Sanction RGPD Spanish Data Protection Authority (aepd) — NATURGY ENERGY GROUP, S.A. : 48 k€ (2022)
- Autorité de contrôle
- Spanish Data Protection Authority (aepd)
- Pays
- Espagne
- Entreprise / secteur
- NATURGY ENERGY GROUP, S.A.
- Montant de l'amende
- 48 k€
- Date de la décision
- 28 août 2022
- Fondement juridique
- Art. 5 (1) f), Art. 32
- Manquement
- Non-respect des principes de traitement
Résumé des faits
The Spanish DPA has imposed a fine on NATURGY ENERGY GROUP, S.A.. A person had contacted the energy company pretending to be a relative of a customer. The person requested to receive electricity bills using a new email address. To verify the identity, the person had to provide name, address, ID number, contract number and the last 4 digits of the bank account details of the customer. However, the DPA found that this verification did not comply with the requirements of the GDPR for identity verification and considered it to be a violation of Art. 5 (1) f) GDPR and Art. 32 GDPR. The original fine of EUR 80,000 was reduced to EUR 48,000 due to voluntary payment and admission of responsibility.