Sanction RGPD Spanish Data Protection Authority (aepd) — BASER COMERCIALIZADORA DE REFERENCIA, S.A. : 150 k€ (2022)
- Autorité de contrôle
- Spanish Data Protection Authority (aepd)
- Pays
- Espagne
- Entreprise / secteur
- BASER COMERCIALIZADORA DE REFERENCIA, S.A.
- Montant de l'amende
- 150 k€
- Date de la décision
- 11 avril 2022
- Fondement juridique
- Art. 6, Art. 32
- Manquement
- Base légale insuffisante pour le traitement
Résumé des faits
The Spanish DPA has fined BASER COMERCIALIZADORA DE REFERENCIA, S.A., EUR 150,000. A customer of the company had filed a complaint with the DPA since their electricity supply contract was modified without their consent. This resulted in an increase in the electricity supply. In the course of its investigations, the DPA found that a fraudster had pretended to be the data subject by providing the name and ID number of the data subject. In this way, they were able to modify the data subject's contract. According to the DPA, the controller had not properly verified the identity of the fraudster before modifying the contract and, due to a lack of sufficient security measures, had not made sure that the inquirer was actually the data subject.