Enforcement · Spanish Data Protection Authority (aepd) EN LLM context A cited markdown file you can paste into your AI assistant (ChatGPT, Claude, a RAG or project knowledge base) to ground it in this document. Contains: this document’s text, its sections with their topics, and the full text of every law provision it applies. Everything links back to its source on overview.legal — legal information, not advice.
HISPAPOST, S.A.: Insufficient fulfilment of data breach notification obligations
How it connects
Related across sources
Guidance Guidelines 10/2020 on restrictions under Article 23 GDPR Guidance Opinion 14/2019 on the draft Standard Contractual Clauses submitted by the DK SA (Article 28(8) GDPR) Guidance Guidelines 07/2022 on certification as a tool for transfers Guidance EDPB Annual Report 2021 Guidance Guidelines 07/2020 on the concepts of controller and processor in the GDPR Guidance Guidelines 2/2020 on articles 46 (2) (a) and 46 (3) (b) of Regulation 2016/679 for transfers of personal data between EEA and non-EEA public authorities and bodies
Full text
The Spanish DPA has imposed a fine on HISPAPOST, S.A.. The police had found over a thousand abandoned letters containing the Hispapost logo. Hispapost had been contracted by several companies to deliver the letters. During its investigation, the DPA found that Hispapost, as a processor, had failed to report the data protection incident to the data controllers in a timely manner. The original fine of EUR 60,000 was reduced to EUR 36,000 due to admission of responsibility and voluntary payment.
Industry: Transportation and Energy
Original document at the source www.aepd.es