- Enforcing jurisdiction
- Spain · Geography does not establish applicable law.
- Confirmed applicable legislation
- Privacy topics
TELEFÓNICA DE ESPAÑA SAU – €1,300,000 Fine (Spain, 2024)
Privacy enforcement record
This record is classified outside cookie consent. Subject classification does not confirm an applicable law. It is not included in cookie statistics or the Risk Calculator.
TELEFÓNICA DE ESPAÑA SAU was fined EUR 1.3 million after a cyber attack exposed personal customer data. This incident shows the critical need for companies to protect customer information from unauthorized access. Businesses must implement strong security measures to prevent data breaches.
What happened
TELEFÓNICA DE ESPAÑA SAU suffered a cyber attack that allowed unauthorized access to personal customer data.
Who was affected
Customers of TELEFÓNICA DE ESPAÑA SAU whose personal data was accessed during the cyber attack.
What the authority found
The Spanish DPA found that TELEFÓNICA DE ESPAÑA SAU failed to implement adequate security measures to protect personal data, violating GDPR.
Why this matters
This ruling emphasizes the importance of robust data security practices for companies. It serves as a warning that failing to protect customer data can lead to hefty fines.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Linked-source text retrieved.
Automated check recorded — 5 March 2026.
Processing notes: articles corrected.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
The Spanish DPA has imposed a fine of EUR 1.3 million on TELEFÓNICA DE ESPAÑA SAU. The controller had reported a security incident to the DPA, stating that they had suffered a cyber attack that allowed unauthorised third parties to access personal customer data via an employee's account. During its investigation, the DPA found that the controller had failed to implement appropriate technical and organisational measures to protect personal data that could have prevented such an incident. The fine is composed as follows: EUR 500,000 for the violation of Art. 5 (1) f) GDPR and EUR 800,000 for the violation of Art. 32 GDPR.
Related Enforcement Actions (0)
No other enforcement actions found for TELEFÓNICA DE ESPAÑA SAU in ES
This is the only recorded action for this entity in this jurisdiction.
Details
Fine Date
26 September 2024
Authority
Agencia Española de Protección de Datos
Fine Amount
€1,300,000
Enforcement Tracker ID
ETid-2508
About this data
Cite as: Cookie Fines. TELEFÓNICA DE ESPAÑA SAU - Spain (2024). Retrieved from cookiefines.eu
Last updated: