Alterna Operador Integral SL – €50,000 Fine (Spain, 2021)

The complainant filed an action against Alterna Operador Integral SL (Flip Energy). The complainant complained that her energy provider was switched from Naturgy to Flip Energy without her consent. Invoices proved that this change had occured. As such, the complainant's personal data were transferred to Flip Energy without having proof of consent from the concerned data subject, the complainant, or that there were other legitimate purposes for processing that personal data. Flip Energy claims that the subcontracted company (Sycgestion Global Energy, S.L.) was responsible for contacting and promoting Flip Energy services to the data subject. Is it contrary to Article 6(1) of the GDPR for a customer to have their energy provider switch from one company to another without contracting with them or having gathered their consent prior to the switch? The Spanish DPA (AEPD) held that Alterna Operador Integral SL (Flip Energy) infringed Article 6(1) of the GDPR as it processed the complainant's data without a legal basis. The data subject's personal data were incorporated into Flip Energy's information system without proving that it was necessary for a contract, that the data subject had consented to it, or that there was another legal basis making the processing lawful. The DPA noted that the complainant had taken no action or caution with the subcontracted company (Sycgestion Global Energy, S.L.) responsible for contacting and promoting Flip Energy services to the data subject. However, the DPA held that inactivity by Alterna Operador Integral SL (Flip Energy) lead to failure to take action or precautions. The DPA also held that the defendant failed to prove that the complainant had contracted for the supply of energy from Flip Energy (and as such contracted for the switch). The defendant did not provide any documents obtained from the complainant indicating a contractual relationship which effectively identified the complainant. Therefore, the Spanish DPA impo