Enforcement · Spanish Data Protection Authority (aepd) EN LLM context A cited markdown file you can paste into your AI assistant (ChatGPT, Claude, a RAG or project knowledge base) to ground it in this document. Contains: this document’s text, its sections with their topics, and the full text of every law provision it applies. Everything links back to its source on overview.legal — legal information, not advice.
ENDESA (energy supplyer): Insufficient legal basis for data processing
How it connects
Related across sources
Guidance Art. 29 WP Guidelines on GDPR transparency requirements (WP260 rev.01) Case Law VB v Natsionalna agentsia za prihodite Guidance Guidelines 05/2022 on the use of facial recognition technology in the area of law enforcement Case Law UI v Österreichische Post AG News Can the roles of DPO and whistleblowing officer be merged? Case Law Meta Platforms v noyb
Full text
The complainant's bank account was charged by ENDESA, the beneficiary of which was a third party, who had been convicted under criminal law and imposed with a two-year restraining order regarding the claimant, her domicile and work. Instead amending the contract details as requested by the claimant ENDESA deleted her data erroneously and fillid in the data of the third party. The AEPD found the disclosure of the claimant's data to the third party was a severe violation of the principle of confidentiality.
Industry: Transportation and Energy
Original document at the source www.aepd.es