Sanction RGPD Spanish Data Protection Authority (aepd) — TELEFÓNICA DE ESPAÑA SAU : 1,3 M€ (2024)
- Autorité de contrôle
- Spanish Data Protection Authority (aepd)
- Pays
- Espagne
- Entreprise / secteur
- TELEFÓNICA DE ESPAÑA SAU
- Montant de l'amende
- 1,3 M€
- Date de la décision
- 26 septembre 2024
- Fondement juridique
- Art. 5 (1) f), Art. 5 (1) c)
- Manquement
- Non-respect des principes de traitement
Résumé des faits
The Spanish DPA has imposed a fine of EUR 1.3 million on TELEFÓNICA DE ESPAÑA SAU. The controller had reported a security incident to the DPA, stating that they had suffered a cyber attack that allowed unauthorised third parties to access personal customer data via an employee's account. During its investigation, the DPA found that the controller had failed to implement appropriate technical and organisational measures to protect personal data that could have prevented such an incident. The fine is composed as follows: EUR 500,000 for the violation of Art. 5 (1) f) GDPR and EUR 800,000 for the violation of Art. 32 GDPR.