AFIANZA ASESORES, S.L. – €145,000 Fine (Spain, 2024)

AFIANZA ASESORES, S.L. is a consultancy company engaged in, among other work, the provision of legal advice. A USB stick with a large amount of personal data, including data pertaining to a criminal proceeding, was stolen. The USB was not encrypted. The controller conducted an internal investigation. It informed the Spanish DPA (AEPD) of the incident 13 days after its occurrence. On 2 July 2021, the AEPD ordered the controller to communicate the breach to data subjects. On 24 June 2022, the AEPD initiated sanctioning proceedings against the controller and proposed a sanction of €160,000. The AEPD considered that the controller had suffered a breach resulting in the unauthorized disclosure of personal data. The AEPD noted that it considered the controller’s storage of personal data on a removable device without encryption negligent, resulting in an aggravating factor for the fine. The controller argued that there was no evidence that a third party had ever accessed the information contained in the USB. Instead, the infringing ‘disclosure’ or ‘breach’ was entirely hypothetical. Thus, the controller argued, it could not be proved that any third party ever improperly accessed the information contained in the USB and no breach of confidentiality could be demonstrated. The controller also argued that it protected its data diligently and had adequate security measures in place. For instance, all personnel with access to personal data were instructed of their obligations and responsibilities. It also conducted IT audits to verify appropriate measures and security standards in place. The controller emphasised that Article 32 GDPR does not regulate a closed list of security measures – instead, it requires the controller to apply appropriate measures. It thus challenged the focus of the sanctioning proceedings on the absence of encryption on the USB because it was not an obligatory security measure and this did not take account of the controller’s other security measures. Penalising this, the controller argued, was contrary to the principle of culpability. The controller also defended its delay in notifying the AEPD of the breach, stating that in the 13 days it conducted an internal investigation. It argued that the 72 hour period articulated in Article 33 GDPR is not imperative. The AEPD found that the controller infringed Articles 5(1)(f) and 32 GDPR and imposed a fine of €145,000. Article 5(1)(f) GDPR: The AEPD recognised that the controller had technical and organisational measures in place. It also recognised that the incident occurred as a result of a criminal act – not due to the lack of security measures on the part of the controller. The fact that a third party had overtaken the controller’s security measures does not imply a per se infringement of the controller’s obligations. Controllers, it considered, are bound to obligations concerning measures, not obligations of results. The AEPD considered that the loss of the USB containing unencrypted personal data was itself a breach of confidentiality. The fact that the USB was unencrypted and had no way to restrict unauthorized access supposes the violation of the principle of confidentiality under Article 5(1)(f) GDPR. Article 32 GDPR: The controller argued extensively that it had numerous technical and organisational measures in place for data protection. However, the AEPD noted that with regard to the USB specifically, there was no type of protection measure or impediment to access for unauthorised third parties (such as encryption). In addition, the AEPD noted that it appeared that several security measures were in fact not being observed, permitting the theft of the USB and the breach. Article 32 GDPR is just as breached, the controller noted, when there are no measures adopted as when measures are not properly observed. While the AEPD recognised that the controller had technical and organisational measures in place, it considered it a different issue that on a particular day and due to particular circumstances, some of the security measures were not properly applied. As a company dedicated to providing legal advice, the AEPD noted that the controller handles considerable personal data including those relating to criminal offences and penalties. For these reasons, the controller must take greater care to comply with security obligations. Article 33 GDPR: The AEPD did not find an infringement of Article 33 GDPR because, although the controller exceeded the imperative 72 deadline for reporting the breach to the AEPD, the AEPD did not cite this as an infringement in its resolution to initiate sanctioning proceedings and the limitation period of one year had been exceeded in accordance with national law ([https://www.boe.es/buscar/act.php?id=BOE-A-2018-16673 Law 3/2018]).