TELEFÓNICA DE ESPAÑA SAU – €1,300,000 Fine (Spain, 2024)

The Spanish DPA has imposed a fine of EUR 1.3 million on TELEFÓNICA DE ESPAÑA SAU. The controller had reported a security incident to the DPA, stating that they had suffered a cyber attack that allowed unauthorised third parties to access personal customer data via an employee's account. During its investigation, the DPA found that the controller had failed to implement appropriate technical and organisational measures to protect personal data that could have prevented such an incident. The fine is composed as follows: EUR 500,000 for the violation of Art. 5 (1) f) GDPR and EUR 800,000 for the violation of Art. 32 GDPR.