Enforcement · Data Protection Authority of Hamburg EN LLM context A cited markdown file you can paste into your AI assistant (ChatGPT, Claude, a RAG or project knowledge base) to ground it in this document. Contains: this document’s text, its sections with their topics, and the full text of every law provision it applies. Everything links back to its source on overview.legal — legal information, not advice.

Vattenfall Europe Sales GmbH: Insufficient data processing agreement

€900,000 Fine
Vattenfall Europe Sales GmbH
GERMANY
Art. 12 GDPR Art. 13 GDPR
Fairness & Transparency Processing Agreement Controllers Personal Data Processing Data Processor Supervisory Authorities Law Enforcement
Sep 24, 2021 Source

How it connects

Related across sources

Case Law Deutsche Wohnen SE v Staatsanwaltschaft Berlin CJEU Guidance Guidelines 07/2022 on certification as a tool for transfers EDPB News Danish SA Declares Use of Google Analytics Unlawful Without Supplementary Measures Datatilsynet Guidance Guidelines 2/2020 on articles 46 (2) (a) and 46 (3) (b) of Regulation 2016/679 for transfers of personal data between EEA and non-EEA public authorities and bodies EDPB Case Law Google LLC v CNIL CJEU Guidance Guidelines 2/2018 on derogations of Article 49 under Regulation 2016/679 EDPB

Full text

The DPA from Hamburg has imposed a fine of EUR 900,000 on Vattenfall Europe Sales GmbH. The fine is related to data matching, which the controller had carried out in the period from August 2018 to December 2019 in the course of contract inquiries for special contracts. The special contracts served to attract new customers and were accompanied by bonus payments for the customers. The controller compared personal data of prospective customers who had submitted an inquiry for a special contract with contracts concluded by existing customers. If this revealed that an applicant had already signed a contract with the controller, then switched to another supplier and now wanted to sign a contract again, the controller could reject the application for the special contract if necessary. This was intended to prevent 'bonus shopping', which is not lucrative for the companies. However, the controller had not properly informed the customers that such comparisons would be made. The DPA considered this to be a violation of the company's transparency and information obligations. Around 500,000 people were affected.

Industry: Transportation and Energy

Original document at the source www.heise.de

Similar Content