EU Digital Rights Organization Noyb has filed a complaint against the Belgian telecommunications company, Bics, and US-based fraud detection company, Telesign, alleging violations of data privacy laws. Noyb claims that Bics and Telesign have been collecting and transmitting mobile phone data from half of the world’s population to develop personalized assessments of people’s reliability without their consent.
A group of unnamed plaintiffs submitted the complaint to the Belgian data protection department through Noyb, stating that their confidentiality was violated. Bics, which cooperates with over 500 mobile operators across more than 200 countries, Telesign, which uses AI for digital identification, and Proximus, the maternal company of BICS and Telesign, are the accused.
Le Soir newspaper had originally reported that Bics collected data on the activity of customers by phone and secretly shared them with Telesign. The data included information such as the type of technology used to make calls or send texts, the frequency of activity, and the duration of calls.
Then, Telesign assessed users with “confidence assessments” using AI algorithms that are supposedly used by tech giants such as Microsoft, SalesForce, and TikTok to determine whether users should be allowed to configure accounts. The company checks over five billion unique telephone numbers every month, covering half of the world’s mobile users.
When the plaintiffs requested data from the company in accordance with the European GDPR Privacy Law, they discovered that Telesign had ranked them based on their telephone activity. For instance, one of the plaintiffs received a “medium-nosed” risk rating. The plaintiffs argued that this rating system violated the GDPR’s ban on profiling individuals using forecasting algorithms.
According to the GDPR, “automated processing of personal data to evaluate certain personal aspects regarding an individual […] for the analysis or forecasting of factors regarding labor productivity, economic situation, health, personal preferences, interests, reliability, behavior, location, or movement of this individual” is prohibited.