fined

He has just been fined 10 million euros

by

The Spanish Data Protection Agency has imposed on Aena the largest technological sanction in Spain. This is not a security or data leak problem, but rather having deployed a “high-risk” technology for fundamental rights without demonstrating that it was really necessary. The supervisor has also ordered the immediate suspension of all facial recognition at airports until the deficiencies are corrected. What has happened. The fine of 10,043,002 euros specifically punishes the lack of a valid Impact Assessment before processing biometric data of more than 62,000 passengers. The resolution, dated November 6 but known now, details that Aena continued with the system despite having received two previous unfavorable reports from the Agency itself during the consultation phase. The core of the infringement. The problem is not using biometrics, but how the system architecture was designed: Aena opted for a “one-to-many identification” model with centralized storage. This means that the passenger’s face was not only checked against their documentation at the time of screening, but was stored in a central database for up to two years. The regulator considers that there were much less intrusive alternatives to achieve the same objective of speeding up boarding. For example, local biometric authentication or simply the traditional visual verification system that has worked for decades. Between the lines. The AEPD challenges the premise that the “user experience” justifies any technological deployment. In its resolution, the body headed by Lorenzo Cotino describes Aena’s lack of diligence as “serious” and emphasizes that the company was fully aware that its program involved special category and high-risk treatment. The system worked at eight airports: Madrid-Barajas. Barcelona-El Prat. Alicante. Gran Canaria. Tenerife-North. Palma de Mallorca. Minorca. Ibiza. Going through biometric controls was voluntary and coexisted with traditional documentary controls, which will continue to operate as before. Aena’s response. The airport manager has announced that it will appeal the sanction before the courtsexpressing his “respectful disagreement.” It maintains that the passengers gave their consent voluntarily and that the security of the data was never compromised. “There has been no security breach and, therefore, there has been no data leak,” the company stressed. Aena describes the sanction as “disproportionate” and argues that it is based on an “alleged violation of a formal obligation.” However, in the field of data protection, consent does not validate processing if it is disproportionate or unnecessary from its design. Yes, but. The suspension dictated by the AEPD will not affect flight operations. It will remain in place until Aena carries out a risk assessment that truly considers the dangers to the rights and freedoms of travelers. The company has assured that it will work to restart the program “as soon as possible.” In Xataka | “We have not done it well”: the DGT assumes that something has failed in the arrival of the V-16 beacons Featured image | Aena

A car rental company has fined a customer with 100 euros for smoking behind the wheel. The only problem is that he never did

by

Should you smoke inside the car? The debate is a pédiagudo and has gained strength in Spain in recent weeks after the balloon was dropped that smoking could be prohibited from the wheel in our country. The reasons wielded range from the health of the rest of the passengers (especially if the driver travels with children) to the possible distractions that a cigarette can cause. But where Smoking is prohibited It is in rental cars or in shared car services. That is what a driver has discovered to whom a company the carsharing platform Thousandsvery widespread in Berlin, has punished with 100 euros of sanction because it ensures that it briefly smoked up to four times. However, the driver alleges that this is not possible. He says not only that he has not smoked in the car, he emphasizes that he is not even a smoker. A black box for smokers The story is brought by our German companions of Gamestar Tech. They explain that, as in Spain, neither in their carsharing vehicles is allowed to smoke. To control it, cars have a small smoke detector that launches a sound warning when it records that someone inside the vehicle is smoking. According to the company, this notice rang up to four times on a three -kilometer journey that lasted 10 minutes. The driver does recognize that the detector rang but defends himself by ensuring that he is not a smoker and that, of course, he did not smoked inside the car. In your article, Gamestar Tech It shows the activity peaks registered by the smoke detector in which the four, supposed, smoke snacks that the driver expelled. The sanction on the part of the company is 100 euros but the driver says he has no intention of paying it. To try to get rid of the fine, the sanctioned contacted thousands, the carsharing company, but these were limited to showing the report with the four peaks of activity. As in the case of defective AI When reviewing the damage to a rental car, we are facing the evidence that the driver and the company are in unequal positions because one has alleged activity records and the driver has no way to prove that it is A “non -smoker”. Although the case of this driver is the last one, it is not much less unique. In social networks You can read similar complaints of other drivers who have had problems with the service of Miles, ensuring that the detector began to whistle without having reasons for it. In all testimonies a sanction is mentioned by the company of 100 euros. Some even point out that they have charged this amount up to three occasions. In the case of thousands, the detector is designed by Bosch and it is common to find them in rental vehicles. In the Consumer Information Association Austrian highlights the case of a driver who lived a similar situation. This time with a rental car and an economic punishment that reached 300 euros. The Bosch system boasts to be able to discern if a person has smoked or simply has a smell of tobacco impregnated in clothes. Therefore, I should be able to discriminate if really The driver has given or not a draft to cigarette. In addition, they claim to use artificial intelligence to send a signal to the center that manages fleets when the detector has been activated to give notice and, thus, to be able to manage the car cleaning more quickly. Photo | Thousands Mobility and Hans Isaacson In Xataka | Smoking ends on the terraces and beaches: socially makes sense, scientifically not so much

A man stayed a 20 -euro bizum sent by mistake. The judge has fined her and has come out ten times more expensive

by

With 28 million active users, Bizum is the most used system in Spain for payments among users. We send and receive a lot of money through Bizum and make an mistake when typeing the number we want to send money is something that can happen with relative ease. If we are lucky, they may return it to us, but what happens if who is on the other side decides to stay the money? Now we know. Staying a bizum sent by mistake is very expensive. As we said, making a mistake to type the number to which we want to send a bizum can be quite easy and it is just what happened to a neighbor of Benavente, as they say in Zamora’s opinion. The person who received the 20 euros did not return the amount and the woman decided to denounce him to the authorities. The Provincial Court of Zamora has proved him right and has condemned the receiver of the transfer to return the 20 euros, in addition to paying the judicial coasts and a fine of 180 euros for a slight crime of improper appropriation. More than ten times the original amount. The Civil Code says. The denounced has resorted to the sentence alleging lack of evidence and presumption of innocence, but the judge has confirmed it and considers that the woman had not consented to the transfer. This would apply not only to Bizum, but to transfers and any other payment received by error. He Article 1895 of the Civil Code It is clear, it must always be returned: When something that was not entitled to collect is received, and that by mistake it has been improperly delivered, the obligation to restore it arises. There is jurisprudence. There have been more cases that have reached the courts for transfers made by error, such as this one of an Alicante businessman who faces Three years in jail for not returning a payment of 341,000 That was done by mistake. EITHER This 2015 sentence who condemned a woman for staying with 25,900 euros of the pension plan of her ex -husband, the result of an error of the bank when rescuing the money. Bizum in figures. Bizum It has become the standard of immediate payments in Spain. Arrived in 2016 as part of an initiative among various banking entities, although it was not until 2018 when It extended and began to grow. It currently has 28 million users and it is expected to reach 30 throughout the year. In 2024 an average of 3 million operations were made per day. The record was the past Black Friday (November 29, 2024), with 4.8 million operations. Or what is the same: 55 bizums per second. In total, in 2024 1,093 million operations were made worth 44,206 million euros. We do not know the number of erroneous operations when sending money, but with these numbers it is logical that they are increasing. Bizum grows, legal doubts too. In parallel to this growth, unknowns have also been increasing from the legal and legal point of view. Many users wonder What income or payments should be declared to the Treasury. We know that it is not necessary to declare payments between friends and family, although the freelancers who use it to collect, the income that generate economic profitability as rentals or if the total amount adds more than 10,000 euros per year should do. Doubts have also emerged about whether something that has eliminated the Threshold of 3,000 euros in the control of transfers by the Treasury. In this case, if high amounts are received through Bizum, the Treasury may investigate it, just as they would do if it were a transfer or a metallic income. Little by little, light is shed and it is clear that, at the legal level, Bizum is one more method to move money and apply the same rules as any type of income In Xataka | Timo of the false bizum by mistake: how it works and how to avoid this scam

Five identical cyberbrains did not suffice for Carrefour to react. So they have fined it with 3.2 million euros

by

The Spanish Data Agency (AEPD) has imposed A fine of 3.2 million euros to Carrefour for alleged infractions of several articles of the RGPD. The surprising thing is not that, but the fact that these infractions were due not to a single cyber attack, but five … exactly the same. Security gaps. Carrefour notified to The AEPD up to five personal data security violations, all related to illegitimate access to customer accounts. The gaps occurred on January 13, January 20, January 24, April 18 and April 21, 2023. All with the same technique. Credential Stuffing. Everything indicates that these security gaps occurred when taking advantage of credential criminals (name, password) of Legitimate Employees of Carrefour who ended up filtering and managed to be obtained by the attackers, probably through Previous massive data robberies. Stolen data. Among the affected data They were name, surname, email, telephone number, DNI, physical address or customer passport number, in addition to information related to their interests, purchase trends and commercial preferences. Thousands of affected. The number of affected according to the AEPD was 118,895 unique accounts that the attacker could obtain personal information. According to Carrefour, the real affectation was much lower: the one that impacted the people’s integrity It was only 234 cases and the confidentiality of its data 973 cases. Several serious infractions. Carrefour recognized his responsibility for the alleged violation of article 34 of the GDPR (communication of the gaps to the affected people) but initially did not consider it “mandatory.” In addition, the AEPD concluded that Carrefour violated the principle of integrity and confidentiality (Article 5.1.F of the RFPD) by allowing illegitimate access to third parties of personal data. And lack of diligence. According to those responsible for AEPD, Carrefour did not have implanted the technical measures necessary to guarantee a level of safety appropriate to risk, but also accused it of lack of diligence. In Carrefour they ended up implementing the double authentication optionbut only since October 2023, when five security gaps had already been used. The fine, broken down. The total fine is 3.2 million euros, but it is actually composed of three concepts: Violation of the principle of integrity and confidentiality (very serious): two million euros Infringement of data processing (serious): one million euros Infringement for communication to interested parties (mild): 200,000 euros. Do not protect customer data is expensive. Iberdrola received an even greater than 6.5 million euros last year after being the victim of a cyber attack that Exposed the data of 850,000 clients. Before, in July 2021, the AEPD I fined 2.5 million euros to Mercadona For a violation of the privacy of the users: in this case, for a pilot of facial recognition that carried out months before and that laid a precedent for this type of systems. With this data, a threat: identity supplaments. Whenever customer data is stolen, there is a clear threat: that they are used to supplant the identity of those customers. With these data it is possible to configure custom and directed scams, much more credible and dangerous for the victims. The other immediate risk is that cybercounts use these credentials to try to steal accounts in all types of services, hence the importance of Do not use the same password on different platforms. Image | Xataka In Xataka | We visited the National CNI cryptological center: here is the epicenter of Spanish cybersecurity

Log In

Forgot password?

Forgot password?

Enter your account data and we will send you a link to reset your password.

Your password reset link appears to be invalid or expired.

Log in

Privacy Policy

Add to Collection

No Collections

Here you'll find all collections you've created before.