I-DE Redes Eléctricas Inteligentes, S.A.U. – €3,500,000 Fine (Spain, 2024)

On 15 March 2022, I-DE Redes Eléctricas Inteligentes, S.A.U. (the controller) detected an attack on its GEA management portal (GEA portal), which is a web portal that manages service connections between the electric distribution network. At that point, the controller had yet to detect any effect on personal data. The following day (16 March), a brute force attack was made against the same webpage, resulting in a general slowdown. The controller adopted security measures in order to repel the attack. The controller analysed the attack’s activity and concluded that it has extracted the personal data of 1.35 million clients. The breached data included names, surnames, email addresses, phone numbers, addresses, national identification card numbers and client codes. On 18 March 2022, the controller notified the breach to the AEPD. The controller is Iberdrola's energy distribution brand. Spanish law concerning the electricity sector requires that regulated activities (such as distribution of electricity) and unregulated activities (such as marketing) be unbundled. In accordance with such law, the controller stated that it could only access the personal data of users of its electric service. It thus claims that it does not have access to the data of data subjects managed by other distribution companies. Despite this separation, the controller communicated the breach to other companies of the Iberdrola group on 28 March 2022, noting that it could have affected information referring to clients of these companies. The controller included internal codes corresponding to the affected clients so that the companies could verify if those clients’ data had been compromised. Two companies, Iberdrola Clientes, S.A. and Curenergía Comercializador de Ultimo Recurso SA, subsequently reported to the AEPD that personal data of 92,550 and 1,515,000 clients was affected, respectively. Due to the numerous companies affected, the AEPD initiated investigations into four entities. The controller requested that its case be joined with the AEPD’s investigation of Iberdrola ([https://www.aepd.es/documento/ps-00221-2023.pdf EXP202305587]). It noted that the attack on its GEA portal was the common security incident that prompted both cases. With regard to the data breach and its security measures, the controller stated that had adopted the totality of security measures established by Iberdrola. It also argued that there had been no harm to the data subjects as a result of the breach. The AEPD found that the controller violated Articles 5(1)(f) and 32 GDPR, imposing a fine of €3,500,000. It began by rejecting the controller’s request for joinder, finding that even though there was a common security incident, the cases involve distinct breaches of different sets of personal data. With regard to the violation of Article 32 GDPR, the AEPD considered that the vulnerability resulting in the data breach was foreseeable and avoidable. The controller failed to carry out an appropriate assessment of the risks of harms to data subjects that were inherent in its processing, and it did not account for risks to confidentiality, availability or integrity of the data. Furthermore, the AEPD noted that there were vulnerabilities in the portal that could have been detected prior to the cyberattack, including an inadequate password policy and a failure to limit access to the portal from suspicious IP addresses. The precise details of the vulnerabilities are redacted in the decision, but the AEPD noted that the shortcomings were exploited in the cyberattack and resulted in the breach. It further stated that the vulnerability could have been identified in security assessments, but that the controller had not conducted a security review of its critical applications since 2019 – over two years before the incident. Due to the shortcomings in security measures that resulted in oversights of the GEA portal’s vulnerabilities, the AEPD found the controller violated Article 32 GDPR. The AEPD also found that the controller violated Article 5(1)(f) GDPR. It focused in particular on the failure to protect confidentiality of the personal data affected. In addition to lacking the security measures discussed above, the controller also did not have technical measures in place, such as pseudonymisation, that corresponded to the detail of the personal data it was regularly processing. The AEPD rejected the argument that none of the data subjects were adversely affected by the breach, emphasizing that the loss of confidentiality is, in of itself, a harm to the fundamental right to data protection.