ENERGYA VM GESTIÓN DE ENERGÍA, S.L.
Non-compliance with general data processing principles
決定日
2024年2月6日
権威
Spanish Data Protection Authority (aepd)
ES
セクター
Transportation and Energy
国名
ES
法律
GDPRステータス
FINAL説明
The Spanish DPA (AEPD) has fined ENERGYA VM GESTIÓN DE ENERGÍA, S.L. EUR 5 million following an investigation into unlawful personal data processing by Nivalco, a company contracted by Energya VM to make sales calls to customers. During these calls, customers were misled into providing additional personal data to conclude a new energy supply contract. The AEPD determined that Energya VM acted as the 'data controller' for the processing of this personal data, as it provided Nivalco with a sales script, thereby influencing the data processing. However, Energya VM failed to comply with GDPR requirements, particularly by not conducting a risk assessment for Nivalco's data processing activities