Sanction RGPD Spanish Data Protection Authority (aepd) — CURENERGÍA COMERCIALIZADOR DE ÚLTIMO RECURSO S.A.U. : 500 k€ (2025)
- Autorité de contrôle
- Spanish Data Protection Authority (aepd)
- Pays
- Espagne
- Entreprise / secteur
- CURENERGÍA COMERCIALIZADOR DE ÚLTIMO RECURSO S.A.U.
- Montant de l'amende
- 500 k€
- Date de la décision
- 22 décembre 2025
- Fondement juridique
- Art. 25
- Manquement
- Mesures techniques et organisationnelles insuffisantes
Résumé des faits
The Spanish DPA has imposed a fine of EUR 500,000 on CURENERGÍA COMERCIALIZADOR DE ÚLTIMO RECURSO S.A.U. The controller used a communication tool that was not designed in accordance with the privacy-by-design principle. This resulted in an unaffiliated third party receiving messages containing personal data intended for another customer.