Spain

CURENERGÍA COMERCIALIZADOR DE ÚLTIMO RECURSO S.A.U.

500,000 €

GDPR enforcement action by Spanish Data Protection Authority (aepd) on 2025-12-22.

Rank · Sector

#41

of 167 in Transportation and Energy

Rank · Spain

#43

of 1,075

Rank · All fines

#249

of 3,050

Case details

Authority: Spanish Data Protection Authority (aepd)
Date: 2025-12-22
Controller / Processor: CURENERGÍA COMERCIALIZADOR DE ÚLTIMO RECURSO S.A.U.
Sector: Transportation and Energy
Quoted Articles: Art. 25 GDPR
Type of violation: Insufficient technical and organisational measures to ensure information security

Summary

The Spanish DPA has imposed a fine of EUR 500,000 on CURENERGÍA COMERCIALIZADOR DE ÚLTIMO RECURSO S.A.U. The controller used a communication tool that was not designed in accordance with the privacy-by-design principle. This resulted in an unaffiliated third party receiving messages containing personal data intended for another customer.

Open original source Links to the regulator's original publication or another source.