Cybersecurity Policy Report, Spain Fines Insurance Firm Over GDPR Violations, (Mar 4, 2025)
The Spanish data protection authority, Agencia Espanola de Proteccion de Datos (AEPD), has fined Ibermutua Mutua Colaboradora 600,000 euros ($632,000) after it determined the insurance firm violated the European Union’s General Data Protection Regulation (GDPR).
The incident affected the data of 3,395 individuals, whose data was sent to a total of 354 recipients, including companies and consultancies collaborating with Ibermutua, according to AEPD. The decision is available on the AEPD website in Spanish and was machine-translated for reporting purposes.
The sanctions followed complaints from individuals who said they received a communication from Ibermutua’s data protection officer (DPO) informing them that, due to a computer error, the individuals’ personal data, including health data, had been sent to different companies and entities, AEPD said.
Ibermutua contacted the companies and entities to request that the personal data be deleted. The complaints were forwarded to Ibermutua so that the company could investigate and inform the AEPD of the actions it carried out to adapt to the requirements of the GDPR.
According to Ibermutua, after detecting the breach, it took immediate technical measures, including correcting the error in programing and undertaking a series of exhaustive tests to ensure correct functioning; restriction of attachments to prohibit the sending of multiple attachments in a single e-mail; verification of the identity of the attachment with the corresponding recipient; and testing prior to sending e-mail remittances. Ibermutua also took immediate operational measures, including informing the owners of the personal data and contacting the recipient entities to request deletion, according to AEPD.
Ibermutua undertook organizational security measures as a result of the incident, including implementing policies and procedures for security and data protection; implementing training for staff in relation to data protection; undertaking risk analysis; and launching an external audit.
News: InternationalLegislation DataPrivacy LitigationEnforcement GDPR