Spain

ENERGYA VM GESTIÓN DE ENERGÍA, S.L.

5,000,000 €

GDPR enforcement action by Spanish Data Protection Authority (aepd) on 2024-02-06.

Rank · Sector

#13

of 167 in Transportation and Energy

Rank · Spain

of 1,075

Rank · All fines

#73

of 3,050

Case details

Authority: Spanish Data Protection Authority (aepd)
Date: 2024-02-06
Controller / Processor: ENERGYA VM GESTIÓN DE ENERGÍA, S.L.
Sector: Transportation and Energy
Quoted Articles: Art. 5 (1) a) GDPR, Art. 5 (2) GDPR
Type of violation: Non-compliance with general data processing principles

Summary

The Spanish DPA (AEPD) has fined ENERGYA VM GESTIÓN DE ENERGÍA, S.L. EUR 5 million following an investigation into unlawful personal data processing by Nivalco, a company contracted by Energya VM to make sales calls to customers. During these calls, customers were misled into providing additional personal data to conclude a new energy supply contract. The AEPD determined that Energya VM acted as the 'data controller' for the processing of this personal data, as it provided Nivalco with a sales script, thereby influencing the data processing. However, Energya VM failed to comply with GDPR requirements, particularly by not conducting a risk assessment for Nivalco's data processing activities

Open original source Links to the regulator's original publication or another source.