Spain

CARTONAJES BAÑERES, S.A

220,000 €

GDPR enforcement action by Spanish Data Protection Authority (aepd) on 2024-11-22.

Rank · Sector

#13

of 213 in Employment

Rank · Spain

#53

of 1,075

Rank · All fines

#335

of 3,050

Case details

Authority: Spanish Data Protection Authority (aepd)
Date: 2024-11-22
Controller / Processor: CARTONAJES BAÑERES, S.A
Sector: Employment
Quoted Articles: Art. 15 GDPR, Art. 35 GDPR
Type of violation: Insufficient technical and organisational measures to ensure information security

Summary

The Spanish DPA has fined CARTONAJES BAÑERES, S.A. EUR 220,000. During its investigation, the DPA found that the controller had failed to grant a former employee access to their personal data. The DPA also found that the controller had failed to carry out a data protection impact assessment regarding the operation of a biometric facial recognition system installed to track working hours.

Open original source Links to the regulator's original publication or another source.