Spain

NATURGY ENERGY GROUP, S.A.

48,000 €

GDPR enforcement action by Spanish Data Protection Authority (aepd) on 2022-08-28.

Rank · Sector

#82

of 167 in Transportation and Energy

Rank · Spain

#242

of 1,075

Rank · All fines

#754

of 3,050

Case details

Authority: Spanish Data Protection Authority (aepd)
Date: 2022-08-28
Controller / Processor: NATURGY ENERGY GROUP, S.A.
Sector: Transportation and Energy
Quoted Articles: Art. 5 (1) f) GDPR, Art. 32 GDPR
Type of violation: Non-compliance with general data processing principles

Summary

The Spanish DPA has imposed a fine on NATURGY ENERGY GROUP, S.A.. A person had contacted the energy company pretending to be a relative of a customer. The person requested to receive electricity bills using a new email address. To verify the identity, the person had to provide name, address, ID number, contract number and the last 4 digits of the bank account details of the customer. However, the DPA found that this verification did not comply with the requirements of the GDPR for identity verification and considered it to be a violation of Art. 5 (1) f) GDPR and Art. 32 GDPR. The original fine of EUR 80,000 was reduced to EUR 48,000 due to voluntary payment and admission of responsibility.

Open original source Links to the regulator's original publication or another source.