[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fCQcWpmGdE-GymGsHbYexVN7kDcGHQzjfnlj-yRnPYYg":3},{"article":4,"iocs":46,"watch_terms":47,"solutions":48,"lesson":135},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":20,"category":21,"article_tags":25},"6a70a9fc-a8ac-4f34-bb47-47725363ddd0","AEPD (Spain) - PS-00140-2025","aepd-spain-ps-00140-2025-93862a","← Older revision Revision as of 10:55, 29 July 2026 Line 100: Line 100: }} }} The DPA fined a genomics and biotechnology company €2.4 million for failing to adequately protect sensitive genetic and health data and for notifying a personal data breach after the 72-hour deadline. The DPA fined a genomics and biotechnology company €2.4 million for failing to adequately protect sensitive genetic and health data and for notifying the DPA about a personal data breach after the 72-hour deadline. == English Summary == == English Summary == Line 122: Line 122: First, the DPA found a violation of [[Article 5 GDPR|Article 5(1)(f) GDPR]]. The controller had failed to process personal data in a manner ensuring appropriate integrity and confidentiality. The adequacy of its security measures had to be assessed in light of Articles 24(1) and 32 GDPR and the risk-based approach established by the GDPR. First, the DPA found a violation of [[Article 5 GDPR|Article 5(1)(f) GDPR]]. The controller had failed to process personal data in a manner ensuring appropriate integrity and confidentiality. The adequacy of its security measures had to be assessed in light of Articles 24(1) and 32 GDPR and the risk-based approach established by the GDPR. The DPA emphasised that the affected information included genetic data, health data and data revealing ethnic origin, which constitute special categories of personal data under [[Article 9 GDPR|Article 9 GDPR]]. Given the sensitivity of this information and the potential consequences of unauthorised disclosure, the controller was required to implement particularly robust security measures. The DPA emphasised that the affected information included genetic data, health data and data revealing ethnic origin, which constitute special categories of personal data under [[Article 9 GDPR]]. Given the sensitivity of this information and the potential consequences of unauthorised disclosure, the controller was required to implement particularly robust security measures. Nevertheless, the controller did not impose specific password-strength requirements or require passwords to be changed periodically. Although it had implemented multi-factor authentication, its use remained optional. Moreover, it had not introduced additional controls or limits concerning account access, access requests or the downloading of sensitive information. These deficiencies made unauthorised access more difficult to detect and facilitated the extraction of the compromised data. Nevertheless, the controller did not impose specific password-strength requirements or require passwords to be changed periodically. Although it had implemented multi-factor authentication, its use remained optional. Moreover, it had not introduced additional controls or limits concerning account access, access requests or the downloading of sensitive information. These deficiencies made unauthorised access more difficult to detect and facilitated the extraction of the compromised data. Line 130: Line 130: Although customers were responsible for using their credentials appropriately, the controller remained responsible for assessing the risks and implementing security measures appropriate to the nature of the processing. Credential theft was a well-known attack vector, particularly relevant where account access allowed users to view or download genetic and health information. Although customers were responsible for using their credentials appropriately, the controller remained responsible for assessing the risks and implementing security measures appropriate to the nature of the processing. Credential theft was a well-known attack vector, particularly relevant where account access allowed users to view or download genetic and health information. Second, the DPA found a violation of [[Article 33 GDPR|Article 33 GDPR]]. It considered that the controller became aware of the personal data breach on 5 October 2023, when it confirmed that one of the records published online belonged to one of its customers. At that point, it had a reasonable degree of certainty that a security incident involving personal data had occurred. Second, the DPA found a violation of [[Article 33 GDPR]]. It considered that the controller became aware of the personal data breach on 5 October 2023, when it confirmed that one of the records published online belonged to one of its customers. At that point, it had a reasonable degree of certainty that a security incident involving personal data had occurred. The controller’s subsequent actions, including publishing an alert, notifying US authorities and requiring password resets, further demonstrated that it was already aware of the breach. However, it did not notify the DPA until 17 October, substantially exceeding the 72-hour deadline. The controller’s subsequent actions, including publishing an alert, notifying US authorities and requiring password resets, further demonstrated that it was already aware of the breach. However, it did not notify the DPA until 17 October, substantially exceeding the 72-hour deadline. Line 138: Line 138: The DPA imposed a total administrative fine of €2,400,000: The DPA imposed a total administrative fine of €2,400,000: - €2,000,000 for the violation of [[Article 5 GDPR|Article 5(1)(f) GDPR]]; - €2,000,000 for the violation of [[Article 5 GDPR|Article 5(1)(f) GDPR]]; - €400,000 for the violation of [[Article 33 GDPR|Article 33 GDPR]]. - €400,000 for the violation of [[Article 33 GDPR]].","Spain's Data Protection Agency (AEPD) has fined a genomics and biotechnology company €2.4 million for failing to implement adequate security measures for sensitive genetic and health data. The company also violated GDPR by notifying the AEPD of a personal data breach after the mandatory 72-hour deadline. The AEPD highlighted deficiencies in password policies and optional multi-factor authentication as contributing factors.","Spain's AEPD fines a genomics company €2.4M for data protection and breach notification failures.","https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=AEPD_(Spain)_-_PS-00140-2025&diff=52546&oldid=52492","https:\u002F\u002Fgdprhub.eu\u002Fimages\u002F5\u002F59\u002FLogoES.jpg","2026-07-29T10:55:18+00:00","2026-07-29T12:00:19.778395+00:00",7,[17],{"name":18,"type":19},"AEPD","vendor","53f9c4b6-8bc6-4964-9169-d09e5cd41d72",{"id":20,"icon":22,"name":23,"slug":24},null,"Compliance","compliance",[26,31,36,41],{"category":27},{"id":28,"icon":22,"name":29,"slug":30},"2e06f76c-d5b9-4f54-9eef-4d3447b10730","Breaches","breaches",{"category":32},{"id":33,"icon":22,"name":34,"slug":35},"3f0f8451-91df-4b6c-9a73-ef3b2509b7f1","GDPR","gdpr",{"category":37},{"id":38,"icon":22,"name":39,"slug":40},"c5c77cdb-f7d7-4990-9436-c81dcbff1163","Policy","policy",{"category":42},{"id":43,"icon":22,"name":44,"slug":45},"d95477d7-eb04-4fad-a2dc-be1428040ce7","Privacy Fines","privacy-fines",[],[18],{"controls":49,"vendors":134},[50,79,108],{"slug":51,"name":52,"problem":53,"products":54},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",[55,63,71],{"vendor_slug":56,"vendor_name":57,"vendor_logo":58,"product_slug":59,"product_name":60,"url":61,"description":62},"yubico","Yubico","\u002Fvendor-logos\u002Fyubico.png","yubikey","YubiKey","https:\u002F\u002Fwww.yubico.com\u002Fproducts\u002F","Hardware security keys for FIDO2, passkeys and smart card login, in USB and NFC versions.",{"vendor_slug":64,"vendor_name":65,"vendor_logo":66,"product_slug":67,"product_name":68,"url":69,"description":70},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","workforce-identity","Okta Workforce Identity","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fworkforce-identity\u002F","Single sign-on, adaptive MFA including phishing-resistant methods, and lifecycle management for employees.",{"vendor_slug":72,"vendor_name":73,"vendor_logo":74,"product_slug":75,"product_name":76,"url":77,"description":78},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","entra-id","Microsoft Entra ID","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fidentity-access\u002Fmicrosoft-entra-id","Cloud identity and access management with single sign-on, conditional access, passkeys and identity governance.",{"slug":80,"name":81,"problem":82,"products":83},"security-monitoring-siem","Security monitoring (SIEM)","Logs from everywhere end up in one place, with alerts that someone actually sees.",[84,92,100],{"vendor_slug":85,"vendor_name":86,"vendor_logo":87,"product_slug":88,"product_name":89,"url":90,"description":91},"vega","Vega","\u002Fvendor-logos\u002Fvega.png","vega-agentic-detection","Agentic Detection","https:\u002F\u002Fvega.io\u002Fplatform\u002Fagentic-detection","Detection rules that run across security data in the stores where it already lives, so logs do not have to be moved into a central SIEM first.",{"vendor_slug":93,"vendor_name":94,"vendor_logo":95,"product_slug":96,"product_name":97,"url":98,"description":99},"google","Google","\u002Fvendor-logos\u002Fgoogle.png","google-security-operations","Google Security Operations","https:\u002F\u002Fcloud.google.com\u002Fsecurity\u002Fproducts\u002Fsecurity-operations","Cloud SIEM and SOAR, formerly Chronicle.",{"vendor_slug":101,"vendor_name":102,"vendor_logo":103,"product_slug":104,"product_name":105,"url":106,"description":107},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","cortex-xsiam","Cortex XSIAM","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fcortex\u002Fcortex-xsiam","AI-driven security operations platform that centralises security data, detection, automation and response for the SOC.",{"slug":109,"name":110,"problem":111,"products":112},"encryption-key-management","Encryption and key management","Stolen data stays unreadable, and the keys stay under your control.",[113,121,129],{"vendor_slug":114,"vendor_name":115,"vendor_logo":116,"product_slug":117,"product_name":118,"url":119,"description":120},"utimaco","Utimaco","\u002Fvendor-logos\u002Futimaco.png","utimaco-hsm","Utimaco General Purpose HSM","https:\u002F\u002Futimaco.com\u002Fdata-protection\u002Fgp-hsm","Hardware security modules for key generation, storage and cryptographic operations.",{"vendor_slug":122,"vendor_name":123,"vendor_logo":124,"product_slug":125,"product_name":126,"url":127,"description":128},"thales","Thales","\u002Fvendor-logos\u002Fthales.png","luna-hsm","Thales Luna HSM","https:\u002F\u002Fcpl.thalesgroup.com\u002Fencryption\u002Fhardware-security-modules","Hardware security modules for protecting cryptographic keys.",{"vendor_slug":122,"vendor_name":123,"vendor_logo":124,"product_slug":130,"product_name":131,"url":132,"description":133},"ciphertrust","CipherTrust Data Security Platform","https:\u002F\u002Fcpl.thalesgroup.com\u002Fencryption\u002Fdata-security-platform","Data discovery, encryption and central key management across on-premises and cloud.",[],{"slug":136,"title":137,"body":138,"framework_refs":139,"framework_notes":153},"24m-gdpr-fine-for-genomics-firm-over-weak-security-controls-and-late-breach-notification","€2.4M GDPR Fine for Genomics Firm Over Weak Security Controls and Late Breach Notification","A Spanish genomics and biotechnology company was fined €2.4 million by the AEPD for failing to adequately protect highly sensitive genetic and health data — among the most protected categories under GDPR. Weak password policies and optional (rather than mandatory) multi-factor authentication left the organization exposed to unauthorized access. Compounding the violation, the company failed to notify the AEPD within the mandatory 72-hour breach notification window, demonstrating a breakdown in incident response preparedness. This case underscores that organizations handling special category data under GDPR Article 9 face heightened obligations and significantly greater penalties when basic security hygiene and response procedures are neglected.",[140,141,142,143,144,145,146,147,148,149,150,151,152],"GDPR Article 5(1)(f) — Integrity and confidentiality principle","GDPR Article 9 — Processing of special categories of personal data","GDPR Article 25 — Data protection by design and by default","GDPR Article 32 — Security of processing","GDPR Article 33 — Notification of a personal data breach to the supervisory authority","NIST SP 800-53 AC-2 (Account Management)","NIST SP 800-53 IA-5 (Authenticator Management)","NIST SP 800-53 IR-6 (Incident Reporting)","CIS Control 5 — Account Management","CIS Control 6 — Access Control Management","CIS Control 17 — Incident Response Management","ISO\u002FIEC 27001:2022 A.9 (Access Control)","ISO\u002FIEC 27001:2022 A.5.24 (Information Security Incident Management)",{}]