Spain

AIO E-COMMERCE, S.L.

6,400 €

GDPR enforcement action by Spanish Data Protection Authority (aepd) on 2022-10-26.

Rank · Sector

#261

of 597 in Industry and Commerce

Rank · Spain

#456

of 1,075

Rank · All fines

#1,594

of 3,050

Case details

Authority: Spanish Data Protection Authority (aepd)
Date: 2022-10-26
Controller / Processor: AIO E-COMMERCE, S.L.
Sector: Industry and Commerce
Quoted Articles: Art. 5 (1) c), f) GDPR
Type of violation: Non-compliance with general data processing principles

Summary

The Spanish DPA has imposed a fine on AIO E-COMMERCE, S.L.. The controller had suffered a data breach resulting in personal data such as bank details being siphoned off and subsequently sold on the internet. As part of its investigation, the DPA found that the controller had failed to implement appropriate technical and organizational measures to protect personal data. The DPA also found that the controller had violated the principle of data minimization by storing all digits of the affected credit card numbers rather than just the last four. The original fine of EUR 8,000 was reduced to EUR 6,400 due to voluntary payment.

Open original source Links to the regulator's original publication or another source.