AEPD (Spain) - EXP202307313

AEPD - EXP202307313
Authority:	AEPD (Spain)
Jurisdiction:	Spain
Relevant Law:	Article 6(1) GDPR Article 83(5) GDPR
Type:	Complaint
Outcome:	Upheld
Started:	13.04.2023
Decided:	31.07.2024
Published:	16.10.2024
Fine:	60,000 EUR
Parties:	Curenergía
National Case Number/Name:	EXP202307313
European Case Law Identifier:	n/a
Appeal:	n/a
Original Language(s):	Spanish
Original Source:	AEPD (in ES)
Initial Contributor:	Ao

The DPA fined an energy provider €60,000, after its processor erroneously assigned the data subject to a different company and therefore unlawfully disclosed personal data to that company.

English Summary

Facts

On the 13 April 2023, the data subject filed a complaint with the Spanish DPA (AEPD) against the controller, an electricity provider. The data subject had been a customer of the controller until 2021 and on the 12 April 2022 again wanted to register as a customer with the controller. The customer service team of the controller contacted the data subject to confirm his account and telephone number.

The data subject alleged that the controller was still in possession of the data subject’s personal data such as his ID card number, his name and his address as he did not have to provide this data anew.

After supplying data to the customer service team of the controller, the data subject received an email from the controller as well as another electricity company, the partner company of the controller, asking him to sign the attached pdf contract. The contract included personal data such as the data subject’s name, address and IBAN. The data subject therefore concluded that the controller had transferred personal data to its partner company without the data subject’s consent.

After the submission of the complaint, the AEPD launched preliminary investigative procedures to clarify the facts of the case. The partner company submitted to the AEPD that the controller and itself do not maintain any sort of relationship in the processing of personal data and that each company solely processes the data of its own customers without there being any cross-over. However, both companies belong to the Iberdrola Group and use the same processor for their customer service. The partner company ensured that there is a system in place which identifies which customers belong to which company. The partner company further submitted that the customer service employee had made a mistake and sent the contract from the wrong company. Immediate steps were taken to cancel the contract with the partner company.

The controller further submitted that they had responded to the data subjects email notifying them of the mistake just three hours later with an apology.

Holding

On the 31 of July 2024, the AEPD commenced sanctioning proceedings against the controller. It highlighted that the controller had irresponsibly handled the data which led to another entity having access to the data without the data subject's consent. The AEPD demonstrated that the transfer of data to the partner company was processing which the data subject never consented to.

The AEPD considered that the unlawful processing of personal data by the partner company of the controller was caused by an accident but insisted that this does not negate the unlawful act.

The AEPD held that the controller had infringed Article 6(1) GDPR and set a fine of €100,000 based on the controller’s annual turnover (Article 83(5)) GDPR). The fine was reduced to €60,000 as the controller accepted the judgement and the voluntary payment procedure.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Spanish original. Please refer to the Spanish original for more details.

1/16

File No.: EXP202307313

RESOLUTION TO TERMINATE THE PROCEDURE FOR VOLUNTARY

PAYMENT

From the procedure instructed by the Spanish Data Protection Agency and based
on the following

BACKGROUND

FIRST: On July 31, 2024, the Director of the Spanish Data Protection
Agency agreed to initiate sanctioning proceedings against CURENERGÍA
COMERCIALIZADOR DE ÚLTIMO RECURSO, S.A.U. (hereinafter, the

respondent), by means of the Agreement transcribed below:

<<

File No.: EXP202307313

AGREEMENT TO START SANCTIONING PROCEDURE

From the actions carried out by the Spanish Data Protection Agency and
based on the following:

FACTS

FIRST: D. A.A.A. (hereinafter, the claimant) on April 13, 2023
filed a claim with the Spanish Data Protection Agency. The
claim is directed against CURENERGÍA COMERCIALIZADOR DE ÚLTIMO
RECURSO, S.A.U. with NIF A95554630 (hereinafter, the respondent or
Curenergía). The reasons on which the claim is based are the following:

The complainant states that he was a Curenergía customer until 2021, and that
he subsequently contacted the electricity supplier of last resort (***EMAIL.1) by email on April 12, 2022, to sign up again with Curenergía.

He adds that Curenergía already had the supply data because he had previously been a
customer of said company, so in the customer service area by telephone they only
asked him for some of his data to confirm if they were the same (power, account number and
phone number), while he did not provide the other data (ID, name, postal address).

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 2/16

In confirming the data requested, he received an email from ***EMAIL.1
indicating that "I confirm that I have just sent the policy with electronic signature to your email."

He also received an email from "***EMAIL.2" asking him to electronically
sign the PDF contract, sent by Iberdrola Clients.

Thus, the claimant states that Curenergia transferred all his data (ID, IBAN, name, surname, address) to Iberdrola Clients without his consent so that

it could formalize the electricity supply contract with the latter, having never
maintained any type of relationship with Iberdrola Clients.

The following documentation is provided with the notification:

Email dated April 12, 2023, sent by the claimant to
***EMAIL.3, stating the following:

<<I had this contract Supply contract reference (CURENERGÍA
COMERCIALIZADOR DE ÚLTIMO RECURSO S.A.U.): ***TELEPHONE.1 with
CURENERGIA which is currently with another marketer. I wanted to

put it back with CURENERGIA in PVPC>>.
Response from Curenergía Clientes dated April 12, 2023:

<<We confirm that we have received your email and that we have started the
necessary steps to respond to you as soon as possible>>.

Email from Curenergía Clientes dated April 12, 2023 addressed to the
complainant:

<<To carry out the procedure you request, it is necessary that you indicate to me, if you are so kind,
the following information: The name of the marketing company with which you are currently

registered. If you are the current holder or if you are going to change. Bank account
in which you wish to direct debit the payment. Contact telephone number. Contracted power
in each of the sections, peak and off-peak. If you wish to receive correspondence by
regular or electronic mail and address.

Email from the claimant dated April 12, 2023:

<<The name of the marketing company with which you are currently: NATURGY If you are the current holder or if you are going to change: SAME HOLDER Bank account in which you want to direct debit the payment: ***PAYMENT.1 Contact telephone number:
***PHONE.2 Contracted power in each of the sections, peak and valley: No
changes: PEAK 0.100 kW and VALLEY 0.700 kW If you want to receive correspondence by

regular or electronic mail and address: BY EMAIL ***EMAIL.4>>

Email from Curenergía Clientes dated April 12, 1:10 p.m. addressed to the
claimant:

<<I confirm that I have just sent the policy with electronic signature to your email so that if you agree and the data is correct, I ask you to continue these
simple steps: You will receive an email with a link to the document so that you can view it
from your device. When you click on the link, you will be redirected to a website, where you must

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 3/16

allow access by clicking on the "Start" check. This screen will only appear
on your first access. You will access the platform to view the PDF with the offer and, at
the end of the document, you can accept the offer or reject it>>.

Email from Iberdrola Customers for the claimant dated April 12,
2023, 1:06 p.m. addressed to the claimant:

<<Dear A.A.A., Thank you for your interest in contracting with Iberdrola. To view
and sign the offer and its conditions, click the View document button in this

email. Once the document has been opened, go to the last page and select
the Accept and Sign option. After signing it, you will receive a copy of the document in
your email>>.

Contract sent by Iberdrola Clientes, S.A.U. to the claimant dated April 12,

2023, where the following data appears:

<<ELECTRICITY SUPPLY CONTRACT CONTRACTING PARTIES
Retailer: IBERDROLA CLIENTES, S.A.U. Tax ID: A95758389
Registered Office: Plaza Euskadi 5, 48009 Bilbao Customer Service Telephone:
***TELEPHONE.3 / ***TELEPHONE.4 IBERDROLA CLIENTES, S.A.U. is authorized

by the Directorate General of Energy Policy and Mines of the Ministry of Energy,
Tourism and Digital Agenda for the activity of marketing electricity and
natural gas. CUSTOMER Surname and First Name/Company Name: A.A.A. NIF: ***NIF.1 Date of
Birth: SUPPLY ADDRESS Supply address: ***ADDRESS.1
SPECIFIC CONDITIONS PRODUCTS AND SERVICES TO BE

CONTRACTED Stable Electricity Plan SUPPLY CONDITIONS Type of
contract: Normal Voltage: 1X230 V Access rate: BT 2.0 TD Mode 1 Power
Contracted: Peak: 100 W Valley: 700 W CUPS: ***CUPS.1 Distribution Company:
UFD Distribución de Electricidad, S.A. Attention Network Failures: XXXXXXXXX
ECONOMIC CONDITIONS ELECTRICITY PRICE Power Term

Peak: 34.504864 €/kW and year Power Term Valley: 6.377714 €/kW and year
Energy Term: 0.201984 €/kWh The cost will be added to the prices>>

SECOND: In accordance with article 65.4 of Organic Law 3/2018, of December 5, on the Protection of Personal Data and Guarantee of Digital Rights (hereinafter LOPDGDD), said claim was forwarded to the respondent party, so that

it could proceed to its analysis and inform this Agency within a period of one month, of the
actions carried out to comply with the requirements provided for in the data protection
regulations.

The transfer, which was carried out in accordance with the rules established in Law 39/2015, of

October 1, on the Common Administrative Procedure of Public Administrations
(hereinafter, LPACAP), was received on June 1, 2023, as
shown in the acknowledgment of receipt in the file.

No response has been received to this transfer letter.

THIRD: On July 13, 2023, in accordance with article 65 of the
LOPDGDD, the claim submitted by the claimant was admitted for processing.

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 4/16

FOURTH: The General Subdirectorate of Data Inspection proceeded to carry out
preliminary investigation actions to clarify the facts in question, by virtue of the functions assigned to the control authorities in
article 57.1 and the powers granted in article 58.1 of Regulation (EU)
2016/679 (General Data Protection Regulation, hereinafter RGPD), and in

compliance with the provisions of Title VII, Chapter I, Section two, of the
LOPDGDD, being aware of the following points:

1. In relation to the facts claimed, the representatives of IBERDROLA
CLIENTS in response to the request of this Agency, dated October 6, 2023, make the following statements:

Article 12.3 of Law 24/2013, of December 26, on the Electricity Sector,
establishes within the framework of regulation of the separation of activities, that "the
distribution companies and the reference marketing companies that
form part of a group of companies that develops regulated and

free activities in the terms provided for in this law, will not create confusion in their
information and in the presentation of their brand and brand image with respect to the
identity of the subsidiaries of their same group that carry out marketing activities".

As a consequence of the aforementioned provision, IBERDROLA CLIENTES and

CURENERGIA COMERCIALIZADORA DE ÚLTIMO RECURSO, S.A.U (hereinafter "CURENERGIA") do not maintain any type of relationship in the
processing of the personal data of their clients.

Each of the two marketing companies maintains its own treatments, without any confusion or permeability between them, so that each

of the marketing companies only processes the information of its own clients and does not
process any personal data of those who do not have this status.

Both entities belong to the Iberdrola Group and both maintain links with
the same service provider for telephone customer service of the two companies, which acts as the data processor for both companies.

In these cases, the Iberdrola Group has adopted the necessary measures to
guarantee compliance with the obligations related to the separation of activities. The telephone customer service lines for IBERDROLA
CLIENTS are different from those that CURENERGIA makes available to its
clients, having established a system that allows the operator to know if the
interested party has requested the attention of one or the other entity.

Operators have express instructions related to the prohibition of cross-access to the databases of the entities, so that in the event that the interested party has contacted CURENERGIA through the telephone number, it is expressly prohibited to access the databases of IBERCLI, as well as to provide any type of information related to this entity.

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 5/16

In relation to the specific case that is the subject of the claim, and taking into account the content of the information incorporated in the request, the sequence of events is as follows:

• On April 12, 2023, the claimant contacted CURENERGIA to enter into a contract with it,
• That same day, CURENERGIA requested a series of documents from the interested party, which were sent to it by the claimant. The CURENERGIA sales representative informs the claimant that he will send him the contract for his

signature.
• On that same date, the contract is sent to the claimant, however, an error occurs in the sales representative's
actions and he sends a contract from IBERCLI and not from CURENERGIA.
• The contract with IBERCLI was cancelled as a result of the

contracting by the Claimant of the supply with another supplier on April 14, 2023.

Thus, in the process of sending the contract to the claimant, an error occurred
on the part of the person who attended the request, as a result of which
there was a confusion between the two entities to which the operator provided
services.

The correction of this error occurred immediately, through the
cancellation of the contract signed with IBERDROLA CLIENTS.

In relation to the service provider for telephone customer service shared between IBERDROLA CLIENTES and CURENERGIA, the representatives of IBERDROLA CLIENTES declare that they do not have any type of relationship in the processing of personal data of the customers of each of the entities.

Each of the two marketing companies maintains its own processing, without any type of confusion or permeability between the two, so that each of the marketing companies only processes the information of its own customers and does not process any personal data of those who do not have this status.

In any case, given that both companies belong to the Iberdrola Group, both sometimes maintain links with the same service provider. This is the case in the case of telephone service for the customers of both companies, which is carried out in both cases by the same contact center service provider, who will act as the data processor for both companies.

They provide a copy of the contract signed by IBERCLI and UNÍSONO SOLUCIONES DE

NEGOCIO

The representatives of the entity provide a copy of the express instructions

related to the prohibition of cross-access to the databases of the entities. The telephone lines for IBERCLI customers are different from
those that CURENERGIA makes available to its customers, having established

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 6/16

a system that allows the operator to know if the interested party has requested the
attention of another.

This guide contains express provisions related to the prohibition of access by the operator, in the event that the interested party has contacted
it through the CURENERGIA telephone number, to access the IBERCLI databases, as well as to provide it with any type of information
related to this entity.

To prove the evidence of the cancellation of the contract entered into by mistake with
IBERDROLA CLIENTS. they provide a screenshot of the IBERCLI system where the cancellation of the contract entered into by mistake with the claimant is
evident

1. The representatives of Curenergía indicate the following on October 9, 2023,
in response to the request of this Agency:

In relation to the specific case subject to the claim, the sequence of events is as follows:

• On April 12, 2023, D. A.A.A. (hereinafter, "the Claimant")

contacted CURENERGIA to enter into a contract with it,
• That same day, CURENERGIA requests a series of
documents from the interested party, which are sent to him by the Claimant. The CURENERGIA sales representative informs the Claimant that he will send him the contract

for signature. • On the same date, the contract is sent to the Complainant, although there is an error in the actions of the salesperson and he sends a contract from IBERCLI and not from CURENERGIA.

• Immediately after receiving it, the Complainant contacts the entity, indicating that same day that the contract sent is from IBERCLI and not from CURENERGIA. CURENERGIA responds to the aforementioned email just three hours later, apologizing to the Complainant and indicating that it is an error.
• Finally, on April 13, 2023, that is, just two days after the aforementioned error occurred, the Complainant signs the electricity supply contract number ***CONTRACT.1 with CURENERGIA.

Thus, in the process of sending the contract to the claimant, an error occurred on the part of the person who attended to the request, as a result of which a confusion arose between the two entities to which the operator provided services.

The correction of this error occurred by signing the contract requested from CURENERGIA.

FIFTH: According to the report collected from the AXESOR tool, the entity
Curenergía is a large company established in 2008, and with a turnover of
2,177,703,000 euros in 2022.

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 7/16

LEGAL BASIS

I

Competence

In accordance with the powers that article 58.2 of Regulation (EU) 2016/679
(General Data Protection Regulation, hereinafter RGPD), grants to each
control authority and as established in articles 47, 48.1, 64.2 and 68.1 of Organic Law 3/2018, of December 5, on the Protection of Personal Data and

guarantee of digital rights (hereinafter, LOPDGDD), the Director of the Spanish Data Protection Agency is competent to
initiate and resolve this procedure.

Likewise, article 63.2 of the LOPDGDD determines that: "The procedures

processed by the Spanish Data Protection Agency will be governed by the provisions
of Regulation (EU) 2016/679, in this organic law, by the regulatory provisions
issued in its development and, insofar as they do not contradict them, in a
subsidiary manner, by the general rules on administrative procedures."

II

Unfulfilled Obligation

The respondent is charged with committing an infringement for violating
Article 6 of the GDPR, "Lawfulness of processing", which indicates in its section 1 the
cases in which the processing of third party data is considered lawful:

"1. Processing is only lawful if at least one of the following

conditions is met:

a) the data subject has given consent to the processing of his or her personal data
for one or more specific purposes;

b) processing is necessary for the performance of a contract to which the data subject is

party or in order to take steps at the request of the data subject prior to entering into a contract;

c) processing is necessary for compliance with a legal obligation to which the
controller is subject;

d) processing is necessary to protect the vital interests of the data subject or of another

natural person;

e) processing is necessary for the performance of a task carried out in the
public interest or in the exercise of official authority vested in the
controller;

f) processing is necessary for the purposes of the legitimate interests pursued
by the controller or by a third party, except where such interests are overridden by the
interests or fundamental rights and freedoms of the data subject which require protection of personal
data, in particular where the data subject is a child. The provisions of letter f) of the first paragraph shall not apply to the processing carried out by public authorities in the exercise of their functions.

Moreover, Article 4 of the GDPR, Definitions, in its paragraphs 1, 2 and 11, states

that:

“1) “personal data” means any information relating to an identified or identifiable natural person
(“data subject”); an identifiable natural person is any person
whose identity can be determined, directly or indirectly, in particular by reference to
an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;

“2) “processing” means any operation or set of operations performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, communication by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction;

“11) “consent of the data subject” means any freely given, specific, informed and unequivocal indication of the data subject’s wishes by which he or she accepts, by a statement or by a clear affirmative action, the processing of personal data relating to him or her.”

In the present case, it has been proven that the respondent party violated Article 6.1
of the GDPR, since it processed the personal data of the complainant (NIF, address, universal delivery point code, email, mobile number, bank details) without any legal grounds to do so. The personal data

were incorporated by Curenergía into the information systems of Iberdrola
Clientes, without having proven that it had a legal basis for the collection and
subsequent processing of their personal data by Iberdrola Clientes, as
proven by the fact that the claimant's data were incorporated into the contract
sent by Iberdrola Clientes, S.A.U. to the claimant dated April 12, 2023,
where the following data appear:

<<ELECTRICITY SUPPLY CONTRACT CONTRACTING PARTIES

Supply company: IBERDROLA CLIENTES, S.A.U. Tax ID number: A95758389
Registered office: Plaza Euskadi 5, 48009 Bilbao Customer Service Telephone:
***TELEPHONE.3 / ***TELEPHONE.4 IBERDROLA CLIENTES, S.A.U. is authorized
by the General Directorate of Energy Policy and Mines of the Ministry of Energy,
Tourism and Digital Agenda for the activity of commercialization of electric energy and

natural gas. CLIENT Surname and First Name/Company Name: A.A.A. NIF: ***NIF.1 Date
of Birth: SUPPLY ADDRESS Supply address: ***ADDRESS.1
SPECIFIC CONDITIONS PRODUCTS AND SERVICES TO BE
CONTRACTED Stable Electricity Plan SUPPLY CONDITIONS Type of
contract: Normal Voltage: 1X230 V Access rate: BT 2.0 TD Mode 1 Power
Contracted: Peak: 100 W Valley: 700 W CUPS: ***CUPS.1 Distribution Company:

UFD Distribución de Electricidad, S.A. Attention Network Failures: XXXXXXXXX
ECONOMIC CONDITIONS ELECTRICITY PRICE Power Term

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 9/16

Peak: 34.504864 €/kW and year Power Term Valley: 6.377714 €/kW and year
Energy Term: 0.201984 €/kWh The cost will be added to the prices>>

Said contract was sent through the email address ***EMAIL.5, an address not
belonging to the respondent party and corresponding to a different entity that did
not participate in the contracting process with the complainant party, which shows the
improper treatment of the data.

Consequently, it has processed personal data without

proving that it has the legal authorization to do so.

In this regard, and this is essential, the respondent does not prove the legitimacy for the
transfer of the complainant's data to Iberdrola Clients.

The respondent states in response to the request of this Agency dated
October 9, 2023 that Curenergía and Iberdrola Clients have subcontracted the customer service to the
same entity.

Both operators can access the customer databases of both entities
simultaneously, but they have express instructions that when a call is received on a telephone of one of the entities,
not to access or provide information relating to the other.

The respondent claims that the facts subject to the claim were due to an error

by the salesperson, which was corrected after the affected party had informed them of what had
happened. However, this circumstance does not invalidate the fact that improper processing has occurred, nor does it remedy the lack of legitimacy in carrying out said processing.

In this regard, article 6.1 of the GDPR states that processing “will be lawful if it is
necessary for the execution of a contract to which the interested party is a party”.

Therefore, Curenergía has acknowledged the existence of an incorrect action in the
management of the data of the complainant, the consequence of which was that an entity
unrelated to the operation had access to the personal data of the complainant without
the latter's consent.

In view of the above, the respondent party fails to prove that it acted
diligently and therefore there was an unlawful processing of the personal data of the complainant, thereby contravening article 6 of the GDPR.

In this regard, Recital 40 of the GDPR states:

“(40) For processing to be lawful, personal data must be processed with the
consent of the data subject or on another legitimate basis established by law, whether in this Regulation, including the need to comply with the
legal obligation applicable to the controller or the need to execute a contract to which the data subject is a party or in order to take steps at the request

of the data subject prior to entering into a contract.”

For the above reasons, without prejudice to the outcome of the investigation of the procedure, it is clear that the personal data of the complainant has been unlawfully processed, consisting of the transfer of his/her data to an unauthorized entity, which

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 10/16

results in a breach of the principle of legality provided for in the aforementioned article 6.1
of the GDPR.

III
Classification and qualification of the infringement

The infringement is classified in article 83.5 of the GDPR, which considers as such:

“5. Infringements of the following provisions shall be punished, in accordance with

section 2, with administrative fines of up to EUR 20,000,000 or,
in the case of a company, an amount equivalent to a maximum of 4% of the
total global annual turnover of the previous financial year, whichever is higher:

The basic principles for processing, including the conditions for

consent pursuant to articles 5, 6, 7 and 9.”

For the purposes of the limitation period of the infringement, the LOPDGD classifies in its article 72.1
as a very serious infringement, in this case the limitation period being three years, “b)

The processing of personal data without any of the conditions for the lawfulness of the processing established in article 6 of Regulation (EU) 2016/679 being met.”

IV
Proposal for a penalty

In order to determine the administrative fine to be imposed, the provisions of

Articles 83.1 and 83.2 of the GDPR must be observed, which state:

“Each supervisory authority shall ensure that the imposition of administrative fines
under this Article for infringements of this Regulation referred to in paragraphs 4, 9 and 6 are effective, proportionate and dissuasive in each individual case.”

“Administrative fines shall be imposed, depending on the circumstances of

each individual case, as an additional or alternative measure to the measures provided for in
Article 58, paragraph 2, points (a) to (h) and (j). When deciding whether to impose an administrative fine and its amount in each individual case, due account shall be taken of:

a) the nature, seriousness and duration of the infringement, taking into account the
nature, scope or purpose of the processing operation in question,
as well as the number of data subjects affected and the level of
damage suffered by them;

b) the intentionality or negligence of the infringement;

c) any measures taken by the controller or processor to
mitigate the damage suffered by the data subjects;

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 11/16

d) the degree of responsibility of the controller or processor, taking into account any
technical or organisational measures they have implemented pursuant to Articles 25 and 32;

e) any previous infringement committed by the controller or processor;

(f) the degree of cooperation with the supervisory authority in order to remedy the breach and mitigate any adverse effects of the breach;

(g) the categories of personal data affected by the breach;

(h) the manner in which the supervisory authority became aware of the breach,
in particular whether the controller or processor notified the breach and, if so, to what extent;

(i) where measures referred to in Article 58(2) have previously been ordered against the controller or processor concerned
in relation to the same matter, compliance with those measures;

(j) adherence to codes of conduct pursuant to Article 40 or to certification mechanisms approved pursuant to Article 42; and

(k) any other aggravating or mitigating factors applicable to the circumstances of the

case, such as the financial benefits obtained or losses avoided, directly or indirectly, through the breach.”

Regarding section k) of article 83.2 of the GDPR, the LOPDGDD, article 76,
“Sanctions and corrective measures”, provides:

“2. In accordance with the provisions of article 83.2.k) of Regulation (EU) 2016/679,
the following may also be taken into account:

a) The continued nature of the infringement.

b) The connection between the offender's activity and the processing of personal data.

c) The benefits obtained as a result of committing the infringement.

d) The possibility that the affected party's conduct could have led to the commission of the infringement.

e) The existence of a merger process after the commission of the infringement, which cannot be attributed to the absorbing entity.

f) The impact on the rights of minors.

g) Having, when not mandatory, a data protection officer.

h) The submission by the controller or processor, on a voluntary basis, to alternative dispute resolution mechanisms, in those cases in which there are disputes between them and any interested party.”

In accordance with the provisions transcribed, and without prejudice to what results from the

instruction of the procedure, for the purposes of setting the amount of the fine to be
imposed on the respondent, as responsible for an infringement classified in article
83.5.a) of the GDPR, in an initial assessment, the following factors are considered to be concurrent:

- The seriousness of the infringement taking into account the scope of the processing operation, a circumstance provided for in article 83.2.a) GDPR.

A significant circumstance in the case examined is that it was an
electricity supply contract, to which the respondent would have linked the personal data of the
complainant. In this sense, the seriousness of the scope of the
operation is manifested in the transfer of the data to a third party who was not
authorized and to which the complainant had not given his

consent.

- “The link between the offender's activity and the processing of personal data”, a circumstance provided for in article 76.2.b) LOPDGDD in connection

with article 83.2.k) RGPD.

The business activity of the defendant necessarily processes personal data,

being one of the most important electricity companies in Spain. This characteristic
of its business activity has an impact, reinforcing it, on the diligence that it must

deploy in compliance with the principles that govern the processing of personal data and in the quality and effectiveness of the technical and organizational
measures that it must have implemented to guarantee respect for the fundamental right.

The National Court's ruling of 17/10/2007 (rec. 63/2006), in which,
with respect to entities whose activity involves the continuous processing of customer data,
indicates that "...the Supreme Court has understood that there is
imprudence whenever a legal duty of care is disregarded, that is, when the

offender does not behave with the required diligence. And in assessing the degree of
diligence, the professionalism or lack thereof of the subject must be especially considered, and
there is no doubt that, in the case now examined, when the activity of the appellant
is of constant and abundant handling of personal data, it is necessary to insist on
the rigor and the exquisite care to comply with the legal provisions in this regard."

The penalty to be imposed on the respondent must be graduated and set at the amount of €100,000

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 13/16

for the infringement of article 83.5 a) RGPD, classified as very serious for the purposes of
the prescription in article 72.1b) of the LOPDGDD.

Therefore, in accordance with the above, by the Director of the Spanish Data Protection Agency,

IT IS AGREED:

FIRST: TO INITIATE SANCTIONING PROCEDURE against CURENERGÍA
COMERCIALIZADOR DE ÚLTIMO RECURSO, S.A.U. with NIF A95554630, for the
alleged infringement of article 6.1) classified in article 83.5.a) of the aforementioned RGPD.

SECOND: APPOINT Mr. B.B.B. as instructor and Ms. C.C.C. as secretary,
indicating that either of them may be challenged, if applicable, in accordance with the

established in articles 23 and 24 of Law 40/2015, of October 1, on the Legal Regime of the Public Sector (LRJSP).

THIRD: INCORPORATE into the sanctioning file, for evidentiary purposes, the
claim filed by the claimant and its documentation, the documents obtained and generated by the General Subdirectorate of Data Inspection.

FOURTH: THAT for the purposes provided for in art. 64.2 b) of Law 39/2015, of 1 October, on the Common Administrative Procedure of Public Administrations, the
sanction that could be applied would be for the infringement of article 6.1 of the RGPD,
specified in article 83.5 a) of the RGPD, the sanction that would be applied would be a
fine for an amount of 100,000 euros (one hundred thousand euros) without prejudice to what results
from the investigation.

FIFTH: NOTIFY this agreement to CURENERGÍA COMERCIALIZADOR DE
ÚLTIMO RECURSO, S.A.U. with NIF A95554630, granting it a hearing period of
ten business days to formulate the allegations and present the evidence it
deems appropriate. In its written allegations, you must provide your NIF and the
procedure number that appears in the heading of this document.

If you do not make any objections to this initiation agreement within the stipulated period, it

may be considered a resolution proposal, as established in article
64.2.f) of Law 39/2015, of October 1, on the Common Administrative Procedure of
Public Administrations (hereinafter, LPACAP).

In accordance with the provisions of article 85 of the LPACAP, if the
sanction to be imposed is a fine, you may acknowledge your liability within the
period granted for the formulation of objections to this initiation agreement; which

will entail a 20% reduction for the sanction to be imposed
in this procedure, equivalent in this case to twenty thousand euros (€20,000).
With the application of this reduction, the amount of the sanction would be set at
eighty thousand euros (€80,000), and the procedure will be resolved with the imposition of this
sanction.

Likewise, at any time prior to the resolution of this procedure, the applicant may voluntarily pay the proposed fine, in accordance with the provisions of article 85.2 of the LPACAP, which will entail a reduction of 20% of the amount of the fine, equivalent in this case to twenty thousand euros (€20,000) for the alleged infringement. With the application of this reduction, the amount of the fine would be set at eighty thousand euros (€80,000) and its payment will imply the termination of the procedure, without prejudice to the imposition of the corresponding measures.

The reduction for voluntary payment of the fine may be added to the reduction that must be applied for the acknowledgment of liability, provided that this acknowledgment of liability is made clear within the period granted for submitting objections to the opening of the procedure. The voluntary payment of the amount referred to in the previous paragraph may be made at any time prior to the resolution. In this case, if both reductions were to be applied, the amount of the fine would be set at sixty thousand euros (€60,000).

In any case, the effectiveness of either of the two reductions mentioned will be subject to the withdrawal or waiver of any action or appeal in administrative proceedings against the fine.

If you choose to make a voluntary payment of any of the amounts indicated above, 80,000 euros or 60,000 euros, you must make the payment
by depositing it in account number ES00 0000 0000 0000 0000 0000 opened in the name of the Spanish Data Protection Agency at Banco CAIXABANK,

S.A., indicating in the concept the reference number of the procedure that appears in
the heading of this document and the reason for the reduction of the amount to which you are applying.

You must also send proof of payment to the Subdirectorate General of Inspection
in order to continue with the procedure in accordance with the amount paid.

The procedure will have a maximum duration of twelve months from the date
of the start agreement. After this period, it will expire and, consequently, the proceedings will be closed; in accordance with the provisions of
article 64 of the LOPDGDD.

Finally, it is noted that in accordance with the provisions of article 112.1 of the LPACAP,
there is no administrative appeal against this act.

Mar España Martí

Director of the Spanish Data Protection Agency

>>

SECOND: On September 18, 2024, the respondent party has proceeded to

pay the fine in the amount of 60,000 euros using the two
reductions provided for in the Initiation Agreement transcribed above, which implies the
recognition of liability.

THIRD: The payment made, within the period granted to formulate allegations at

the opening of the procedure, entails the waiver of any action or appeal through
administrative means against the fine and the recognition of liability in relation to
the facts referred to in the Initiation Agreement and its legal qualification.

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 15/16

LEGAL BASIS

I
Competence

In accordance with the powers granted to each supervisory authority by article 58.2 of Regulation (EU) 2016/679
(General Data Protection Regulation, hereinafter RGPD) and as established in articles 47, 48.1, 64.2 and 68.1 of Organic Law 3/2018, of December 5, on the Protection of Personal Data and

the Guarantee of Digital Rights (hereinafter LOPDGDD), the Director of the Spanish Data Protection Agency is competent to
initiate and resolve this procedure.

Likewise, article 63.2 of the LOPDGDD determines that: "The procedures

processed by the Spanish Data Protection Agency will be governed by the provisions
of Regulation (EU) 2016/679, in this organic law, by the regulatory
provisions issued in its development and, insofar as they do not contradict them,
on a subsidiary basis, by the general rules on administrative procedures."

II
Termination of the procedure

Article 85 of Law 39/2015, of October 1, on the Common Administrative

Procedure of Public Administrations (hereinafter, LPACAP), under the heading
"Termination of sanctioning procedures" provides the following:

"1. Once a sanctioning procedure has been initiated, if the offender acknowledges his responsibility,
the procedure may be resolved with the imposition of the appropriate sanction.

2. When the sanction is of a purely monetary nature or when it is possible to impose a
monetary sanction and another of a non-monetary nature but the
inappropriateness of the second has been justified, the voluntary payment by the presumed responsible party, at
any time prior to the resolution, will imply the termination of the procedure,

except in relation to the restoration of the altered situation or the determination of
compensation for the damages and losses caused by the commission of the infringement.

3. In both cases, when the sanction is of a purely monetary nature, the
body competent to resolve the procedure will apply reductions of at least
20% on the amount of the proposed sanction, these being cumulative with each other.

The aforementioned reductions must be determined in the notification of the initiation
of the procedure and their effectiveness will be conditional on the withdrawal or waiver of
any action or appeal in administrative proceedings against the sanction.

The percentage of reduction provided for in this section may be increased

by regulation.”

According to the above,
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 16/16

the Director of the Spanish Data Protection Agency RESOLVES:

FIRST: DECLARE the termination of procedure EXP202307313, in
accordance with the provisions of article 85 of the LPACAP.

SECOND: NOTIFY this resolution to CURENERGÍA
COMERCIALIZADOR DE ÚLTIMO RECURSO, S.A.U..

In accordance with the provisions of article 50 of the LOPDGDD, this

Resolution will be made public once it has been notified to the interested parties.

Against this resolution, which ends the administrative process as prescribed by
art. 114.1.c) of Law 39/2015, of October 1, on the Common Administrative Procedure of Public Administrations, interested parties may file an administrative appeal

before the Administrative Litigation Division of the National Court, in accordance with the provisions of article 25 and section 5 of the fourth additional provision of Law 29/1998, of July 13, regulating the Administrative Litigation Jurisdiction, within two months from the

day following the notification of this act, as provided for in article 46.1 of the aforementioned Law.

936-151024
Mar España Martí

Director of the Spanish Data Protection Agency

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es