Spain

Automecanica Jerez, S.L.

4,000 €

GDPR enforcement action by Spanish Data Protection Authority (aepd) on 2021-09-02.

Rank · Sector

#325

of 599 in Industry and Commerce

Rank · Spain

#564

of 1,078

Rank · All fines

#1,911

of 3,059

Case details

Authority: Spanish Data Protection Authority (aepd)
Date: 2021-09-02
Controller / Processor: Automecanica Jerez, S.L.
Sector: Industry and Commerce
Quoted Articles: Art. 5 (1) f) GDPR, Art. 32 GDPR, Art. 21 LSSI
Type of violation: Insufficient technical and organisational measures to ensure information security

Summary

The Spanish DPA (AEPD) has fined Automecanica Jerez, S.L. EUR 4,000. The controller had sent commercial e-mails to a large number of people without their consent. In doing so, the controller failed to hide the personal data of the recipients, such as surname, first name and email address, which allowed the other recipients to view the data. The AEPD considered this to be a violation of Article 5 (1) f) GDPR and Article 32 GDPR, as the controller had failed to implement technical and organizational measures to ensure an adequate level of security in the processing of personal data. Furthermore the AEPD found a breach of Art. 21 LSSI.

Open original source Links to the regulator's original publication or another source.