No personal data on reissued SIM cards (2022-05-02)

Summary

This is a case summary published by the Cayman Islands Ombudsman describing the outcome of an informal resolution into a data protection complaint. A complainant alleged that a telecoms company resold a SIM card containing his personal data, allowing a third party to access his accounts and contact his social media contacts.

The Ombudsman's investigation found the complaint had no merit: the telecoms company does not resell SIM cards. Dormant phone numbers (not SIM cards) are returned to a pool after 90 days for reassignment, and newly issued SIM cards contain no data from the previous owner, so the alleged access could not have occurred as described.

Rather than imposing any requirement on the telecoms company, the Ombudsman recommended that the complainant himself improve personal security practices, such as using two-factor authentication or a non-reassignable personal email address for app accounts.

Applies to

telecommunications companies