Spain's data protection authority, the Agencia Española de Protección de Datos, published a blog discussing personal data protection and the effectiveness of organizations' security measures. The AEPD highlighted the difference between organizations that focus on protecting their information systems and organizations that mainly focus on compliance.