# Electrotecnica Bastida S.L.: Insufficient technical and organisational measures to ensure information security

- Type: Enforcement
- Source: Spanish Data Protection Authority (aepd)
- Date: 2021-04-05
- Original: https://www.enforcementtracker.com/ETid-622
- Canonical: https://overview.legal/posts/46737
- Topics: Security, Controllers, Privacy by Design & Default, Processing Agreement, Personal Data, Healthcare, Processing, Supervisory Authorities, Law Enforcement, Data Controller

## Summary

The Spanish DPA (AEPD) has fined Electrotecnica Bastida S.L. EUR 3,000. Police officers had found 29 envelopes addressed to the controllers' respective employees on a vacant lot in the local industrial area. Two envelopes had already been opened. The envelopes contained results of medical examinations. The AEPD considered this to be a breach of the controller's duty to implement adequate technical and organizational measures to protect the processing of personal data.

## Full text

The Spanish DPA (AEPD) has fined Electrotecnica Bastida S.L. EUR 3,000. Police officers had found 29 envelopes addressed to the controllers' respective employees on a vacant lot in the local industrial area. Two envelopes had already been opened. The envelopes contained results of medical examinations. The AEPD considered this to be a breach of the controller's duty to implement adequate technical and organizational measures to protect the processing of personal data.

GDPR Articles: Art. 32 (1) GDPR
Industry: Industry and Commerce

---
Generated by overview.legal · https://overview.legal/posts/46737 · 2026-08-22