Spain

UST GLOBAL ESPAÑA, S.A.

3,000 €

GDPR enforcement action by Spanish Data Protection Authority (aepd) on 2021-07-27.

Rank · Sector

#156

of 213 in Employment

Rank · Spain

#620

of 1,075

Rank · All fines

#2,042

of 3,050

Case details

Authority: Spanish Data Protection Authority (aepd)
Date: 2021-07-27
Controller / Processor: UST GLOBAL ESPAÑA, S.A.
Sector: Employment
Quoted Articles: Art. 5 (1) f) GDPR
Type of violation: Non-compliance with general data processing principles

Summary

The Spanish DPA (AEPD) has imposed a fine of EUR 3,000 on UST GLOBAL ESPAÑA, S.A.. An employee filed a complaint against the controller with the DPA. UST GLOBAL ESPAÑA, S.A. was acting as a service provider for OpenBank as part of a project. On 08.01.2020, the controller informed OpenBank by email that two new employees (one of them the complainant) would join the project, for which it requested access to the VPN and other applications. This email, which was sent with a copy to both employees, included their first and last names, professional email addresses, and ID card numbers. This way, both gained mutual unauthorized access to their colleague's data. The DPA considered this to be a violation of the principle of integrity and confidentiality.

Open original source Links to the regulator's original publication or another source.