- Enforcing jurisdiction
- Spain · Geography does not establish applicable law.
- Confirmed applicable legislation
- No confirmed legal basis recorded.
- Privacy topics
Centros comerciales Carrefour S.A. – No Violation (Spain, 2019)
Privacy enforcement record
This record is classified outside cookie consent. Subject classification does not confirm an applicable law. It is not included in cookie statistics or the Risk Calculator.
Centros comerciales Carrefour S.A. reported a cyberattack to the Spanish data protection authority, but the investigation found no illegal access to their systems. This matters because it shows that even if a company faces a cyberattack, they can still be held responsible for ensuring their systems are secure.
What happened
Carrefour suffered a cyberattack but no illegal access to their information system was found.
Who was affected
Carrefour's users whose information could have been compromised during the cyberattack.
What the authority found
The authority determined that Carrefour must improve its security measures to prevent future incidents.
Why this matters
This case highlights the importance of having strong security measures in place to protect user data. Companies should regularly review and update their security practices to avoid vulnerabilities.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Linked-source text retrieved.
Automated check recorded — 21 March 2026.
Processing notes: articles corrected, authority corrected.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
The AEPD received a data breach notification sent by Centros comerciales Carrefour S.A. (Carrefour) in which they inform having suffered from a cyberattack. Thus, the AEPED carried out an investigation. Th AEPD found there was no evidence showing illegal access to the Carrefour information system. Also, it issued that the attacker obtained the user code and password to access to Carrefours' information system through external fraudulent databases. The use of this database allowed the attacker to act without being detected by the security measures that Carrefour had implemented so far. However, the AEPD found that Carrefour has to implement suitable and appropriate measures to avoid such incidents. Consequently, Carrefour has been ordered to update its internal digital process to avoid as many vulnerabilities as possible. Finally, the AEPD considered that Carrefour is the responsible entity and is needs to ensure compliance with the GDPR.
Outcome
No Violation
The DPA investigated and found no violation.
Related Enforcement Actions (0)
No other enforcement actions found for Centros comerciales Carrefour S.A. in ES
This is the only recorded action for this entity in this jurisdiction.
Details
Decision Date
6 November 2019
Authority
Agencia Española de Protección de Datos
About this data
Cite as: Cookie Fines. Centros comerciales Carrefour S.A. - Spain (2019). Retrieved from cookiefines.eu
Last updated: