Spain

I-DE Redes Eléctricas Inteligentes, S.A.U

200,000 €

GDPR enforcement action by Spanish Data Protection Authority (aepd) on 2021-03-02.

Rank · Sector

#81

of 369 in Media, Telecoms and Broadcasting

Rank · Spain

#55

of 1,075

Rank · All fines

#345

of 3,050

Case details

Authority: Spanish Data Protection Authority (aepd)
Date: 2021-03-02
Controller / Processor: I-DE Redes Eléctricas Inteligentes, S.A.U
Sector: Media, Telecoms and Broadcasting
Quoted Articles: Art. 5 (1) b), c) GDPR, Art. 6 (1) b) GDPR
Type of violation: Non-compliance with general data processing principles

Summary

The Spanish DPA (AEPD) imposed a fine of EUR 200,000 on I-DE Redes Eléctricas Inteligentes, S.A.U. The DPA received complaints from Waitum, S.L. and Servicios Aby 2018, S.L. because their customers had received letters from the controller. Both companies had previously transferred their customers' personal data to the controller under a network access agreement entered into with the controller. Under this agreement, the two companies acted as representatives of their respective customers, who were supplied with electricity by the controller. In the letters sent, the controller mentioned, among other things, alleged breaches of contract and non-payment by the companies to the controller.
In the course of its investigations, the DPA determined that the sending of these letters was neither related to nor necessary for the performance of the respective contract. The controller had therefore violated the principles of purpose limitation and data minimization, so that the sending of these letters constituted unlawful processing of the customers' personal data.

Open original source Links to the regulator's original publication or another source.