NATURGY ENERGY GROUP, S.A.

Kuvaus

The Spanish DPA has imposed a fine on NATURGY ENERGY GROUP, S.A.. A person had contacted the energy company pretending to be a relative of a customer. The person requested to receive electricity bills using a new email address. To verify the identity, the person had to provide name, address, ID number, contract number and the last 4 digits of the bank account details of the customer. However, the DPA found that this verification did not comply with the requirements of the GDPR for identity verification and considered it to be a violation of Art. 5 (1) f) GDPR and Art. 32 GDPR. The original fine of EUR 80,000 was reduced to EUR 48,000 due to voluntary payment and admission of responsibility.