60,000 Euro fine against National Social Security Institute
Data protection violations in cloud services for minimum income management.

The Spanish data protection authority AEPD imposed a fine against the Instituto Nacional de la Seguridad Social (INSS) for violations in managing the minimum income (IMV) through cloud services. The authority found violations regarding data processing agreements (Art. 28 GDPR), insufficient information obligations (Art. 13 GDPR) and inadequate security measures (Art. 32 GDPR). Cloud-based applications such as the IMV simulator and web forms for applications were affected.