IBERDROLA CLIENTES, S.A.U – €200,000 Fine (Spain, 2025)

A data subject entered into a contract with IBERDROLA CLIENTES, S.A.U (a utilities company, the controller) in October 2022. The data subject decided to terminate the contract early in December 2022. This came with a penalty of 114 euros in total, which the controller informed the data subject by mail. The payment request was issued on 1 March 2023, however, it was not sent by the post service until 14 March 2023. The controller requested ASNEF (a credit information agency) to include the information on the data subject’s debt on 27 March 2023. This was done despite the fact that the data subject had not received the payment request. The data was included in the ASNEF’s delinquency file on 28 March. The data subject presented a complaint to the DPA on 26 August 2023. According to the data subject, the controller transferred data related to an outstanding debt to ASNEF without their knowledge. This was because the data subject was unaware of the debt and that their data would be included in a credit information agency system. The controller argued that the data subject was sufficiently informed, since the contract stated the possibility of transferring data to a credit information agency in cases of nonpayment. The request for payment also stated this possibility. The DPA imposed a €200,000 fine on the controller on 8 April 2025, and the controller filed an internal appeal on 20 May 2025. The DPA dismissed the internal appeal on the basis that the deadline to file the appeal had already passed. In its initial decision, the DPA stated that the data transfer to the credit reference agency was unlawful under Article 6(1) GDPR. National law ([https://www.boe.es/buscar/act.php?id=BOE-A-2018-16673#a2-2 Article 20 of the Spanish Data Protection Act]) allows data processing by credit information agencies related to unfulfilled financial obligations. This processing, however, must meet specific conditions, and process data in line with the GDPR. While the payment request was issued by the controller on 1 March, the national post service did not accept the shipment until 10 March. This was one day before the payment deadline (11 March). The post service did not send the payment request until 14 March. The DPA stated that the controller should have considered the time needed to deliver the payment request and pay the penalty. Furthermore, the controller transferred the data before receiving confirmation that the post service had not delivered the payment request. According to the DPA, the controller had not fulfilled its obligations of informing the data subject on the possibility of their data being included in credit information agency systems. This was the case despite the DPA acknowledging that the contract stated the possibility of transferring data to a credit information agency in cases of nonpayment. With this, the DPA considered the processing unlawful under [https://www.boe.es/buscar/act.php?id=BOE-A-2018-16673#a2-2 Article 20(1)(c) of the Spanish Data Protection Act] and Article 6(1) GDPR. The DPA upheld the €200,000 fine and ordered the controller to adapt its processing operations to the applicable data protection law. The DPA considered this a serious violation of the data subject’s rights, as their data was included in a credit information agency system without allowing them to settle the debt first. Lawfulness of processing is also a principle of data protection under the GDPR. Finally, the DPA stated that the controller must ensure an adequate level of diligence when processing data.