ALBOR ENERGÍA S.L. – €12,000 Fine (Spain, 2025)

On 8 August 2023 a data subject filed a complaint with the DPA regarding a call from their energy provider. According to the data subject, they received a call from a company posing as their energy provider, stating there was an error in their bills and that their contract needed to be updated. The other company sent several e-mails to the data subject asking them to sign a new contract. After calling their energy provider, it confirmed that the company posing as them was a separate company. The data subject decided not to sign the contract. The DPA began investigating on 8 November 2023, and requested information to ALBOR ENERGÍA S.L. (an energy consultant, the processor) regarding the companies involved in the case. The companies involved are the following: - The company posing as the data subject's energy provider has a contract with a company to sell electricity under its brand. The latter is the controller in this case. - The controller has a contract with the processor to request potential clients to contact and offer services to. - The processor has an agreement with a marketing company (the sub-processor). This is the company that contacted the data subject according to the processor. - This sub-processor has a contract with a call center for the use of its database. This is the company that contacted the data subject according to the DPA's investigations. It is important to note that the contract between the controller and the processor explicitly prohibits the processor from subcontracting without prior authorisation. The processor argued that it was not responsible for processing the personal data of the data subject, as it did not have a legal relationship with the data subject at any moment. Furthermore, the processor stated that it had stopped working with the sub-processor (and by extension the call center). This was due to concerns over their processing of personal data and whether they verified if the data subject was included in an adve