US Vendor Accused of Violating GDPR By Reputation-Scoring EU Citizens

TeleSign, a U.S.-based fraud prevention company, has allegedly collected data from millions of EU citizens and processed it in the United States using automated tools without their knowledge. The complaint "alleges that TeleSign is in violation of the GDPR's provisions that ban use of automated profiling tools, as well as rules that require affirmative consent be given to process EU citizen's data," reports The Register. From the report: The complaint was filed by Austrian privacy advocacy group noyb, helmed by lawyer Max Schrems, and it doesn't pull any punches in its claims that TeleSign, through its former Belgian parent company BICS, secretly collected data on cellphone users around the world. That data, noyb alleges, was fed into an automated system that generates "reputation scores" that TeleSign sells to its customers, which includes TikTok, Salesforce, Microsoft and AWS, among others, for verifying the identity of a person behind a phone number and preventing fraud. BICS, which acquired TeleSign in 2017, describes itself as "a global provider of international wholesale connectivity and interoperability services," in essence operating as an interchange for various national cellular networks. Per noyb, BICS operates in more than 200 countries around the world and "gets detailed information (e.g. the regularity of completed calls, call duration, long-term inactivity, range activity, or successful incoming traffic) [on] about half of the worldwide mobile phone users." That data is regularly shared with TeleSign, noyb alleges, without any notification to the customers whose data is being collected and used. "Your phone provider likely forwards data to BICS who then forwards it to TeleSign. TeleSign generates a 'trust score' about you and sells phone data to third parties like Microsoft, Salesforce or TikTok -- without anyone being informed or giving consent," Schrems said. [...] When BICS acquired TeleSign in 2017, it began to fall under the partial control of BICS' parent company, Belgian telecom giant Proximus. Proximus held a partial stake in BICS, which Proximus spun off from its own operations in 1997. In 2021, Proximus bought out BICS' other shareholders, making it the sole owner of both the telecom interchange and TeleSign. With that in mind, noyb is also leveling charges against Proximus and BICS. In its complaint, noyb said Proximus was asked by EU citizens from various countries to provide records of the data TeleSign processed, as is their right under Article 15 of the GDPR. [...] Noyb is seeking cessation of all data transfers from BICS to TeleSign, processing of said data, and is requesting deletion of all unlawfully transmitted data. It's also asking for Belgian data protection authorities to fine Proximus, which noyb said could reach as high as $257 million -- a mere 4 percent of Proximus's global turnover.

Read more of this story at Slashdot.