Spain

BAYARD REVISTAS, S.A.

31,200 €

GDPR enforcement action by Spanish Data Protection Authority (aepd) on 2022-09-28.

Rank · Sector

#245

of 369 in Media, Telecoms and Broadcasting

Rank · Spain

#294

of 1,075

Rank · All fines

#878

of 3,050

Case details

Authority: Spanish Data Protection Authority (aepd)
Date: 2022-09-28
Controller / Processor: BAYARD REVISTAS, S.A.
Sector: Media, Telecoms and Broadcasting
Quoted Articles: Art. 5 (1) f) GDPR, Art. 32 GDPR, Art. 33 GDPR
Type of violation: Insufficient technical and organisational measures to ensure information security

Summary

The Spanish DPA has imposed a fine on Bayard Revistas S.A.. Unauthorized persons had accessed the Bayard database and thus unauthorizedly siphoned off location and contact data of users of the database. Approximately 470,000 users were affected by the incident. The DPA's investigation determined that a vulnerability in the controller's systems allowed the incident to occur. The original fine of EUR 52,000 was reduced to EUR 31,200 due to voluntary payment and admission of guilt.

Open original source Links to the regulator's original publication or another source.