|Date of enforcement action:|
|Spain||EUR 75,000 (US$82,000)|
|Defendant company or entity:||Industry segment:|
|EDP Comercializadora S.A.||Utilities /|
EDP Comercializadora S.A., a Spanish energy company, processed personal data without a legal basis and then issued an invoice for the provision of gas services to the data subject. The data subject reportedly did not consent to the gas account, or sign any contract with the respondent company. This was considered a breach of the GDPR, Article 6, and subsequent to a complaint, EDP Comercializadora SA was fined EUR 75,000 by the Spanish Data Protection Agency.
“In short, the behavior of EDP, embodied in the processing of personal data of the claimant, i.e. name, national identity number, mobile phone number and home address, to initiate gas supply services in a contract which the data subject denies being part, and without any positive act of the data subject and without there being an indication of minimum diligence, violates Article 6.1.b of the GDPR, and requires disciplinary action as per article 83.5 of the GDPR.”
The respondent company had argued that the data subject’s contract with a separate (but related) company was enough to justify the processing of data for gas services. This was rejected. The Spanish Data Protection Agency also rejected the argument that a mandate existed, given by the data subject, for the related company to deal with the respondent company on the data subject’s behalf and pass personal data to it for the provision of gas services.
(Spanish Data Protection Agency)
|Enforcement authority:||Type of enforcement action:|
|Spanish Data Protection Agency||Penalty notice|
|Subject to appeal?|
Cite this fine in your work
Data Privacy Fines Index. (2020-01-07 11:55) EDP Comercializadora S.A., energy company, fined EUR 75k. dataprivacyfines.com. Retrieved from https://dataprivacyfines.com/fine/edp-comercializadora-sa-fined-eur-75k/
Entry last updated: 2020-01-18 12:30 GMT.