Sanction RGPD Spanish Data Protection Authority (aepd) — IBERDROLA, S.A. : 3,0 M€ (2024)
- Autorité de contrôle
- Spanish Data Protection Authority (aepd)
- Pays
- Espagne
- Entreprise / secteur
- IBERDROLA, S.A.
- Montant de l'amende
- 3,0 M€
- Date de la décision
- 7 février 2024
- Fondement juridique
- Art. 5 (1) f), Art. 32
- Manquement
- Non-respect des principes de traitement
Résumé des faits
The Spanish DPA has fined IBERDROLA, S.A. EUR 3 million following a cyberattack on I-DE Redes, which led to the compromise of customer data from millions of individuals. Although the cyberattack targeted the GEA web application of I-DE Redes, Iberdrola, as the entity responsible for managing the group's IT systems and security infrastructure, was found to have failed in implementing sufficient security measures to prevent the incident.