Spain

Global Business Travel Spain SLU

5,000 €

GDPR enforcement action by Spanish Data Protection Authority (aepd) on 2020-07-10.

Rank · Sector

#131

of 169 in Transportation and Energy

Rank · Spain

#505

of 1,078

Rank · All fines

#1,714

of 3,059

Case details

Authority: Spanish Data Protection Authority (aepd)
Date: 2020-07-10
Controller / Processor: Global Business Travel Spain SLU
Sector: Transportation and Energy
Quoted Articles: Art. 32 GDPR
Type of violation: Insufficient technical and organisational measures to ensure information security

Summary

The fine was preceded by an employee's access to health data of a person concerned. In the course of its investigations, the Data Protection Authority found that Global Business Travel Spain, as data controller, had infringed Article 32(2) and (4) of the GDPR by failing to take adequate technical and organisational measures to protect the data from unauthorised disclosure.

Open original source Links to the regulator's original publication or another source.