The 95 SIM cards sold by Koh had been registered with the details of 73 people, who had their names, addresses as well as their NRIC, FIN and passport numbers used without their consent. — Pixabay
SINGAPORE: An authorised dealer for mobile phones has been fined a record S$48,000 (RM168,412) for exploiting customers’ personal data to register more SIM cards, without their knowledge or consent, before selling them.
The Personal Data Protection Commission said on Jan 17 that Koh Wei Ming, also known as Muhammad Amin Koh, was found to have illegally sold more than 1,000 of such SIM cards to anonymous buyers over four years. He made an estimated profit of about S$35,000 (RM122,800).
His acts came to light when the commission received nearly 1,400 complaints from the public between February 2020 and September 2021. They had received marketing messages, despite registering on the Do Not Call Register to block such messages, according to the commission’s findings released on Jan 17.
The authority then traced these messages to 95 prepaid SIM cards bought from Koh, who ran Mobile Chat, a shop in Geylang that sold mobile phones and prepaid SIM cards.
It found that Koh had exploited the SIM card registration process to register additional prepaid SIM cards through two ways.
Firstly, he would scan identity documents, like identity cards and passports, twice to register two SIM cards without the customer’s knowledge.
Koh would then hand over only one card to the customer and keep the other to sell to unauthorised buyers.
Secondly, for customers who had completed the registration process but decided not to buy a SIM card, Koh would keep the card instead of cancelling or reversing the registration.
He would then activate it without the customer’s knowledge and sell the card to other buyers.
The 95 SIM cards sold by Koh had been registered with the details of 73 people, who had their names, addresses as well as their NRIC, FIN and passport numbers used without their consent.
However, the commission found that it is likely that the personal data of more people were affected, as Koh admitted that he sold an average of 250 prepaid SIM cards annually over four years.
In deciding the fine for Koh, the commission noted Koh’s breaches of the Personal Data Protection Act were difficult to detect, as these went unnoticed until the customers’ information had been misused to send marketing messages.
As prepaid SIM cards are frequently used to further criminal activities, a supplier of prepaid SIM cards who breaches the act must be dealt with severely to deter others, said the commission.
It also considered the fact that his actions were intentional and took place over a long period of time, had caused inconvenience to innocent parties, and he had made a profit of about S$35,000 (RM122,800).
The commission said Koh had asked for no financial penalty to be imposed due to personal and financial hardship. According to Koh, he was the sole breadwinner of his family and had been seeking treatment at the Institute of Mental Health.
These reasons were not accepted as he did not substantiate his claims.
In September 2023, Koh was also sentenced to 16 months of jail for illegally modifying the contents of M1’s computer system to register pre-paid SIM cards.
Koh had registered SIM cards with a terminal device provided by M1, which was used for registration of such cards before December 2021.
The commission said Koh’s case is the second case involving egregious misuse of individuals’ personal data for illicit activities.
In 2022, another mobile retailer – Yoshi Mobile – was fined S$21,000 (RM73,680) for selling illicit SIM cards that were also used to send unsolicited messages. – The Straits Times (Singapore)/Asia News Network
