Spain

CORPORACIÓN DE RADIO Y TELEVISIÓN ESPAÑOLA, S.A. S.M.E.

12,000 €

GDPR enforcement action by Spanish Data Protection Authority (aepd) on 2026-09-18.

Rank · Sector

#304

of 383 in Media, Telecoms and Broadcasting

Rank · Spain

#398

of 1,104

Rank · All fines

#1,361

of 3,197

Case details

Authority: Spanish Data Protection Authority (aepd)
Date: 2026-09-18
Controller / Processor: CORPORACIÓN DE RADIO Y TELEVISIÓN ESPAÑOLA, S.A. S.M.E.
Sector: Media, Telecoms and Broadcasting
Quoted Articles: Art. 25 GDPR
Type of violation: Insufficient technical and organisational measures to ensure information security

Summary

The Spanish DPA has imposed a fine of EUR 12,000 on CORPORACIÓN DE RADIO Y TELEVISIÓN ESPAÑOLA, S.A. S.M.E. The controller had outsourced its recruitment portal to a contractor. The portal used had a contact module through which images could be uploaded. Documents uploaded in this way were accessible to anyone with the link. Some candidates had used this tool to upload their personal data. The controller was informed about the breach by a newspaper and immediately informed the processor, who subsequently shut down the platform. The personal data of 257 people, including names, ID numbers, contact details, CVs, bank account and card numbers and certificates, was affected.

Open original source Links to the regulator's original publication or another source.