- Enforcing jurisdiction
- Spain · Geography does not establish applicable law.
- Confirmed applicable legislation
- Privacy topics
IBERMUTUA, MUTUA COLABORADORA CON LA SEGURIDAD SOCIAL NUM.274. – €600,000 Fine (Spain, 2025)
Privacy enforcement record
This record is classified outside cookie consent. Subject classification does not confirm an applicable law. It is not included in cookie statistics or the Risk Calculator.
A Spanish DPA fined IBERMUTUA for a data breach that exposed personal health information of over 3,000 individuals. This case is significant because it shows the importance of protecting sensitive data. Organizations must implement strong security measures to prevent such incidents.
What happened
IBERMUTUA was fined for unlawfully transferring personal data due to a technical error on its platform.
Who was affected
3,395 individuals whose personal and health information was exposed to unauthorized recipients.
What the authority found
The DPA found that IBERMUTUA failed to implement adequate security measures to protect personal data.
Why this matters
This ruling highlights the critical need for organizations to safeguard personal data. Companies should regularly assess their security protocols to prevent data breaches.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Linked-source text retrieved.
Automated check recorded — 6 March 2026.
Processing notes: national law identified.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
The Spanish DPA has imposed a fine on IBERMUTUA, MUTUA COLABORADORA CON LA SEGURIDAD SOCIAL NUM.274. Due to a technical error in its online platform, personal data, including health information, of 3,395 individuals was unlawfully transferred to 354 recipients. The DPA found that the controller had failed to implement appropriate technical and organisational measures to protect personal data that could have prevented such an incident. The original fine of EUR 1 million was reduced to EUR 600,000 due to voluntary payment and admission of responsibility.
Related Enforcement Actions (0)
No other enforcement actions found for IBERMUTUA, MUTUA COLABORADORA CON LA SEGURIDAD SOCIAL NUM.274. in ES
This is the only recorded action for this entity in this jurisdiction.
Details
Fine Date
25 February 2025
Authority
Agencia Española de Protección de Datos
Fine Amount
€600,000
Enforcement Tracker ID
ETid-2574
About this data
Cite as: Cookie Fines. IBERMUTUA, MUTUA COLABORADORA CON LA SEGURIDAD SOCIAL NUM.274. - Spain (2025). Retrieved from cookiefines.eu
Last updated: