The Spanish data protection authority (AEPD) has sanctioned the company GIANTS GAMING ESPORTS, S.L. for the public exposure of a file containing data of over 80,000 individuals and for its delayed response following an alert, qualified as serious negligence, imposing a fine of €6,000, reduced to €4,800 after voluntary payment.

Facts and context

The Spanish data protection authority (AEPD) issued a sanction decision against GIANTS GAMING ESPORTS, S.L. (including the imposition of a €6,000 fine) for breaches related to processing security.

The case originated from a complaint dated July 6, 2023, reporting the public exposure of a file containing personal data of over 80,000 individuals.

Reasons for the decision

• Obligation to ensure processing security (Article 32 of the GDPR): The authority found that a file containing data of 80,581 individuals (email address, first name, last name, phone number, IP address, location data, gender) was freely accessible and downloadable via an internet address. Although the company was alerted to this breach on June 28, 2023, the authority verified that the file was still accessible on July 13, 2023. The authority qualified as "serious negligence" the fact that the company did not carry out the necessary checks and did not remove the file immediately after the alert, leaving the data exposed on the internet for at least 23 days (from June 28 to July 21, 2023). The authority concluded that the absence of appropriate technical and organizational measures to prevent such exposure, resulting from an internal configuration error, and the slow reaction constituted a violation of the security obligation, referring notably to Recitals 74 and 87 of the GDPR and the European Data Protection Board (EDPB) Guidelines 9/2022.

Authority's decision

Consequently, the authority imposed a fine of €6,000 on GIANTS GAMING ESPORTS, S.L. The company made a voluntary payment, benefiting from a 20% reduction, bringing the final amount to €4,800.

Lessons learned

This decision reminds that:

• Responsiveness following an alert about a potential data breach is a key element of the security obligation. A delay of several weeks to investigate and contain a confirmed data breach can be qualified as serious negligence and constitute an aggravating factor.
• The security obligation under Article 32 of the GDPR implies not only implementing preventive measures to avoid human errors (such as misconfiguration of access permissions) but also rapid detection and correction measures to remedy incidents.
• To determine the amount of a fine, supervisory authorities refer to the turnover of the financial year preceding the date of their decision, in accordance with the EDPB Guidelines 04/2022.