Caja Rural de Jaén, Barcelona y Madrid, Sociedad Cooperativa de Crédito

What happened

A Spanish financial institution was fined €500,000 for failing to ensure the confidentiality and security of customer data under Article 5.1(f) GDPR. A cyberattack exposed sensitive data due to inadequate security measures, violating Article 32 GDPR.

Summary from GDPRhub (noyb), written by its volunteers, not by Fino. CC BY-NC-SA 4.0.

Rules involved

• Art. 5Principles relating to processing of personal data5(1)(f)Read →
• Art. 32Security of processingRead →
• Art. 33Notification of a personal data breach to the supervisory authorityRead →
• Art. 83General conditions for imposing administrative fines83(5)(a)Read →

• Data breach
• Data principles
• Data security