Sanction RGPD Spanish Data Protection Authority (aepd) — ENDESA ENERGÍA, S.A.U. : 6,1 M€ (2023)
- Autorité de contrôle
- Spanish Data Protection Authority (aepd)
- Pays
- Espagne
- Entreprise / secteur
- ENDESA ENERGÍA, S.A.U.
- Montant de l'amende
- 6,1 M€
- Date de la décision
- 25 octobre 2023
- Fondement juridique
- Art. 5 (1) f), Art. 32, Art. 33, Art. 34, Art. 44
- Manquement
- Non-respect des principes de traitement
Résumé des faits
The Spanish DPA has fined ENDESA ENERGÍA, S.A.U. EUR 6,1 million due to a security breach resulting in unauthorized access to its systems. The controller had informed the DPA that certain Facebook ads had been placed offering the sale of login credentials for the Endesa platform, resulting in the compromise of data such as names, first names, ID numbers, telephone numbers, email addresses, postal addresses, bank account numbers, of millions of individuals. The DPA found that the controller had failed to implement appropriate technical and organizational measures to protect personal data in order to prevent such incidents. In addition, the controller failed to inform the DPA and the data subjects of the security incident in a timely manner. Finally, the DPA found that the controller did not implement adequate safeguards for the transfer of personal data to countries not covered by an adequacy decision of the EU Commission.