ENERGYA VM GESTIÓN DE ENERGÍA, S.L.

What happened

Energya VM Gestión de Energía, S.L., (“Energya VM” or “data controller”) entered into a contractual relationship with Nivalco, to promote its services. Nivalco contacted individuals from its database, offering discounts or insurance purportedly from their current energy supplier. However, these offers were actually agreements with Energya VM. Many data subjects only discovered they had entered into agreements with a new company when they noticed unexpected charges on their bank accounts. AEPD's investigation began following police reports of alleged crimes by energy supply companies. Energya VM failed to conduct a prior risk analysis analysis,ensure GDPR compliance in processing, and adopt measures for GDPR-compliant sales pitches. The AEPD found Energya VM negligent for allowing Nivalco’s deceptive practices to persist despite being aware of them at some point during the contractual relationship and imposed fines.

Summary from the GDPRhub page for this decision, written by its volunteers, not by Fino. CC BY-NC-SA 4.0.

Rules involved

• Art. 5Principles relating to processing of personal data5(1)(a) · 5(2)Read →

• Data principles