Energia y Servicios Aby 2018 SL – €200,000 Fine (Spain, 2021)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
The Spanish data protection authority fined Energia y Servicios Aby 2018 SL EUR 200,000 for mishandling customer data. The company shared personal information with an energy distributor without a valid reason, violating data protection rules. This case highlights the importance of having a clear legal basis for using customer data.
What happened
Energia y Servicios Aby 2018 SL shared customer data with an energy distributor without a valid legal reason.
Who was affected
Customers of Energia y Servicios Aby 2018 SL whose personal data was shared with an energy distributor.
What the authority found
The Spanish authority found that the company lacked a valid legal basis for sharing personal data, breaching data protection principles.
Why this matters
This case emphasizes the need for companies to ensure they have a proper legal basis before sharing customer data. It serves as a reminder that businesses must respect data protection principles like purpose limitation and data minimization.
GDPR Articles Cited
View original scraped data
Original data from scraper before AI verification against source document.
National Law Articles
Entities Involved
Energia y Servicios Aby 2018 SL (ESA 2018) and Watium SL filed a complaint against I-DE, Redes Eléctricas Inteligentes SAU (I-DE, previously Iberdrola Distribución Eléctrica) before the Spanish DPA (AEPD). Watium is an electric power trading company which is subscribed with the energy distribution company I-DE by way of a network access contract (ATR). This contract is refers to Articles 3(2) and 3(3) of the Royal Decree 1435/2002. The contract included the identification and contact of the end consumer, the logo of Iberdrola Distribución Eléctrica (now i-DE) and the identification of Watium. Although signed by the two entities, there is no place for the end consumer's signature in the contract. In the letters sent by Iberdrola/I-DE to Watium end consumers in 2018, Iberdrola/I-DE stated that the were forced to send Watium (according to the law) a request for payment for unpaid invoices. They requires that the end consumer get in contact with their provider company. Watium informed these facts to the Spanish Competition Authority (Comisión Nacional de los Mercados y la Competencia - CNMC) and the Spanish DPA (AEPD) in January 2018. At the time, the AEPD issued a report stating that it could be concluded that processing of personal data carried out by I-DE violated data protection law (legal basis and data protection principles). The report highlighted that the appropriate legal basis would have been contractual necessity (Article 6(1)(c)) but the processing of personal data of the consumer (who acts by way of an intermediary) is not necessary for the fulfillment of that contract as the intermediary is precisely there to deal with the communication with these types of communications. The AEPD at the time added that I-DE violated the principles of purpose limitation and data minimisation (Article 5(1)(b) and (c)). In January 2020, Energia y Servicios Aby 2018 SL (ESA 2018), another electric power trading company subscribed to I-DE complained to the AEPD about identi
Related Enforcement Actions (0)
No other enforcement actions found for Energia y Servicios Aby 2018 SL in ES
This is the only recorded action for this entity in this jurisdiction.
Details
Fine Date
12 February 2021
Authority
Agencia Española de Protección de Datos
Fine Amount
€200,000
GDPRhub ID
gdprhub-3203About this data
Cite as: Cookie Fines. Energia y Servicios Aby 2018 SL - Spain (2021). Retrieved from cookiefines.eu
Last updated: