- Enforcing jurisdiction
- Spain · Geography does not establish applicable law.
- Confirmed applicable legislation
- Privacy topics
EDP Comercializadora, S.A.U. – €1,500,000 Fine (Spain, 2021)
Privacy enforcement record
This record is classified outside cookie consent. Subject classification does not confirm an applicable law. It is not included in cookie statistics or the Risk Calculator.
EDP Comercializadora, S.A.U. was fined for processing personal data without proper consent and failing to inform users about their rights. This is significant because it shows the importance of transparency and consent in data handling.
What happened
EDP Comercializadora, S.A.U. processed personal data without obtaining proper consent and failed to inform users.
Who was affected
Customers whose personal data was processed without their knowledge.
What the authority found
The Spanish DPA found that EDP Comercializadora, S.A.U. violated GDPR by not informing users about their rights and not verifying consent.
Why this matters
This case highlights the need for businesses to have clear consent processes and to inform users about their data rights. Companies should review their data collection practices to ensure compliance.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Linked-source text retrieved.
Automated check recorded — 5 March 2026.
No issues were reported by that automated check.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
The Spanish DPA (AEPD) has imposed a fine of EUR 1,500,000 on EDP Comercializadora, S.A.U.. The decision follows, in particular, several complaints received for processing personal data without consent. As the DPA found, the controller had failed to inform data subjects in accordance with Art. 13 GDPR when collecting their data. This involved data subjects not being informed of their rights under Art. 15 GDPR - Art. 22 GDPR, and the contact details of the controller (e.g. its address) being incomplete. Besides, the company's business practice allowed it to conclude contracts with customer representatives instead of with the customers directly. In these cases, however, the data controller did not check whether there was actually an authorization to represent the data subjects. The DPA finds that the controller failed to implement a procedure to verify the authorization of the alleged representatives.The fine is composed proportionately of EUR 1,000,000 for a breach of Art. 13 GDPR and EUR 500,000 for a breach of Art. 25 GDPR.
Related Enforcement Actions (1)
Other enforcement actions involving EDP Comercializadora, S.A.U. in ES
Details
Fine Date
4 May 2021
Authority
Agencia Española de Protección de Datos
Fine Amount
€1,500,000
Enforcement Tracker ID
ETid-670
About this data
Cite as: Cookie Fines. EDP Comercializadora, S.A.U. - Spain (2021). Retrieved from cookiefines.eu
Last updated: