Enforcement · Spanish Data Protection Authority (aepd) EN LLM context A cited markdown file you can paste into your AI assistant (ChatGPT, Claude, a RAG or project knowledge base) to ground it in this document. Contains: this document’s text, its sections with their topics, and the full text of every law provision it applies. Everything links back to its source on overview.legal — legal information, not advice.

ENDESA ENERGÍA, S.A.U.: Non-compliance with general data processing principles

€6,100,000 Fine
ENDESA ENERGÍA, S.A.U.
SPAIN
Art. 5 GDPR Art. 32 GDPR Art. 33 GDPR Art. 34 GDPR Art. 44 GDPR
Integrity and Confidentiality Principle Data Breaches Social Media Privacy Shield IP Address Security Processing Agreement Privacy by Design & Default
Oct 25, 2023 Source

How it connects

Related across sources

Guidance Guidelines 07/2022 on certification as a tool for transfers EDPB News De Deense beschermingsautoriteit (SA) heeft verklaard dat het gebruik van Google Analytics onrechtmatig is zonder aanvullende maatregelen. Datatilsynet News Danish SA Declares Use of Google Analytics Unlawful Without Supplementary Measures Datatilsynet Guidance EDPB Annual Report 2021 EDPB Guidance Guidelines 07/2020 on the concepts of controller and processor in the GDPR EDPB Case Law HvJ EU: Privacy Shield ongeldig verklaard (Schrems II) Hof van Justitie EU

Full text

The Spanish DPA has fined ENDESA ENERGÍA, S.A.U. EUR 6,1 million due to a security breach resulting in unauthorized access to its systems. The controller had informed the DPA that certain Facebook ads had been placed offering the sale of login credentials for the Endesa platform, resulting in the compromise of data such as names, first names, ID numbers, telephone numbers, email addresses, postal addresses, bank account numbers, of millions of individuals. The DPA found that the controller had failed to implement appropriate technical and organizational measures to protect personal data in order to prevent such incidents. In addition, the controller failed to inform the DPA and the data subjects of the security incident in a timely manner. Finally, the DPA found that the controller did not implement adequate safeguards for the transfer of personal data to countries not covered by an adequacy decision of the EU Commission.

Industry: Transportation and Energy

Original document at the source www.aepd.es

Similar Content