ENERGYA VM GESTIÓN DE ENERGÍA, S.L.
Non-compliance with general data processing principles
决定日期
2024年2月6日
权力
Spanish Data Protection Authority (aepd)
ES
部门
Transportation and Energy
国家
ES
法律
GDPR现状
FINAL说明
The Spanish DPA (AEPD) has fined ENERGYA VM GESTIÓN DE ENERGÍA, S.L. EUR 5 million following an investigation into unlawful personal data processing by Nivalco, a company contracted by Energya VM to make sales calls to customers. During these calls, customers were misled into providing additional personal data to conclude a new energy supply contract. The AEPD determined that Energya VM acted as the 'data controller' for the processing of this personal data, as it provided Nivalco with a sales script, thereby influencing the data processing. However, Energya VM failed to comply with GDPR requirements, particularly by not conducting a risk assessment for Nivalco's data processing activities