Enforcement · Spanish Data Protection Authority (aepd) EN LLM context A cited markdown file you can paste into your AI assistant (ChatGPT, Claude, a RAG or project knowledge base) to ground it in this document. Contains: this document’s text, its sections with their topics, and the full text of every law provision it applies. Everything links back to its source on overview.legal — legal information, not advice.

EDP Energía, S.A.U: Insufficient fulfilment of information obligations

€1,500,000 Fine
EDP Energía, S.A.U
SPAIN
Art. 13 GDPR Art. 25 GDPR
Controllers Personal Data Processing Agreement Representatives Data Controller Processing Supervisory Authorities Consent
May 4, 2021 Source

How it connects

Related across sources

Case Law SG Nürnberg - S 5 SF 65/24 DS Social Court Nuremberg Case Law Deutsche Wohnen SE v Staatsanwaltschaft Berlin CJEU Guidance Guidelines 07/2022 on certification as a tool for transfers EDPB Guidance EDPB Annual Report 2021 EDPB Guidance Guidelines 2/2020 on articles 46 (2) (a) and 46 (3) (b) of Regulation 2016/679 for transfers of personal data between EEA and non-EEA public authorities and bodies EDPB Guidance Guidelines 4/2019 on Article 25 Data Protection by Design and by Default Version 2.0 Adopted on 20 October 2020 EDPB

Full text

The Spanish DPA (AEPD) has imposed a fine of EUR 1,500,000 on EDP Energía, S.A.U.. The decision follows, in particular, several complaints received for processing personal data without consent. As the DPA found, the controller had failed to inform data subjects in accordance with Art. 13 GDPR when collecting their data. This involved data subjects not being informed of their rights under Art. 15 GDPR - Art. 22 GDPR, and the contact details of the controller (e.g. its address) being incomplete. Besides, the company's business practice allowed it to conclude contracts with customer representatives instead of with the customers directly. In these cases, however, the data controller did not check whether there was actually an authorization to represent the data subjects. The DPA finds that the controller failed to implement a procedure to verify the authorization of the alleged representatives.The fine is composed proportionately of EUR 1,000,000 for a breach of Art. 13 GDPR and EUR 500,000 for a breach of Art. 25 GDPR.

Industry: Transportation and Energy

Original document at the source www.aepd.es

Similar Content