Spain

TELEFÓNICA DE ESPAÑA SAU

1,300,000 €

GDPR enforcement action by Spanish Data Protection Authority (aepd) on 2024-09-26.

Rank · Sector

#45

of 369 in Media, Telecoms and Broadcasting

Rank · Spain

#27

of 1,075

Rank · All fines

#152

of 3,050

Case details

Authority: Spanish Data Protection Authority (aepd)
Date: 2024-09-26
Controller / Processor: TELEFÓNICA DE ESPAÑA SAU
Sector: Media, Telecoms and Broadcasting
Quoted Articles: Art. 5 (1) f) GDPR, Art. 5 (1) c) GDPR
Type of violation: Non-compliance with general data processing principles

Summary

The Spanish DPA has imposed a fine of EUR 1.3 million on TELEFÓNICA DE ESPAÑA SAU. The controller had reported a security incident to the DPA, stating that they had suffered a cyber attack that allowed unauthorised third parties to access personal customer data via an employee's account. During its investigation, the DPA found that the controller had failed to implement appropriate technical and organisational measures to protect personal data that could have prevented such an incident. The fine is composed as follows: EUR 500,000 for the violation of Art. 5 (1) f) GDPR and EUR 800,000 for the violation of Art. 32 GDPR.

Open original source Links to the regulator's original publication or another source.