EDP Comercializadora, S.A.U.
€75K($81K USD)final
Date Issued
2020-01-07
Regulation
Authority
Spanish Data Protection Authority (AEPD)
Country
Spain
Violation Type
Non-compliance with lawful basis for data processing
Currency
EUR
Violation Summary
The company was fined because it processed personal data in regards to a gas contract without the applicants’ consent. The investigation revealed that the applicant received an invoice for the supplying of natural gas, a contract which they didn’t sign. EDP Comercializadora argued that since the applicant had a contract with another gas company with which EDP Comercializadora had a collaboration agreement, it was justified to process the personal data of the respective individuals. The AEPD, however, ruled that the company was required to receive permission directly from the affected individuals to process personal data.
Articles Violated
Art. 6 GDPR