EDP Comercializadora S.A., energy company, fined EUR 75k

On 07/Jan/2020, EDP Comercializadora S.A. received a privacy fine of EUR 75,000. The enforcement authority (Spanish Data Protection Agency) has cited these legal provisions in imposing the fine on EDP Comercializadora S.A.: Article 6 GDPR/ GDPR/

Essentials

Date of enforcement action:
07/Jan/2020
Jurisdiction: Fine imposed:
Spain Flag for Spain, which is the jurisdiction taking enforcement action EUR 75,000 (US$82,000)
Defendant company or entity: Industry segment:
EDP Comercializadora S.A. Utilities /

Case summary

EDP Comercializadora S.A., a Spanish energy company, processed personal data without a legal basis and then issued an invoice for the provision of gas services to the data subject. The data subject reportedly did not consent to the gas account, or sign any contract with the respondent company. This was considered a breach of the GDPR, Article 6, and subsequent to a complaint, EDP Comercializadora SA was fined EUR 75,000 by the Spanish Data Protection Agency.

“In short, the behavior of EDP, embodied in the processing of personal data of the claimant, i.e. name, national identity number, mobile phone number and home address, to initiate gas supply services in a contract which the data subject denies being part, and without any positive act of the data subject and without there being an indication of minimum diligence, violates Article 6.1.b of the GDPR, and requires disciplinary action as per article 83.5 of the GDPR.”

The respondent company had argued that the data subject’s contract with a separate (but related) company was enough to justify the processing of data for gas services. This was rejected. The Spanish Data Protection Agency also rejected the argument that a mandate existed, given by the data subject, for the related company to deal with the respondent company on the data subject’s behalf and pass personal data to it for the provision of gas services.

(Spanish Data Protection Agency)

Applicable legal provisions

Enforcement information

Enforcement authority: Type of enforcement action:
Spanish Data Protection Agency Flag for Spain, which is the jurisdiction taking enforcement action Penalty notice
Subject to appeal?
Yes

Cite this fine in your work

Data Privacy Fines Index. (2020-01-07 11:55) EDP Comercializadora S.A., energy company, fined EUR 75k. dataprivacyfines.com. Retrieved from https://dataprivacyfines.com/fine/edp-comercializadora-sa-fined-eur-75k/

Entry last updated: 2020-01-18 12:30 GMT.