Sanction RGPD Spanish Data Protection Authority (aepd) — ENERGYA VM GESTIÓN DE ENERGÍA, S.L. : 5,0 M€ (2024)
- Autorité de contrôle
- Spanish Data Protection Authority (aepd)
- Pays
- Espagne
- Entreprise / secteur
- ENERGYA VM GESTIÓN DE ENERGÍA, S.L.
- Montant de l'amende
- 5,0 M€
- Date de la décision
- 6 février 2024
- Fondement juridique
- Art. 5 (1) a), Art. 5 (2)
- Manquement
- Non-respect des principes de traitement
Résumé des faits
The Spanish DPA (AEPD) has fined ENERGYA VM GESTIÓN DE ENERGÍA, S.L. EUR 5 million following an investigation into unlawful personal data processing by Nivalco, a company contracted by Energya VM to make sales calls to customers. During these calls, customers were misled into providing additional personal data to conclude a new energy supply contract. The AEPD determined that Energya VM acted as the 'data controller' for the processing of this personal data, as it provided Nivalco with a sales script, thereby influencing the data processing. However, Energya VM failed to comply with GDPR requirements, particularly by not conducting a risk assessment for Nivalco's data processing activities