Energya VM Gestión de Energía, S.L – €5,000,000 Fine (Spain, 2024)

Energya VM received several complaints from data subjects alleging they had been contacted by Nivalco, which offered energy services. The individuals making these calls had access to the customers' personal data. In response, Energya VM held a meeting with Nivalco to clarify the purpose of the calls and the discounts being offered. An internal audit revealed that most of the calls targeted customers who had canceled their agreements within the initial days of the contract. Under their contractual arrangement, Nivalco was responsible for promoting Energya VM’s services and managing a database containing the personal information of individuals and businesses for marketing purposes. Energya VM claimed it was not involved in compiling this database and only accessed personal data when an individual entered into an agreement for energy services. On May 9, 2023, the Spanish Data Protection Agency (AEPD) initiated an investigation into alleged violations of Article 5(2) GDPR and Article 5(1)(a) GDPR. Energya VM denied responsibility for Nivalco’s data processing practices, asserting that Nivalco independently obtained and managed the personal data and autonomously decided its use. Energya also argued that its lack of access to the database prevented effective supervision. However, during its investigation, the AEPD found that Energya VM had provided Nivalco with instructions regarding the processing of personal data, undermining Energya’s claims of non-involvement. Energya VM was deemed the data controller. The contractual relationship between Energya VM and Nivalco ended on May 28, 2020. The AEDP determined that Energya VM violated Article 5(1)(a) GDPR, as well as Article 5(2) GDPR. • Article 5(1)(a) GDPR: The facts indicate that the processing of personal data was neither lawful nor transparent, as Energya VM was aware that Nivalco was using the data in a manner that misled customers. Energya VM provided Nivalco with a sales script for the calls, which violated Arti