Sanction RGPD Spanish Data Protection Authority (aepd) — AIO E-COMMERCE, S.L. : 6 k€ (2022)
- Autorité de contrôle
- Spanish Data Protection Authority (aepd)
- Pays
- Espagne
- Entreprise / secteur
- AIO E-COMMERCE, S.L.
- Montant de l'amende
- 6 k€
- Date de la décision
- 26 octobre 2022
- Fondement juridique
- Art. 5 (1) c), f)
- Manquement
- Non-respect des principes de traitement
Résumé des faits
The Spanish DPA has imposed a fine on AIO E-COMMERCE, S.L.. The controller had suffered a data breach resulting in personal data such as bank details being siphoned off and subsequently sold on the internet. As part of its investigation, the DPA found that the controller had failed to implement appropriate technical and organizational measures to protect personal data. The DPA also found that the controller had violated the principle of data minimization by storing all digits of the affected credit card numbers rather than just the last four. The original fine of EUR 8,000 was reduced to EUR 6,400 due to voluntary payment.