Nokia says phones sent user data to China by mistake
- 5 years ago
HELSINKI — Finland's Data Protection Ombudsman is investigating HMD Global over claims that its Nokia 7 Plus phones sent user data to China.
NRK reports that based on a tip from a phone owner, Nokia 7 Plus phones sent out unencrypted data, which includes location, sim card, and the phone's serial number.
The data packages were sent to a server in China owned by China Telecom.
According to Nokia, phones purchased in regions like the EU, U.S., and India send data for phone warranty and diagnostics to HMD Global servers in Singapore. Data from phones bought in China are sent to servers in China in order to comply with the country's Cyber Security Law.
According to a statement from HMD Global, the Chinese device activation client was mistakenly installed on a single batch of Nokia 7 Plus phones that were meant for countries outside China.
Reuters reports that the Finnish investigation would look into whether any data rules that involved personal information were breached and if there has been a legal justification for it.
The company says no personally identifiable data was processed or shared to a third party, and claim the error was fixed in February by switching the client to the correct country variant.
NRK reports that based on a tip from a phone owner, Nokia 7 Plus phones sent out unencrypted data, which includes location, sim card, and the phone's serial number.
The data packages were sent to a server in China owned by China Telecom.
According to Nokia, phones purchased in regions like the EU, U.S., and India send data for phone warranty and diagnostics to HMD Global servers in Singapore. Data from phones bought in China are sent to servers in China in order to comply with the country's Cyber Security Law.
According to a statement from HMD Global, the Chinese device activation client was mistakenly installed on a single batch of Nokia 7 Plus phones that were meant for countries outside China.
Reuters reports that the Finnish investigation would look into whether any data rules that involved personal information were breached and if there has been a legal justification for it.
The company says no personally identifiable data was processed or shared to a third party, and claim the error was fixed in February by switching the client to the correct country variant.