SUMINISTRADOR IBERICO DE ENERGIA S.L. – €70,000 Fine (Spain, 2023)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
Spain's data protection authority fined SUMINISTRADOR IBERICO DE ENERGIA S.L. EUR 70,000 for billing a customer without a valid contract. The company continued to charge the customer even after they canceled their energy contract, which violated GDPR rules. This case highlights the importance of having a legal basis for processing personal data.
What happened
SUMINISTRADOR IBERICO DE ENERGIA S.L. continued to issue invoices and charge a customer after they canceled their contract.
Who was affected
A customer who mistakenly signed up for an energy contract and later canceled it was affected.
What the authority found
The Spanish authority found that the company lacked a legal basis for processing the customer's data after the contract was canceled, violating GDPR Article 6(1).
Why this matters
This ruling emphasizes the need for companies to ensure they have a valid legal basis for processing personal data, especially when contracts are canceled. Businesses should review their contract and billing processes to avoid similar violations.
GDPR Articles Cited
On 14 July 2021 the data subject mistakenly signed a contract with másLUZ Energía (marketed by SUMINISTRADOR IBÉRICO DE ENERGÍA - SIE) through an SMS. As he later realized that másLUZ Energía was posing as the complainant's own energy supplier, he requested the cancellation of the contract for gas supply on 10 August 2021 and for electricity supply on 26 August 2021. Nonetheless, másLUZ Energía (SIE), the controller, continued issuing energy consumption invoices to the data subject, which were automatically paid via his bank account. Further, in January 2022, the controller again changed the electricity contract without consent of the data subject. On 24 April 2022, the data subject filed a complaint with the Spanish DPA against SIE. The Spanish DPA considered the certification of the digital signature of the supply contract through the sending of an SMS with másLUZ Energía (SIE) on 14 July 2021 and, with this, the registration in the services in August 2021. The DPA also acknowledged the request by the data subject to withdraw from the contract for gas supply on 10 August 2021 and for electricity supply on 26 August 2021. As a matter of fact, the controller was able to provide evidence (through call recordings and SMS) of the contract, but only with respect to the contract signed on 14 July 2021, from which the claimant withdrew on 10 and 26 August 2021 respectively. However, the controller failed to adduce evidence of the contract of January 2022, according to which two invoices were issued by másLUZ Energía (SIE) between 8 and 18 January 2022, and another one with consumptions made between 19 January and 11 February 2022. The controller thus failed to provide a legitimate basis for processing activities that took place after the data subject withdrew from the contract. Accordingly, the Spanish DPA held that the processing activities carried out after cancellation of the contract lacked a legal basis under Article 6(1) GDPR. In light of this, the DPA issued a
Related Enforcement Actions (0)
No other enforcement actions found for SUMINISTRADOR IBERICO DE ENERGIA S.L. in ES
This is the only recorded action for this entity in this jurisdiction.
Details
Fine Date
22 May 2023
Authority
Agencia Española de Protección de Datos
Fine Amount
€70,000
GDPRhub ID
gdprhub-6237About this data
Cite as: Cookie Fines. SUMINISTRADOR IBERICO DE ENERGIA S.L. - Spain (2023). Retrieved from cookiefines.eu
Last updated: