AEPD (Spain) - EXP202401683
From GDPRhub
| AEPD - EXP202401683 | |
|---|---|
 | |
| Authority: | AEPD (Spain) |
| Jurisdiction: | Spain |
| Relevant Law: | Article 5(1)(f) GDPR Article 34 GDPR |
| Type: | Complaint |
| Outcome: | Upheld |
| Started: | |
| Decided: | 22.10.2025 |
| Published: | 04.12.2025 |
| Fine: | 2,600,000 EUR |
| Parties: | n/a |
| National Case Number/Name: | EXP202401683 |
| European Case Law Identifier: | n/a |
| Appeal: | n/a |
| Original Language(s): | Spanish |
| Original Source: | AEPD (in ES) |
| Initial Contributor: | RP |
The DPA fined a sports retail company €2,600,000 after personal data of more than 6 million people was published in the dark web in course of a ransomware attack. The DPA found that the company lacked adequate security measures under Article 5(1)(f) GDPR.
English Summary
Facts
In October 2023, the controller, SPRINTER MEGACENTROS DEL DEPORTE, S.L., suffered a serious ransomware attack. The attackers entered the controller’s systems on 24 October 2023 and accessed large amounts of personal data. They later encrypted key systems on 27 October 2023. The controller confirmed that the attackers had exfiltrated personal data and later published part of it on the dark web. The incident affected 6,381,913 individuals in Spain, France, Italy, the Netherlands and Portugal. The affected personal data included names, identification numbers, postal addresses, phone numbers, email addresses and dates of birth of customers. For employees and former employees, additional categories such as photographs, bank account numbers, payslips and health-related information about disability were affected.
The controller notified the DPA of the breach on 31 October. They informed the affected individuals on 27 and 28 November 2023. Several individuals later submitted complaints after receiving these notifications. During its investigation, the DPA found that the controller had insufficient security measures in place before the incident. Some internal alerts had not been reviewed, and several weaknesses made it possible for the attackers to move through the system unnoticed before the encryption attack. Although the controller improved its security measures after the incident, the DPA held that these improvements did not change the fact that the relevant measures had been missing at the time of the attack.
Holding
The DPA held that the controller violated Article 5(1)(f) GDPR because they failed to implement appropriate technical and organisational measures to ensure the integrity and confidentiality of the personal data they processed. The DPA considered the scale of the breach, the sensitivity of some categories of data and the risks created for the affected individuals as aggravating factors. The DPA also found that the controller violated Article 34 GDPR by failing to communicate the breach to the affected individuals without undue delay and by providing incomplete information. However, this violation was time-barred under Spanish procedural law, so the DPA did not impose a penalty for it.
For the violation of Article 5(1)(f) GDPR, the DPA imposed a fine of €2,600,000. The controller accepted responsibility and chose to make an early voluntary payment, which allowed them to receive two reductions in accordance with Spanish administrative law. As a result of these reductions, the final amount paid was €1,560,000.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Spanish original. Please refer to the Spanish original for more details.
1/31
• File No.: EXP202401683
- RESOLUTION OF TERMINATION OF PROCEEDINGS DUE TO
ACKNOWLEDGMENT OF LIABILITY AND VOLUNTARY PAYMENT
From the proceedings initiated by the Spanish Data Protection Agency and based on the following
BACKGROUND
FIRST: On October 22, 2025, the Presidency of the Spanish Data Protection Agency agreed to initiate sanctioning proceedings against SPRINTER
MEGACENTROS DEL DEPORTE, S.L., with Tax Identification Number B53404646 (hereinafter,
SPRINTER), by means of the agreement transcribed below:
<<
File No.: EXP202401683
AGREEMENT TO INITIATE SANCTIONING PROCEEDINGS
From the actions carried out by the Spanish Data Protection Agency and Based on the following
FACTS
FIRST: On October 31, 2023, this Agency was notified of a breach of
personal data belonging to SPRINTER MEGACENTROS DEL DEPORTE, S.L., with
Tax Identification Number B53404646 (hereinafter, SPRINTER).
The notification received stated, among other things, the following:
- “On October 27, 2023, Sprinter's Datacenter revealed an incident: an
intrusion by the ***PROGRAM.1. This group encrypted critical machines,
leaving a ransom note. In response, Sprinter activated its response protocol, (…).
(…). On October 28, forensic analysts confirmed that there were indications
of data leakage by the attacker. (…). We will expand on the information
about the incident as the investigation progresses.”
- Approximate number of affected individuals: 6,200,000
- The processing activity affected by the breach includes data of
individuals in more than one Member State.
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 2/31
- The incident was intentional, intended to harm the controller/processor or
the affected individuals.
- The origin of the incident was: external. Other factors unrelated to the
controller/processor or the affected individuals.
- What may have occurred? Cyber incident: Encrypted device / data theft, Cyber incident: Phishing / Compromise of user or administrator accounts, Cyber incident: Unauthorized access to
data in an information system (corporate or online service).
- As a result of the incident, the following have been affected: confidentiality, availability
- Specifically regarding the data breach:
Is the data securely encrypted, anonymized, or protected in such a way that it is unintelligible to anyone who may have had access, or can individuals be identified?
No.
Has the availability of the personal data been restored so that it can be processed normally?
Not yet, but it will be restored shortly.
- What might have happened?
Becoming a victim of phishing/spamming campaigns.
Loss of control over personal data.
Other consequences.
- To what extent could the identified consequences affect individuals?
Still unknown.
- Types of data affected: basic data (e.g., name, surname, date of birth), image (photos or videos), national identity card, foreign resident card, passport, and/or any other identification document; economic or financial data (excluding payment methods) and contact information.
- The affected individuals have the following profiles: customers/citizens,
users, and employees.
- Are there individuals affected by the breach in other EU Member States?
Yes. Affected states: France (9,000), Italy (4,000), Netherlands (550,000),
Portugal (800,000).
- Temporal information regarding the breach: Please indicate the date the breach was detected,
understood as the date on which the controller became certain that personal data had been compromised: October 28, 2023.
- Do you know the date the breach began? The exact date.
- Please indicate the date the breach began: October 24, 2023.
- The breach was detected through: detection methods proactively implemented by the controller or processor.
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 3/31
- Check the security measures implemented in the organization before the
breach: (…).
- Could the breach have been prevented by adopting any additional security
measures? Yes. Did the incident occur due to any failure, deficiency, or
non-compliance with implemented security measures? Yes.
- Have you updated your incident log with information about this personal data breach? Yes. Have you adopted new security
measures after the incident that could have prevented the breach? Yes. Have you adapted/improved
your security procedures and policies? Yes. Check only the
new security measures and those that have been updated: (…).
- Has the breach been communicated to the affected individuals under the
conditions described above? Pending Decision
On November 30, 2023, this Agency received a second document from
SPRINTER intending to “Modify a previous notification to provide relevant information.”
The received document provided identical information to that of the document dated
October 31, 2023, with the following exceptions:
- “(...) A report from the Data Protection Officer (DPO) is provided, analyzing the various actions taken
from the beginning of the incident until its resolution. The breach has been communicated
to the affected parties in accordance with Article 34 of the GDPR.”
- Approximate number of affected parties: 6,381,913
- What may have occurred? Cyber incident: encrypted device / data theft. Cyber incident: unauthorized access to data in an information system (corporate or online service).
- What may have occurred? Identity theft. Being a victim of
phishing/spamming campaigns. Loss of control over your personal data.
Other consequences.
- To what extent could the identified consequences affect individuals?
Individuals may experience significant inconveniences,
resulting in limited harm, which they will be able to overcome despite some
difficulties (additional costs, denial of access to commercial services,
fear, lack of understanding, stress, minor physical ailments, etc.).
- Types of data affected: basic data (e.g., name, surname, and date of
birth), image (photos or videos), national identity card, foreign resident card, passport, and/or any other
identification document, economic or financial data (excluding payment methods),
contact data, health data (exclusively for employees, only those essential
for the employment relationship).
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 4/31
- The affected individuals have the following profiles: clients/citizens,
users, employees, others.
- Are there any individuals affected by the breach in other EU Member States?
Yes. Affected States: France (10,351), Italy (4,718), Netherlands (1,167,068), Portugal (497,203).
- Did the incident occur due to any failure, deficiency, or non-compliance with the implemented security measures?
No.
- Was the breach communicated to the affected individuals under the conditions described above?
Yes.
- Date of notification: November 27, 2023.
- Number of individuals notified: 6,381,913
- Method of notification: Digital communication personally to each affected individual (mail, email, SMS, or similar) with guaranteed delivery and read receipts.
SECOND: On November 30, the Spanish Data Protection Agency (AEPD) received four complaints from individuals affected by the personal data breach reported by SPRINTER.
On December 1, 2023, one of the claimants submitted a document expanding upon the information contained in their initial claim.
Furthermore, on December 16, 2023, this Agency received a new claim.
The claims state that on November 28, 2023, they received a communication from Sprinter (from noreply@info.sprintersports.com) informing them of the personal data breach that had occurred, which affected them. The content of the communication is as follows:
“Dear Customer,
We would like to inform you that we have experienced a cybersecurity incident, and we apologize for any inconvenience you may have experienced. We have conducted a thorough investigation with cybersecurity specialists to understand the facts, contain the incident, and protect our systems.
What information has been exposed?
The ongoing investigation shows that the compromised information includes systems containing customer account and order data, which may have been accessed by an unauthorized third party.Based on our investigation to date, we can only provide an indication of the type
of orders and information that may be compromised. This is the information that
may be compromised, which could affect you in whole or in part:
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 5/31
- Customer number, full name, shipping and/or billing address, email,
phone number, ID/Tax ID number, date of birth.
Please note that we do not store your bank card number or
your account password.
For us, the security of your data is a priority, and we are therefore continuing to
monitor the situation. We are very sorry for what happened.
What can you do to protect yourself?
We have already reported this incident to the police and the relevant authorities.
As a precaution, we recommend that you remain vigilant against fraud attempts and any suspicious emails, calls, or text messages. Avoid clicking on links in suspicious emails or text messages. We also recommend that you regularly change your password at Sprintersports.com. Although we do not store all of your payment information on our systems, we recommend that you pay attention to any suspicious activity on your accounts and report it to your bank if you notice any unusual activity.
Who can I contact for more information?
Please do not reply to this email. If you would like more information about what happened,
please write to us at dataprotection@sprintersports.com”
THIRD: In accordance with Article 65.4 of Organic Law 3/2018, of December 5, on the Protection of Personal Data and Guarantee of Digital Rights (hereinafter LOPDGDD), on February 1, 2024, these claims were forwarded to SPRINTER so that they could analyze them and inform this Agency, within one month, of the actions taken to comply with the requirements of data protection regulations.
This transfer, which was notified to SPRINTER in accordance with the established rules of the LPACAP, was received on February 1, 2024, as shown in the acknowledgment of receipt included in the file.
On March 1, 2024, this Agency received a written response from SPRINTER in which In summary, it stated the following:
Chronology of events:
- On October 27, 2023, SPRINTER's IT team identified that
several services in its Datacenter had lost connectivity. After a
preliminary investigation, it was established that an unauthorized third party
(***PROGRAM.1) had accessed the network and encrypted or shut down several
virtual machines (…). Following this detection, the following
immediate containment measures were applied:
or (…).
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 6/31
Once the incident was contained, (…).
Once the incident was identified, SPRINTER states that the following
actions were taken to minimize the impact:
or (…).
- On October 28, 2023, forensic analysts confirmed that there were indications
of a data breach. It was also confirmed that (…), and that the first access The unauthorized access by the attacker took place on October 24th between 3:00 PM and 3:10 PM.
- On October 30, 2023, SPRINTER received proof of life indicating that data exfiltration had occurred, affecting both customers and employees. The full extent of the damage was unknown.
- On October 31, 2023, a complaint was filed (attached), stating that the encryption took place in the early morning of October 27, 2023.
- On November 13, 2023, a series of data items that could potentially have been affected were identified, relating to customers, employees, and former employees of the company. This information was obtained through proof of life sent by the attackers with the aim of extorting SPRINTER. The analysis of these proofs of life identified the following categories of affected data:
o Customers: name, Surname, ID/Tax ID (identification data). Address,
telephone, email address (contact data). Date of
birth (personal characteristics).
or Employees and former employees: name, surname, and ID/Passport or
any identification document (identification data). Date of
birth, marital status (personal characteristics). Address, telephone,
email address (contact data). Photo. Data
relating to the degree of disability (health data). Payslips, account number
(financial data).
- After identifying the potentially affected information, work begins on
communicating those affected by the breach, determining a total number of
potentially affected individuals of 6,381,913, broken down as follows:
o Employees: 8,831
o Former employees: 21,782
o Clients: 6,351,300. Spain (4,671,960), France (10,351), the Netherlands
(1,167,068), Italy (4,718), and Portugal (497,203).
Communication to those affected:
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 7/31
SPRINTER states that communications to those affected (customers, employees, and former employees) began after obtaining evidence of the compromised information, based on proof-of-life data provided by the attackers.
These communications took place between November 27 and 28, 2023.
The communications sent are attached.
Impact of the incident and its consequences for those affected:
- “The incident has affected the availability and confidentiality of the personal data of customers, employees, and former employees, as there is evidence "Confirmed instances of encryption of personal data and its publication
on the dark web"
- "SPRINTER, along with all parties involved in resolving the
incident, has worked from the outset to minimize
the potential consequences for those affected, especially the consequences
that could arise for employees, whose risk is greater due to having
a larger amount of personal data on file, which could lead to
serious consequences such as identity theft or financial losses. Therefore, the final notification submitted to the Spanish Data Protection Agency (AEPD) identified the following as possible
consequences: Identity theft. Being a victim of
phishing/spamming campaigns. Loss of control over their personal
data. Over time, reports have been received from SPRINTER customers and employees who have witnessed these consequences materialize,
receiving emails and SMS messages that could be the target of
phishing campaigns.”
Security measures adopted prior to the incident:
SPRINTER states that it has been continuously improving its
information security management system since 2018, which consists of:
- (…)
Security measures adopted after the incident:
SPRINTER states that “The forensic report prepared by ***SERVICIO.1 lists
the measures that must be implemented after the incident is resolved.
These measures have been progressively implemented since the incident.
DOCUMENT #9, which details all these measures, is provided and has
already been implemented.” The remaining measures to be implemented are under development within the organization, through an action plan for continuous improvement of information security.
Among the measures implemented, the following stand out in relation to the incident:
- (…)
Along with the written submission, the following documentation was provided, among others:
- Doc. 2 “Police Report”. Copy of the report filed on October 31, 2023, with the National Police (Report Number: ***REFERENCE.1) by SPRINTER for the same events that are the subject of this disciplinary procedure.
- Doc. 4 “***SERVICE.1 Report”. Copy of the forensic report prepared on November 15, 2023, by the ***SERVICE.1 team of ***COMPANY.1, which includes the following relevant statements:
or “(…)”.
- Doc. 7 “Employee Management” and Doc. 8 “Customer Management”. Copy of the
Processing Activity Records for the “Employee Management” and “Customer Management” activities. Two Excel documents are attached,
without date or signature, containing various sections that include: an
initial description of the processing activity, information on the processing lifecycle, justification for NOT conducting a Data Protection Impact Assessment (DPIA), and a risk assessment.
The following controls are listed for the identified threats (some of them appear among the improvement measures recommended by the forensic analysts after the breach, so it cannot be determined whether they were included in the file before or after the incident):
or (…)
- Doc. 9 “Security Measures”. An Excel document is attached with the security measures already implemented, those in progress, and those not yet implemented.
FOURTH: On February 29, 2024, in accordance with Article 65 of the LOPDGDD (Spanish Data Protection Law), the aforementioned claims were admitted for processing.
FIFTH: The Deputy Directorate General for Data Inspection carried out
preliminary investigative actions to clarify the facts in question,
by virtue of the functions assigned to supervisory authorities in
Article 57.1 and the powers granted in Article 58.1 of Regulation (EU)
2016/679 (General Data Protection Regulation, hereinafter GDPR), and
in accordance with the provisions of Title VIII of the LOPDGDD.
As a result of the actions taken, the following facts have been obtained:
1) On June 17, 2024, this Agency received a written response from SPRINTER to this Agency's request for information, from which the following relevant information is extracted:
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 9/31
- Regarding the procedures implemented for breach management,
a document was provided outlining the procedure for responding to
incidents within the organization, updated on January 17, 2024, as well as
the document outlining the security breach management procedure approved by the organization in March 2024.
- Regarding the solutions implemented in the organization for monitoring
and detecting the incident, they state that prior to the breach (a
preventive measure), a solution was already in place (Document No. 4) that included
“(…)”.
- Regarding the reason why the alert from ***SYSTEM.1
registered after the attackers' actions, as specified in the forensic analysis itself (…), was not addressed, the following statement is provided:
“(…).
- Regarding how the attackers obtained the access credentials
that caused the incident, they state that no evidence of their
compromise was found:
“(…)”.
- Regarding the preventative measures to ensure the security of employee access
to the VDI virtual desktops, they state:
“(…)”. Screenshots are provided showing:
• An image with information (…)”
• An image of (…).
• An image of a panel in the tab (…).
- Regarding the modifications made to the backup policy after the incident, it states:
“(…).
Furthermore, according to the document, SPRINTER had backups of the servers during the incident using a system called “***SYSTEM.2”
- Regarding the types of personal data that were ultimately affected, specifically health data, SPRINTER states:
“Investigations carried out after the incident have confirmed that the data contained on the servers affected by the breach are the following:
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 10/31
• Customer personal data: Name, surname, ID/Tax ID number. Address, telephone number, email address. Date of birth.
• Employee personal data: Name and surname. Copy of ID/Passport or any other identification document. Date of birth, marital status. Home address, telephone number, email address. Photo. Data relating to the degree of disability (In some cases, there may be Social Security documents certifying the reason for the disability). Payslips, account number.
However, no evidence has been obtained of exactly which data has been exfiltrated. It is known that this list of personal data existed within the affected systems, but it was not possible to determine with certainty which types of data were exfiltrated from this set of information. For this reason, the company, considering the highest risk scenario, decided to notify the Supervisory Authority of all data stored in the affected information systems.
Regarding the final number of affected individuals who were notified, SPRINTER states:
“The following emails were sent between November 27, 2023, and November 28, 2023, to all affected parties (customers, employees, and former SPRINTER employees):
To current and former employees: 30,613 emails sent.
To customers: 6,351,300 emails sent. Spain (4,671,960), France (10,351), Netherlands (1,167,068), Italy (4,718), and Portugal (497,203).
- Regarding the activities carried out at SPRINTER to promote training
and awareness among employees in data security and protection, they state that data security and protection training was provided to 581 employees in 2021 and to 45 employees in 2022
(Document No. 9).
Furthermore, it states that, in continuity with SPRINTER's training plan,
a data protection training course was delivered to
the contact persons in the entity's departments on January 25, 2024.
- Regarding the security measures listed in the response to the transfer that were
in place before the incident and which of them were
deployed after the incident to improve the organization's security, they provide a new Excel document (Document No. 10)
with two tabs: “Status before the incident” and “Current status and
forecast”, highlighting the following content:
(…)
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 11/31
The following list of measures is highlighted, indicating the current
implementation status of some of the reactive measures (“Current
Status and Forecast”):
(…)
- Regarding the implementation of Regarding two-factor authentication (2FA) as a reactive measure, SPRINTER states:
“(…)”.
Remaining documentation attached to the letter:
- Doc. 1. Copy of the document “Procedure for Incident Response,” updated on January 17, 2024.
- Doc. 2. Copy of the document “Procedure for Managing Security Breaches in the Processing of Personal Data,” approved, according to SPRINTER, in March 2024.
- Doc. 3. Copy of the service offer from the ***SERVICE.1 team of
***COMPANY.1, signed on May 20, 2022, by SPRINTER and
***COMPANY.2 (…) in reference to the ***SERVICE.1 service that was contracted for support in the detection and response to security incidents.
SIXTH: According to the report obtained from the AXESOR tool on June 16, 2025,
SPRINTER is a subsidiary of a group
established in 1999, with a sales volume of €662,218,431 in
2024 and 4,895 employees.
SEVENTH: The matter was transmitted on 16 July 2025 through the “Internal Market Information System” (hereinafter referred to as the “IMI System”), governed by Regulation (EU) No 1024/2012 of the European Parliament and of the Council of 25 October 2012 (the “IMI Regulation”), which aims to promote cross-border administrative cooperation, mutual assistance between Member States, and the exchange of information. This matter was referred to the Member States in accordance with Article 56 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (hereinafter referred to as the “GDPR”). Taking into account its cross-border nature and the fact that this Agency is competent to act as the main supervisory authority, given that SPRINTER has its main establishment in Spain, the processing time for the proceedings was automatically suspended.
The data processing activities carried out affect data subjects in several Member States. According to the information incorporated into the IMI System, at C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 12/31
In accordance with Article 60 of the GDPR, the authorities of the Netherlands, Sweden, and France act as "competent supervisory authorities."
All of them by virtue of Article 4.22 of the GDPR, given that data subjects residing
in the territory of these supervisory authorities are substantially affected or are
likely to be substantially affected by the processing that is the subject of this
procedure.
EIGHTH: On August 13, 2025, the Presidency of the AEAP adopted a
draft agreement to initiate sanction proceedings. Following the procedure
established in Article 60 of the GDPR, the aforementioned draft was transmitted that same day via the IMI system, and the relevant authorities were informed that they had four weeks from that moment to submit relevant and substantiated objections. The processing time for the proceedings was automatically suspended during these four weeks, in accordance with the provisions of Article 64 of the LOPDGDD.
Within the allotted time, the French supervisory authority submitted its relevant and substantiated objections for the purposes of Article 60 of the GDPR—which were accepted—considering that there was also an infringement of Article 34 of the GDPR regarding the time frame and content
of the breach notification to the affected parties, and requesting clarification as to whether the turnover used to determine the fine corresponded to SPRINTER or the JD SPORTS group.
NINTH: On October 2, 2025, the Presidency of the AEAP adopted a
revised draft agreement to initiate sanction proceedings. Following the
process established in Article 60 of the GDPR, the revised draft was transmitted the following day via
the IMI system, and the relevant authorities were informed that they had two weeks from that date to submit any relevant and substantiated objections. The processing period for the proceedings was automatically suspended
during these two weeks, in accordance with the provisions of
Article 64 of the LOPDGDD.
Within the allotted time, the relevant supervisory authorities did not submit any relevant and substantiated objections. Therefore, it is considered that all the authorities agree with the revised draft and are bound by it,
in accordance with the provisions of paragraph 6 of Article 60 of the GDPR.
LEGAL BASIS
I
Jurisdiction
In accordance with the powers conferred upon each supervisory authority by Articles 58.2 and 60 of Regulation (EU) 2016/679 (General Data Protection Regulation, hereinafter GDPR), and as established in Articles 47, 48.1, 64.2 and 68.1 of Organic Law 3/2018, of December 5, on the Protection of Personal Data and Guarantee of Digital Rights (hereinafter LOPDGDD), the Presidency of the Spanish Data Protection Agency is competent to initiate and resolve this procedure.
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 13/31
... II
Procedure
Likewise, Article 63.2 of the LOPDGDD (Organic Law on the Protection of Personal Data and Guarantee of Digital Rights) establishes that: “The procedures
processed by the Spanish Data Protection Agency shall be governed by the provisions
of Regulation (EU) 2016/679, by this Organic Law, by the implementing regulations issued thereunder, and, insofar as they do not contradict them,
subsidiarily, by the general rules on administrative procedures.”
In accordance with Article 64 of the LOPDGDD, and taking into account the
characteristics of the alleged infringement committed, a sanctioning procedure is initiated.
The procedure will have a maximum duration of twelve months from the date
of the initiation agreement. After this period, the procedure will expire and,
consequently, the case file will be closed, in accordance with the provisions of
Article 64 of the LOPDGDD.
If no objections are raised to this initial agreement within the stipulated period, it may be considered a proposed resolution, pursuant to Article 64.2.f) of Law 39/2015, of October 1, on the Common Administrative Procedure of Public Administrations (hereinafter, LPACAP).
III
Preliminary Issues
Article 4.1 of the GDPR defines "personal data" as: "any information relating to an identified or identifiable natural person ("data subject"). An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person."
Article 4.2 of the GDPR defines "processing" as: "any operation or set of operations performed on personal data or sets of personal data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction."
Article 4.7 of the GDPR defines the "controller" as:
"the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of processing are determined by Union or Member State law, the controller or the specific criteria for its appointment may be laid down by Union or Member State law."
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 14/31
in turn, Article
4.8 of the GDPR defines the "processor" as:
"the natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller."
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 14/31 In this case, in accordance with Articles 4.1 and 4.2 of the GDPR,
the processing of personal data is established, since SPRINTER
collects and stores personal data of
natural persons (clients, employees, and former employees): identification and contact information (name, surname, national identity card/passport number, address, telephone number, email address, date of birth), image, health data (data relating to the degree of disability), and financial data.
SPRINTER carries out this activity as the data controller,
since it determines the purposes and means of such activity, pursuant to Article 4.7 of the GDPR.
Furthermore, this is a cross-border processing activity, since SPRINTER is established in Spain, although it provides services to other countries of the European Union.
The GDPR, in Article 56.1, provides for cross-border processing (as provided for in Article 4.23) regarding the competence of the lead supervisory authority, that, without prejudice to Article 55, the supervisory authority of the main establishment or the sole establishment of the controller or processor shall be competent to act as the lead supervisory authority for cross-border processing carried out by that controller or processor in accordance with the procedure established in Article 60. In the case under examination, as explained above, SPRINTER has its main establishment in Spain, and therefore the Spanish Data Protection Agency is competent to act as the lead supervisory authority.
IV
Obligation not fulfilled. Integrity and Confidentiality
Article 5.1(f) of the GDPR stipulates:
"1. Personal data shall be:
(...)
(f) processed in a manner that ensures appropriate security of the personal data, including protection against unauthorized or unlawful processing and against accidental loss, destruction, or damage, using appropriate technical and organizational measures ("integrity and confidentiality")."
The principle of integrity and confidentiality enshrined in Article 5.1(f) of the GDPR obliges data controllers to ensure that personal data are processed in a way that guarantees the confidentiality of the personal data,
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 15/31
preventing unauthorized access, misuse, or disclosure to unauthorized third parties. This requires implementing appropriate technical and organizational measures of all kinds to protect data against potential personal data breaches, both external and internal. These measures must be adequate to prevent risks to the rights and freedoms of natural persons arising from the processing of personal data, and must be reviewed and updated periodically to ensure their effectiveness.
In this case, on October 31 and November 30, 2023, SPRINTER notified this Agency of a personal data breach that began on October 24, 2023, and was detected on October 27, 2023, by its IT team after identifying several services without connectivity. SPRINTER indicated that the breach affected both the confidentiality and availability of identifying, contact, financial, health (exclusively of current and former employees), and image data belonging to millions of customers, users, employees, and others in various European Union countries: Spain, France, Italy, the Netherlands, and Portugal.
According to the breach analysis report prepared by the team
***SERVICE.1 of ***COMPANY.1 on November 15, 2023, and submitted by
SPRINTER as Document No. 4 in its response to the transfer, the entry vector was (…). The first unauthorized access (…) occurred on October 24, 2023.
Once inside the system, between October 24 and 27, 2023, the attacker
(…) and proceeded to (i) exfiltrate a total of (…) compressed data and (ii) deploy the ***PROGRAM.1 program, which encrypted the virtual disks of the systems booted on October 27, 2023.
SPRINTER stated in its response to the information request of
June 17, 2024, that it did not know how (…).
Likewise, SPRINTER—in its written response to the transfer dated March 1, 2024, and
in its written response to the request for information dated June 17, 2024—
acknowledged the data exfiltration and, therefore, the breach of confidentiality.
The number of affected individuals totaled 6,381,913, who were informed via
email between November 27 and 28, 2023. They are broken down
as follows:
- Clients: 6,351,300 (Spain: 4,671,960, France: 10,351, Netherlands: 1,167,068, Italy: 4,718, and Portugal: 497,203).
- Employees: 8,831
- Former employees: 21,782
And, with The following types of data affected by the exfiltration:
- For clients: identification and contact information (name and surname, ID/Tax ID number, address, telephone number, email address, and date of birth).
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 16/31
- For employees and former employees: identification and contact information (name and surname, ID/Passport or other identification document, date of birth, marital status, address, telephone number, email address), image, health data (data relating to the degree of disability), and economic or financial data (pay slips and account number).
Regarding the impact on data availability, there are contradictions in the statements made by SPRINTER, since initially, in the breach notifications of October and November 2023, the company stated that the availability of the data would also be affected. was affected and had not yet been able to recover it. However, in a written response to the information request dated June 17, 2024, SPRINTER stated that “ultimately, the availability of the affected individuals' personal data was not affected due to data redundancy and the maintenance of databases that prevented unavailability.” It supports these claims with documentation that demonstrates the existence of backups on servers other than the encrypted ones, which would have prevented the loss of availability of personal data.
In any case, the existence of a personal data breach that affected the confidentiality of said data is undeniable.
At this point, this Agency wishes to point out that the documentation in the administrative file demonstrates that the technical and organizational measures in place at the time of the data breach were inadequate to mitigate the potential risk of an incident such as the one that is the subject of these proceedings, which allowed the breach to occur. the confidentiality of the personal data processed by SPRINTER. The entity itself, in the first breach notification form dated October 31, 2023, addressed the question: “Could the breach have been prevented by adopting any additional security measures?” and “Did the incident occur due to any failure, deficiency, or
non-compliance with implemented security measures?”, it indicated “Yes”;
thus acknowledging the inadequacy of its measures. However, in the second document dated November 30, 2023, it contradicted itself.
The forensic report of November 15, 2023, prepared by the service
***SERVICE.1 of ***COMPANY.1, also indicates that SPRINTER's technical and
organizational measures were insufficient to guarantee an adequate level of
personal data security, since the report recommends a
list of measures to prevent a similar personal data breach from occurring again and for SPRINTER to improve its security standards in general. In this regard, the entity stated that many
of these recommendations had already been implemented or were in the process of being
implemented, as classified in Document No. 10 attached to its document. in response to the information request of June 17, 2024.
Among the shortcomings related to the origin of the breach, it is found that
SPRINTER (…).
The entity itself acknowledged that the measure in question (…)”. And, in its written response to the information request of June 17, 2024, it added that (…).
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 17/31
In this regard, this Agency wishes to indicate that (…).
Furthermore, it should be noted that, once inside the system, the attackers took advantage of other vulnerabilities to deploy ***PROGRAM.1. As detailed in the forensic report prepared by the ***SERVICE.1 service of ***COMPANY.1, the attackers (…). This would demonstrate a significant deficiency in the measures implemented
by the organization before the incident that facilitated the breach. The
speed with which the attackers were able to move around shows
vulnerabilities in the infrastructure beyond (…).
In this regard, it is worth highlighting that SPRINTER subsequently implemented
a series of reactive measures, in accordance with the statements in its
response to the transfer dated March 1, 2024. These include:
- (…).
All of the above demonstrates, as previously indicated, that the
technical and organizational measures that SPRINTER had in place before the incident in question were not appropriate to guarantee a level of security commensurate with the
risk to the personal data it processed concerning its clients, employees, and
former employees.
Therefore, in accordance with the evidence currently available, and without prejudice to the outcome of the investigation, it is considered that the known facts could constitute an infringement attributable to SPRINTER, for violation of Article 5.1.f) of the GDPR.
V
Classification of the infringement of Article 5.1.f) of the GDPR and its classification for the purposes of the statute of limitations
If confirmed, the aforementioned infringement of Article 5.1.f) of the GDPR could constitute one of the infringements classified in Article 83.5 of the GDPR, which, under the heading “General conditions for the imposition of administrative fines,” provides:
“5. Infringements of the following provisions shall be subject, in accordance with paragraph 2, to administrative fines of up to EUR 20,000,000 or, in the case of an undertaking, up to 4% of its total worldwide annual turnover of the preceding financial year, whichever is higher:
(a) the basic principles for processing, including the conditions for consent pursuant to Articles 5, 6, 7 and 9; (…)
For its part, the LOPDGDD, in its Article 71, Infringements, states that:
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 18/31
“The acts and conduct referred to in paragraphs 4, 5, and 6 of Article 83 of Regulation (EU) 2016/679, as well as those that are contrary to this Organic Law, constitute infringements.”
For the sole purpose of the limitation period, Article 72.1 of the LOPDGDD (Spanish Data Protection Act) establishes the following:
"In accordance with the provisions of Article 83.5 of Regulation (EU) 2016/679, the following infringements are considered very serious and shall be subject to a three-year limitation period:
infringements that constitute a substantial breach of the articles mentioned therein, and in particular, the following:
a) The processing of personal data in violation of the principles and safeguards established in Article 5 of Regulation (EU) 2016/679; (...)"
VI
Proposed sanction for the infringement of Article 5.1.f) of the GDPR
In order to determine the administrative fine to be imposed, the provisions of Articles 83.1 and 83.2 of the GDPR must be observed. These articles state:
"1. Each supervisory authority shall ensure that the imposition of the
Administrative fines under this article for the infringements of this Regulation indicated in paragraphs 4, 9 and 6 shall be, in each individual case,
effective, proportionate and dissuasive.
2. Administrative fines shall be imposed, depending on the circumstances of each individual case, in addition to or as an alternative to the measures provided for in Article 58(2)(a) to (h) and (j). When deciding on the imposition of an administrative fine and its amount in each individual case, due consideration shall be given to:
(a) the nature, seriousness, and duration of the infringement, taking into account the nature, scope, or purpose of the processing operation concerned, as well as the number of data subjects affected and the level of damage suffered;
(b) the intent or negligence of the infringement;
(c) any measures taken by the controller or processor to mitigate the damage suffered by data subjects;
(d) the degree of responsibility of the controller or processor, taking into account the technical or organizational measures implemented pursuant to Articles 25 and 32; e) any prior infringement committed by the controller or processor;
f) the degree of cooperation with the supervisory authority with a view to remedying the infringement and mitigating its possible adverse effects;
g) the categories of personal data affected by the infringement;
h) how the supervisory authority became aware of the infringement, in particular whether and, if so, to what extent the controller or processor notified the infringement;
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 19/31
i) where the measures referred to in Article 58(2) have been previously ordered against the controller or processor concerned in relation to the same matter, compliance with those measures;
(j) adherence to codes of conduct pursuant to Article 40 or to certification mechanisms approved pursuant to Article 42, and (k) any other aggravating or mitigating factor applicable to the circumstances of the case, such as financial benefits obtained or losses avoided, directly or indirectly, through the infringement.”
For its part, Article 76 “Sanctions and Corrective Measures” of the LOPDGDD (Spanish Data Protection Law) provides:
“1. The sanctions provided for in paragraphs 4, 5 and 6 of Article 83 of Regulation (EU) 2016/679 shall be applied taking into account the criteria for determining the severity of the sanction established in paragraph 2 of that Article.
2. In accordance with the provisions of Article 83.2(k) of Regulation (EU) 2016/679, the following may also be taken into account:
(a) The continuing nature of the infringement.
b) The connection between the infringer's activity and the processing of personal data.
c) The benefits obtained as a result of committing the infringement.
d) The possibility that the affected party's conduct could have induced the commission of the infringement.
e) The existence of a merger by acquisition subsequent to the commission of the infringement, which cannot be attributed to the acquiring entity.
f) The impact on the rights of minors.
g) Having a data protection officer, when not mandatory. h) The voluntary submission by the controller or processor to alternative dispute resolution mechanisms in cases where disputes arise between them and any data subject.
This implies, according to Guidelines 04/2022 on calculating fines under the GDPR, that the amount of the fine must be based on three elements: the turnover, the categorization of the infringement according to its nature (i.e., whether it is an infringement of Article 83.4, 83.5, or 83.6 of the GDPR), and the level of seriousness of the infringement in each specific case (in accordance with Article 83.2 a), b), and g). In any case, the fine imposed must be, in each individual case, effective, proportionate, and dissuasive, as established in Article 83.1 of the GDPR.
In this regard, the turnover is considered beforehand. SPRINTER's annual turnover of €662,218,431.
Furthermore, considering the categorization of the infringement, in accordance with Article 83.5 of the GDPR, the penalty imposed may be a maximum of €20,000,000, or, in the case of a company, an amount equivalent to a maximum of 4% of its annual turnover.
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 20/31
The higher amount will be chosen. 4% of SPRINTER's annual turnover is €26,488,737.
Therefore, the penalty imposed must necessarily be between €0 and €26,488,737.
Furthermore, regarding the level of severity in the In accordance with the GDPR, and without prejudice to the outcome of the investigation, the following circumstances are considered to exist:
The nature, severity, and duration of the infringement, taking into account the nature, scope, or purpose of the processing operation in question, as well as the number of data subjects affected and the level of damage suffered (Article 83.2(a) of the GDPR): the known facts directly affect the control that data subjects have over their personal data. Furthermore, it exceeds the reasonable expectations that data subjects can have regarding the processing of their personal data. Thus, the data subjects rely on the entity for the secure handling of their personal information, and this trust and their reasonable expectations regarding the processing of their personal data have been eroded.
Moreover, the known facts reveal a lack of technical and organizational measures of all kinds, which has resulted in a breach affecting a very considerable number of data subjects, specifically:
or Customers: 6,351,300 (Spain: 4,671,960, France: 10,351, Netherlands: 1,167,068, Italy: 4,718, and Portugal: 497,203).
or Employees: 8,831
or Former Employees: 21,782
It is also important to highlight the high number of personal data per affected individual that were compromised. It should be noted that the breach of the principle of
confidentiality in this case involves a set of personal data whose
nature amplifies the implications of the personal data breach. This is evident
from the fact that a large number of
personal data were affected. Specifically:
or For customers: identification and contact information (name and
surname, ID/Tax ID number, address, telephone number, email address,
and date of birth).
or For employees and Former employees: identification and contact information
(name and surname, ID/Passport or other identification document,
date of birth, marital status, home address, telephone number, email address
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 21/31
), image, health data (data relating to the degree
of disability), and economic or financial data (pay slips and
bank account number).
The combination of this type of personal data significantly increases the
level of risk to the rights and freedoms of its owners and the
implications of a breach of confidentiality. This is due to the
circumstance that such a combination not only increases the amount of
information available to a malicious actor, but also broadens the
spectrum of potential abuses. Since this is not isolated data or individual pieces
of information, but rather the exposure of an integrated set of
personal data that, when combined, can be used to
construct a complete and detailed profile of a individual, which may allow
an attacker to carry out fraud and identity theft with a
higher success rate.
Regarding the duration of the infringement, it lasted from at least October 24, 2023, to October 28, 2023.
Furthermore, the breach of the principle of integrity and confidentiality implies a breach of the principle of proactive responsibility provided for in Article 5.2
GDPR and developed in Article 24, whereby data controllers must not only comply with the provisions of the GDPR, but must also be able to demonstrate compliance with a new approach to adopting and implementing risk-appropriate measures.
The categories of personal data affected by the infringement (Article
83.2(g) of the GDPR): The European Data Protection Board's Guidelines 04/2022 on calculating fines under the GDPR, adopted on October 24, May
2023, in paragraph 57, they state the following regarding the requirement to take into account
the categories of personal data affected: “(…) the GDPR clearly highlights
the types of data that deserve special protection and, therefore, a stricter response
with regard to fines. This refers, at a minimum, to the types
of data referred to in Articles 9 and 10 of the GDPR and to data outside the scope
of these articles whose disclosure would cause immediate harm
to the data subject (for example, location data, data concerning private communications,
national identification numbers or financial data, such as transaction summaries or credit card numbers). In the present case, the
national identity card numbers of millions of customers have been affected by the breach. This constitutes
processing of sensitive data, as this data allows for the direct and
unambiguous identification of a natural person.
6 Jorge Juan Street www.aepd.es
28001 – Madrid sedeaepd.gob.es 22/31
In accordance with Royal Decree 255/2025, of April 1, which regulates the National Identity Document (DNI), the DNI number is a general-purpose numerical identifier
with sufficient value to prove both the identity
and the nationality of the holder. This characteristic makes it a particularly sensitive piece of personal data
because, to the extent that its processing is not
accompanied by the necessary technical and organizational measures to guarantee that
the person identifying themselves with it is indeed its holder, a third party can easily impersonate
a natural person, or, in other words, can
commit identity fraud, with the risks this entails for the privacy,
honor, and assets of the impersonated individual.
Furthermore, it must be noted that the compromised data includes
health data (exclusively of employees) and
financial data of current and former employees.
The following factors are also considered as
aggravating circumstances:
- The connection between the offender's activity and the processing
of personal data (Article 76.2, letter b), of the LOPDGDD): SPRINTER
sells sporting goods both in physical stores and
online. As a result of its business activity, it routinely and continuously processes the personal data of a
large number of data subjects, which necessarily involves
the processing of personal data of natural persons (customers,
employees, and former employees).
The assessment of the circumstances contemplated in Article 83.2 of the GDPR and Article 76.2 of the LOPDGDD, with respect to the infringement committed by violating the provisions of Article 5.1.f) of the GDPR, allows for the initial imposition of an administrative fine of €2,600,000 (two million six hundred thousand euros).
VII
Breach of Obligation. Notification of a Personal Data Breach to the Data Subject.
Article 34, “Communication of a personal data breach to the data subject,” stipulates:
“1. Where a personal data breach is likely to result in a high risk to the rights and freedoms of natural persons, the controller shall communicate it to the data subject without undue delay.
2. The communication to the data subject referred to in paragraph 1 of this Article shall describe, in clear and plain language, the nature of the personal data breach and shall contain at least the information and measures referred to in Article 33(3)(b), (c), and (d).
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 23/31
3. The communication to the data subject referred to in paragraph 1 shall not be required if any of the following conditions apply:
(a) the controller has implemented appropriate technical and organizational safeguards and these measures have been applied to the personal data
affected by the personal data breach,
in particular those measures that render the personal data unintelligible to
anyone who is not authorized to access them, such as encryption;
b) the controller has taken further steps to ensure
that the high risk to the rights and freedoms of the data subject referred to in paragraph 1 no longer exists;
c) involves disproportionate effort. In this case,
a public communication or a similar measure that informs
data subjects in an equally effective manner shall be used instead.
4. Where the controller has not yet communicated the personal data breach to the data subject, the supervisory authority, having considered
the likelihood that such breach entails a high risk, may require the controller to do so or may decide that one of the conditions referred to in
paragraph 3 is met.
In this case, SPRINTER indicated in its breach notification of October 31, 2023,
that “Has the breach been communicated to the affected individuals under the
conditions described above? Pending decision.” However, in its
breach notification of November 30, 2023, it stated that on November 27,
2023, the 6,381,913 affected individuals were informed of the breach
through personal communications (mail, email, SMS, or similar) with guaranteed
delivery and read receipts. This would be evidenced by the documentation
provided by the claimants regarding the breach notification they
received from SPRINTER (noreply@info.sprintersports.com) on November 28,
2023.
While personal data protection regulations do not establish an explicit deadline
for these communications, it should be emphasized that they do address the
obligation to inform those affected of the incident “without undue delay.” In this regard,
section 83 of Guidelines 9/2022, on the notification of
personal data breaches under the GDPR, dated
March 28, 2023, states that: “The GDPR stipulates that notification of
a breach to individuals must be made ‘without undue delay,’ which
means as soon as possible. The main objective of notifying individuals is
to provide them with specific information about the measures they should take
to protect themselves. As already noted, depending on the nature of the
breach and the risk it entails, prompt notification will help
individuals take steps to protect themselves from its negative consequences.”
Thus, although SPRINTER sent communications informing those affected
of the events, these were not sent until November 27 and 28, 2023, a month
after becoming aware of the breach.
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 24/31
Furthermore, the content of the communication submitted by SPRINTER was incomplete
insofar as it made no mention of the measures it adopted to
combat the security breach (among others, (...)). It simply reported that
"we have conducted a thorough investigation with cybersecurity specialists
to understand the facts, contain the incident, and protect the
systems."
Paragraph 86 of the aforementioned Guidelines, in relation to Article 34.2 of the GDPR,
lists the minimum information that a breach notification must contain,
specifically: “a description of the nature of the breach, the name and
contact details of the data protection officer or other
point of contact, a description of the likely consequences of the breach; and a
description of the measures taken or proposed by the controller to remedy the personal data breach, including, where appropriate, measures taken to mitigate its
possible adverse effects” (emphasis added by this Agency). Regarding this
last point, paragraph 87 states: “As an example of the measures
taken to remedy the breach and mitigate its potential adverse effects, the
controller could indicate that, having notified the relevant
supervisory authority, it has received advice on how to
manage it and reduce its impact. The controller should also
, where appropriate, provide specific advice to individuals on how to
protect themselves from the potential adverse consequences of the breach, such as
setting new passwords if their login credentials have been compromised. Again, a controller may decide
to provide more information than is required here.”
Therefore, in accordance with the evidence available at this time,
in the agreement to initiate sanction proceedings, and without prejudice to the outcome
of the investigation, it is considered that the known facts could constitute
an infringement, attributable to SPRINTER, for violation of
Article 34 of the GDPR.
VIII
Classification of the infringement of Article 34 of the GDPR and its classification for the purposes of
statute of limitations
If confirmed, the aforementioned infringement of Article 34 of the GDPR could constitute
one of the infringements classified in Article 83.4 of the GDPR, which
under the heading “General conditions for the imposition of administrative fines” provides:
“Infringements of the following provisions shall be sanctioned, in accordance with paragraph 2, by administrative fines of up to EUR 10,000,000 or,
in the case of an undertaking, up to 2% of its total worldwide annual turnover of the preceding financial year, whichever is higher:
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 25/31
a) the obligations of the controller and the processor pursuant to Articles 8, 11,
25 to 39, 42 and 43; (...)”
For its part, the LOPDGDD, in its Article 71, Infringements, states that:
“The acts and conduct referred to in paragraphs 4,
5 and 6 of Article 83 of Regulation (EU) 2016/679, as well as those that are
contrary to this Organic Law, constitute infringements.”
For the sole purpose of determining the statute of limitations, Article 74 of the LOPDGDD (Spanish Organic Law on the Protection of Personal Data and Guarantee of Digital Rights) establishes the following:
“The remaining infringements of a purely formal nature under the articles mentioned in paragraphs 4 and 5 of
Article 83 of Regulation (EU) 2016/679 are considered minor and shall be subject to a one-year statute of limitations, and in particular, the following:
(…)
(n) Failure to comply with the duty to notify the data subject of a data breach that poses a high risk to the rights and freedoms
of the data subjects, as required by Article 34 of Regulation (EU) 2016/679,
unless the provisions of Article 73(s) of this Organic Law apply.”
In the present case, as explained above, the infringement of Article 34 of the
GDPR was subject to a one-year statute of limitations, and therefore, such infringement is now time-barred.
IX
Corrective Measures
If the infringement is confirmed, the resolution issued may establish the corrective measures that the infringing entity must adopt to end the non-compliance with personal data protection legislation, in this case, Article 5.1.f) of the GDPR, in accordance with the provisions of Article 58.2.d) of the GDPR, according to which each supervisory authority may "require the controller or processor to bring processing operations into compliance with the provisions of this Regulation, where appropriate, in a specific manner and within a specified time frame..."
Thus, the responsible entity may be required to adapt its actions to the personal data protection regulations, to the extent expressed in the preceding Legal Grounds.
This document establishes the alleged infringement and the facts
that could give rise to this possible violation of data protection regulations, clearly outlining the measures to be adopted. However, the specific procedures, mechanisms, or instruments for implementing these measures are the responsibility of the respondent, as it is the data controller who fully understands their organization and must decide, based on proactive responsibility and a risk-based approach, how to comply with the GDPR and the LOPDGDD.
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 26/31
However, in this case, notwithstanding the foregoing, in accordance with the evidence currently available regarding the initiation of disciplinary proceedings, the resolution adopted may require SPRINTER to adopt the following measures within 6 months from the date of enforcement of the final resolution of these proceedings:
- Demonstrate the implementation and effective application of the organizational and technical security measures, particularly those relating to: (...)
The imposition of this measure is compatible with the sanction consisting of an administrative fine, as provided for in Article 83.2 of the GDPR.
Please be advised that failure to comply with any order to adopt measures imposed by this agency in the resolution of this sanctioning procedure may be considered an administrative infringement in accordance with the GDPR, specifically classified as an infringement in Articles 83.5 and 83.6, and such conduct may lead to the initiation of further administrative sanctioning proceedings.
Furthermore, please note that neither acknowledgment of the infringement committed nor, where applicable, voluntary payment of the proposed amounts, exempts you from the obligation to adopt the necessary measures to cease the conduct or correct the effects of the infringement, and from the obligation to demonstrate compliance with this obligation to the Spanish Data Protection Agency (AEPD).
Therefore, in light of the foregoing, the President of the Spanish Data Protection Agency hereby resolves:
FIRST: To initiate disciplinary proceedings against SPRINTER MEGACENTROS DEL DEPORTE, S.L., with Tax Identification Number B53404646, for the alleged infringement of Article 5.1.f) of the GDPR, as defined in Article 83.5 of the GDPR.
SECOND: To appoint R.R.R. as investigating officer and S.S.S. as secretary, noting that they may be challenged, if necessary, in accordance with Articles 23 and 24 of Law 40/2015, of October 1, on the Legal Regime of the Public Sector (LRJSP).
THIRD: To incorporate into the file, for evidentiary purposes, the notification of the personal data security breach and the claims filed by the claimants and their documentation, as well as the documents obtained and generated by the General Sub-Directorate of Data Inspection in the actions prior to the initiation of these disciplinary proceedings.
FOURTH: That, for the purposes set forth in Article 64.2 b) of Law 39/2015, of October 1, on the Common Administrative Procedure of Public Administrations (hereinafter, LPACAP), the applicable sanction would be an administrative fine of €2,600,000 (two million six hundred thousand euros), without prejudice to the outcome of the investigation.
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 27/31
FIFTH: NOTIFY SPRINTER MEGACENTROS DEL DEPORTE, S.L., with Tax Identification Number (NIF) B53404646, of this agreement, granting it a period of ten business days to submit any allegations and present any evidence it deems appropriate. In its statement of allegations, it must provide its Tax Identification Number (NIF) and the procedure number shown in the heading of this document.
In accordance with the provisions of Article 85 of the LPACAP (Law on Administrative Procedure of Public Administrations), it may acknowledge its responsibility within the period granted for submitting allegations to this initiation agreement; this will entail a 20% reduction of the penalty to be imposed in this procedure. With the application of this reduction, the penalty would be set at €2,080,000 (two million eighty thousand euros), and the procedure will be resolved with the imposition of this penalty.
Likewise, at any time prior to the resolution of these proceedings, you may voluntarily pay the proposed penalty, which will result in a 20% reduction. With this reduction, the penalty will be set at €2,080,000 (two million eighty thousand euros), and its payment will terminate the proceedings, without prejudice to the imposition of any other applicable measures.
The reduction for voluntary payment of the penalty is cumulative with the reduction applicable for acknowledging responsibility, provided that this acknowledgment is made within the period granted for submitting allegations upon the initiation of the proceedings. The voluntary payment of the amount referred to in the preceding paragraph may be made at any time prior to the resolution. In this case, if both reductions were to be applied, the amount of the penalty would be set at €1,560,000 (one million five hundred and sixty thousand euros).
In any case, the effectiveness of either of the aforementioned reductions will be conditional upon the withdrawal or waiver of any administrative action or appeal against the penalty.
Should you choose to make a voluntary payment of either of the amounts
indicated above (€2,080,000 or €1,560,000), you must do so by depositing the funds into account number IBAN: ES00-0000-0000-0000-0000-0000 (BIC/SWIFT Code: CAIXESBBXXX) held in the name of the Spanish Data Protection Agency at CAIXABANK, S.A., indicating in the payment details the
procedure reference number shown at the top of this document and
the reason for the reduction you are applying for.
You must also send proof of payment to the General Sub-Directorate of Inspection to continue with the procedure in accordance with the amount
deposited.
In accordance with Article 76.4 of the LOPDGDD (Organic Law on the Protection of Personal Data and Guarantee of Digital Rights) and if the amount of the imposed penalty exceeds one million euros, it will be published in the Official State Gazette (BOE)
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 28/31
The information identifying the offender, the infringement committed, and the amount of the imposed penalty will be published in the Official State Gazette.
Finally, it should be noted that, pursuant to Article 112.1 of the LPACAP (Law on the Common Administrative Procedure of Public Administrations), no administrative appeal may be lodged against this decision.
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 28/31 1479-021025
Lorenzo Cotino Hueso
President of the Spanish Data Protection Agency
>>
SECOND: On November 5, 2025, SPRINTER paid the fine of €1,560,000.00, taking advantage of the two reductions stipulated in the initial agreement transcribed above. This constitutes acknowledgment of responsibility for the facts referred to in the initial agreement and their legal classification.
THIRD: The initial agreement transcribed above indicated that, should the infringement be confirmed, it could be agreed to impose on the controller the adoption of appropriate measures to bring its actions into compliance with the regulations mentioned in this act, in accordance with the provisions of Article 58.2 d) of the GDPR, according to which each supervisory authority may "order the controller or processor to bring processing operations into compliance with the provisions of this Regulation, where appropriate, in a specific manner and within a specified period...".
Having acknowledged responsibility for the infringement, the imposition of the measures included in the initial agreement is warranted.
LEGAL BASIS
I
Jurisdiction
In accordance with the powers granted to each supervisory authority by Article 58.2 of Regulation (EU) 2016/679 (General Data Protection Regulation, hereinafter GDPR) and as established in Articles 47, 48.1, 64.2 and 68.1 of Organic Law 3/2018, of December 5, on the Protection of Personal Data and Guarantee of Digital Rights (hereinafter LOPDGDD), the Presidency of the Spanish Data Protection Agency is competent to resolve this procedure.
Likewise, Article 63.2 of the LOPDGDD (Organic Law on the Protection of Personal Data and Guarantee of Digital Rights) stipulates that: "The procedures processed by the Spanish Data Protection Agency shall be governed by the provisions of Regulation (EU) 2016/679, by this Organic Law, by the implementing regulations issued thereunder, and, insofar as they do not contradict them, subsidiarily, by the general rules on administrative procedures."
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 29/31
II
Termination of the Procedure
Article 85 of Law 39/2015, of October 1, on the Common Administrative Procedure of Public Administrations (hereinafter, LPACAP), under the heading
“Termination of Sanctioning Procedures,” provides the following:
“1. Once a sanctioning procedure has been initiated, if the offender acknowledges their responsibility,
the procedure may be resolved by imposing the corresponding sanction.
2. When the sanction is solely monetary, or when a monetary sanction and a non-monetary sanction are applicable but the impropriety of the latter has been justified, voluntary payment by the alleged offender, at any time prior to the resolution, will imply the termination of the procedure,
except with regard to restoring the altered situation or determining compensation for damages caused by the commission of the infraction.
3. In both In cases where the sanction is solely monetary, the competent body for resolving the proceedings shall apply reductions of at least 20% to the proposed sanction amount, and these reductions may be combined.
These reductions must be specified in the notification initiating the proceedings, and their effectiveness shall be conditional upon the withdrawal or waiver of any administrative action or appeal against the sanction.
The percentage reduction provided for in this section may be increased by regulation.
III
Voluntary Payment and Acknowledgment of Responsibility
In accordance with the provisions of Article 85 of the LPACAP, the notified initiation agreement informed the appellant of the possibility of acknowledging responsibility and making voluntary payment of the proposed sanction, which would entail two cumulative reductions of 20% each. With the application of these two
reductions, the penalty would be set at €1,560,000.00, and its payment
would imply the termination of the proceedings, without prejudice to the imposition of the
corresponding measures.
Following notification of the aforementioned initiation agreement, SPRINTER has proceeded to
acknowledge responsibility and voluntarily pay the penalty, taking advantage of
the two reductions provided for. In accordance with section 3 of Article 85
LPACAP, the effectiveness of the aforementioned reductions will be conditional upon the withdrawal
or waiver of any action or appeal through administrative channels against the penalty.
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 30/31
It should be noted that, in accordance with the provisions of the LPACAP (Law on the Legal Regime of Public Administrations and Common Administrative Procedure), as well as the jurisprudence of the Supreme Court on this matter, the exercise of voluntary payment by the alleged liable party does not exempt the administration from the obligation to resolve and notify all proceedings, regardless of how they were initiated. Similarly, Article 88 of the aforementioned law establishes that the resolution that concludes the proceedings will decide all the issues raised by the interested parties and any other issues arising from them.
Therefore, in accordance with applicable legislation and having assessed the criteria for
graduating the sanctions, the Presidency of the Spanish Data Protection Agency RESOLVES:
FIRST: TO DECLARE the commission of the infringements and CONFIRM the sanctions
determined in the operative part of the initial agreement transcribed in this
resolution.
The sum of the aforementioned amounts totals €2,600,000.00.
Following the prompt payment and acknowledgment of responsibility by SPRINTER MEGACENTROS DEL DEPORTE, S.L., with Tax Identification Number (CIF)
B53404646, the amount is reduced by 40%,
resulting in a final amount of €1,560,000.00, pursuant to
Article 85 of the LPACAP (Law on the Common Administrative Procedure of Public Administrations).
The effectiveness of the aforementioned reductions is conditional, in any case, on the withdrawal or waiver of any action or appeal through administrative channels.
SECOND: DECLARE the termination of procedure EXP202401683, in accordance with the provisions of Article 85 of the LPACAP (Law on Administrative Procedure).
THIRD: ORDER SPRINTER MEGACENTROS DEL DEPORTE, S.L., with Tax Identification Number (CIF) B53404646, to notify the Agency, within 6 months from the date this resolution becomes final and enforceable, of the adoption of the measures described in the legal grounds of the initial agreement transcribed in this resolution.
FOURTH: NOTIFY SPRINTER MEGACENTROS DEL DEPORTE, S.L., with Tax Identification Number (CIF) B53404646, of this resolution.
FIFTH: In accordance with the provisions of Article 85 of the LPACAP (Law on the Common Administrative Procedure of Public Administrations), which conditions the
reduction for voluntary payment and acknowledgment of responsibility on the withdrawal
or waiver of any action or appeal through administrative channels, this resolution
will be final through administrative channels and fully enforceable upon notification.
In accordance with the provisions of Article 76.4 of the LOPDGDD (Organic Law on the Protection of Personal Data and Guarantee of Digital Rights) and given that the
amount of the imposed sanction exceeds one million euros, the information identifying the offender, the
infringement committed, and the amount of the sanction will be published in the Official State Gazette (BOE).
In accordance with the provisions of Article 50 of the LOPDGDD, this
Resolution will be made public. Publication will take place once the resolution has been
notified to the interested parties.
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 31/31
This resolution, which concludes the administrative process as stipulated by art. Pursuant to Article 114.1.c) of Law 39/2015, of October 1, on the Common Administrative Procedure of Public Administrations, interested parties may file an administrative appeal with the Administrative Chamber of the National Court, in accordance with the provisions of Article 25 and paragraph 5 of the fourth additional provision of Law 29/1998, of July 13, regulating the Administrative Jurisdiction, within two months from the day following notification of this act, as provided for in Article 46.1 of the aforementioned Law.
However, in accordance with the provisions of Article 90.3.a) of the LPACAP, the final administrative decision may be provisionally suspended if the interested party expresses their intention to file an administrative appeal. If this is the case,
the interested party must formally notify the Spanish Data Protection Agency in writing,
submitting it through the Agency's Electronic Registry [https://sedeaepd.gob.es/sede-electronica-web/], or
through any of the other registries provided for in Article 16.4 of Law
39/2015, of October 1.
They must also provide the Agency with documentation
proving the effective filing of the administrative appeal.
If the Agency does not receive notification of the filing of the administrative appeal within two months from the day following notification of this resolution,
the precautionary suspension will be terminated.
... 1259-101025
Lorenzo Cotino Hueso
President of the Spanish Data Protection Agency
6 Jorge Juan Street www.aepd.es
28001 – Madrid sedeaepd.gob.es
