Enforcement · Spanish Data Protection Authority (aepd) EN LLM context A cited markdown file you can paste into your AI assistant (ChatGPT, Claude, a RAG or project knowledge base) to ground it in this document. Contains: this document’s text, its sections with their topics, and the full text of every law provision it applies. Everything links back to its source on overview.legal — legal information, not advice.

CARTONAJES BAÑERES, S.A.: Insufficient technical and organisational measures to ensure information security

€220,000 Fine
CARTONAJES BAÑERES, S.A.
SPAIN
Art. 15 GDPR Art. 35 GDPR
Personal Data Employees Biometric Data Biometric Data Controllers Security Special Categories of Data Processing Agreement
Nov 22, 2024 Source

How it connects

Related across sources

News De Autoriteit Persoonsgegevens publiceert een rapport over de risicoanalyse van de AVG (Algemene Verordening Gegevensbescherming). AEPD News Danish SA Declares Use of Google Analytics Unlawful Without Supplementary Measures Datatilsynet News De Deense beschermingsautoriteit (SA) heeft verklaard dat het gebruik van Google Analytics onrechtmatig is zonder aanvullende maatregelen. Datatilsynet News Irish Data Protection Commissioner Fines Instagram EUR 405M for Children Privacy Violations Hunton Andrews Kurth Guidance EDPB Annual Report 2021 EDPB Guidance EDPB Annual Report 2019 EDPB

Full text

The Spanish DPA imposed a fine of EUR 220,000 on CARTONAJES BAÑERES, S.A. following a complaint filed by a former employee. The employee had submitted a request to the controller for access to their personal data, particularly inquiring about the purpose and categories of data held. However, they did not receive a proper response. The employee also stated that the controller used a biometric facial recognition system that allowed employees to clock in and out, but did not offer an alternative method of recording attendance. During its investigation, the DPA found that the controller had failed to properly comply with the data subject's request for access to their personal data. Furthermore, the DPA found that the controller had failed to carry out a risk assessment of the biometric system, which would have been necessary considering the risks that the processing of biometric data poses to data subjects.

Industry: Employment

Original document at the source www.aepd.es

Similar Content