Sanction RGPD Spanish Data Protection Authority (aepd) — I-DE Redes Eléctricas Inteligentes, S.A.U : 200 k€ (2021)
- Autorité de contrôle
- Spanish Data Protection Authority (aepd)
- Pays
- Espagne
- Entreprise / secteur
- I-DE Redes Eléctricas Inteligentes, S.A.U
- Montant de l'amende
- 200 k€
- Date de la décision
- 2 mars 2021
- Fondement juridique
- Art. 5 (1) b), c), Art. 6 (1) b)
- Manquement
- Non-respect des principes de traitement
Résumé des faits
The Spanish DPA (AEPD) imposed a fine of EUR 200,000 on I-DE Redes Eléctricas Inteligentes, S.A.U. The DPA received complaints from Waitum, S.L. and Servicios Aby 2018, S.L. because their customers had received letters from the controller. Both companies had previously transferred their customers' personal data to the controller under a network access agreement entered into with the controller. Under this agreement, the two companies acted as representatives of their respective customers, who were supplied with electricity by the controller. In the letters sent, the controller mentioned, among other things, alleged breaches of contract and non-payment by the companies to the controller. In the course of its investigations, the DPA determined that the sending of these letters was neither related to nor necessary for the performance of the respective contract. The controller had therefore violated the principles of purpose limitation and data minimization, so that the sending of these letters constituted unlawful processing of the customers' personal data.