EDP Solar Spain – €42,000 Fine (Spain, 2025)

Ecodes, here the processor, ran a solar neighbourhood project where 100 residents could take advantage of the solar energy generated on the roof of a municipal building in their area for a set monthly fee. In order to sign up to the project, interested individuals had to register on a website provided by EDP Solar, a solar panel provider and here the controller. The entered details were then sent to the Ecodes email account, here the processor, which selected eligible candidates and then sent their information to EDP Solar in order for them to be added to the participant list. The data subject was one of the participants in the project. The data subject had received an email to which a pdf had been attached which contained the following parts of personal data belonging to 99 different people: name, surname, ID numbers, mobile phone number, e-mail address, postal address, town and postcode and the individuals’ signatures. The data subjected contacted Ecodes informing them of the data breach and requesting Ecodes to restrict the excesive processing of personal data. Ecodes then sent the data subject an email explaining that the information had to be disclosed as the document sent was the contract on which the project was based. It explained that every participant had to be provided with a copy of the contract they had entered into. The data subject lodged a complaint with the Spanish DPA (Agencia Española de Protección de Datos – AEPD). The email had been sent from an Ecodes domain but at the bottom of the email, you could see the EDP logo and during the investigation, it was established that EDP Solar had instructed Ecodes to send the email. The investigation showed that the pdf file included several documents which were relevant to the contract such as the powers of attorney of each participant but also included the personal information listed above. The AEPD determined that EDP Solar acted as the controller and Ecodes as the processor as Ecodes had been instructed to send the pdf file. The AEPD found that it had been unnecessary to disclose to all participants in the project each others personal information in the pdf contract. It therefore found an infringement of Article 5(1)(c) GDPR. The AEPD found that while the controller lacked intention for the infringement, there was also a clear lack of due diligence. The AEPD initially set the responding fine at €70,000 but pursuant to Law 39/2015, a Spanish law concerning administrative proceedings, the AEPD informed the controller that it may acknowledge its responsibility for the alleged violations and/or pay the proposed fine. Each of these actions reduces the imposed fine by 20%. The controller opted to reduce the fine by 40%, both acknowledging its responsibility for the violations and paying the reduced sanction amount of €42,000.