NATURGY IBERIA, S.A. ("Naturgy") – €100,000 Fine (Spain, 2024)

Naturgy (the controller) is one of the main electricity and utilities company in Spain. In December 2022, the data subject's electricity provider informed the data subject that it had discontinued its service at the request of the controller. This was done on the basis of a contract the data subject had allegedly signed. The data subject claimed that the contract was signed through an unknown phone number and IP address, and refused to pay the bills sent by the controller. The process of signing a contract with the controller was carried out by an external company. If an individual expresses the intention to enter into a contract (this was not defined by the controller in the case), they are sent an SMS with a link. This leads to a website containing the product information and policies, and the individual can press a button to give consent to enter into a contract. The time and date are recorded, as well as the individual’s IP address. On 21 February 2023 the data subject presented a complaint to the DPA. The DPA chose not to proceed with the case, and the data subject presented an internal appeal in June 2023. The data subject attached additional evidence in which they claim the controller threatened them if the bills were not paid. The controller argued that the unlawful processing was carried out by a processor acting outside of the instructions of the controller. According to the DPA, the controller did not process the data subject’s personal data lawfully because it did not have a legal basis to do so under Article 6(1)(b) GDPR. The DPA criticized the fact that the controller did not ensure it had a valid legal basis before processing the data. The DPA dismissed the controller's argument, stating it was the controller’s responsibility to verify the phone number that received the SMS to confirm the contract. Furthermore, the data subject warned the controller that they had not signed the contract after being notified of the data transfer. Despite this, the controller continued to send invoices. The DPA fined the controller €100,000. The DPA considered it a serious infraction of the GDPR.