Spain

Global Business Travel Spain SLU

5,000 €

GDPR enforcement action by Spanish Data Protection Authority (aepd) on 2020-07-10.

Rank · Sector

#130

of 167 in Transportation and Energy

Rank · Spain

#502

of 1,075

Rank · All fines

#1,709

of 3,050

Case details

Authority: Spanish Data Protection Authority (aepd)
Date: 2020-07-10
Controller / Processor: Global Business Travel Spain SLU
Sector: Transportation and Energy
Quoted Articles: Art. 32 GDPR
Type of violation: Insufficient technical and organisational measures to ensure information security

Summary

The fine was preceded by an employee's access to health data of a person concerned. In the course of its investigations, the Data Protection Authority found that Global Business Travel Spain, as data controller, had infringed Article 32(2) and (4) of the GDPR by failing to take adequate technical and organisational measures to protect the data from unauthorised disclosure.

Open original source Links to the regulator's original publication or another source.