TELEFÓNICA DE ESPAÑA SAU
Non-compliance with general data processing principles
決定日期
2024年9月26日
權限
Spanish Data Protection Authority (aepd)
ES
部門
Media, Telecoms and Broadcasting
國家
ES
法律
GDPR狀態
FINAL說明
The Spanish DPA has imposed a fine of EUR 1.3 million on TELEFÓNICA DE ESPAÑA SAU. The controller had reported a security incident to the DPA, stating that they had suffered a cyber attack that allowed unauthorised third parties to access personal customer data via an employee's account. During its investigation, the DPA found that the controller had failed to implement appropriate technical and organisational measures to protect personal data that could have prevented such an incident. The fine is composed as follows: EUR 500,000 for the violation of Art. 5 (1) f) GDPR and EUR 800,000 for the violation of Art. 32 GDPR.