AEPD (Spain) - PS/00197/2020
| AEPD - PS/00197/2020 | |
|---|---|
 | |
| Authority: | AEPD (Spain) |
| Jurisdiction: | Spain |
| Relevant Law: | Article 5(1)(b) GDPR Article 5(1)(c) GDPR Article 6(1)(f) GDPR Article 6(1)(b) GDPR Article 58(2) GDPR Article 3(2) Royal Decree 1435/2002 Article 3(3) Royal Decree 1435/2002 Article 4(4) Royal Decree 1164/2001 Article 47 LOPDGDD |
| Type: | Complaint |
| Outcome: | Upheld |
| Started: | |
| Decided: | 12.02.2021 |
| Published: | 01.03.2021 |
| Fine: | 200000 EUR |
| Parties: | Energia y Servicios Aby 2018 SL I-DE, Redes Eléctricas Inteligentes SAU Watium SL |
| National Case Number/Name: | PS/00197/2020 |
| European Case Law Identifier: | n/a |
| Appeal: | n/a |
| Original Language(s): | Spanish |
| Original Source: | AEPD (in ES) |
| Initial Contributor: | n/a |
The Spanish DPA (AEPD) imposed a fine of €200,000 on the energy supplier, I-DE, Redes Eléctricas Inteligentes SAU. I-DE had sent a letter to end consumers requiring them to get in touch with regards to unpaid invoices despite a contractual arrangement providing for an intermediary to communicate with end users (breach of Articles 6(1)(b), 5(1)(b) and 5(1)(c) GDPR).
English Summary
Facts
Energia y Servicios Aby 2018 SL (ESA 2018) and Watium SL filed a complaint against I-DE, Redes Eléctricas Inteligentes SAU (I-DE, previously Iberdrola Distribución Eléctrica) before the Spanish DPA (AEPD).
Watium is an electric power trading company which is subscribed with the energy distribution company I-DE by way of a network access contract (ATR). This contract is refers to Articles 3(2) and 3(3) of the Royal Decree 1435/2002. The contract included the identification and contact of the end consumer, the logo of Iberdrola Distribución Eléctrica (now i-DE) and the identification of Watium. Although signed by the two entities, there is no place for the end consumer's signature in the contract.
In the letters sent by Iberdrola/I-DE to Watium end consumers in 2018, Iberdrola/I-DE stated that the were forced to send Watium (according to the law) a request for payment for unpaid invoices. They requires that the end consumer get in contact with their provider company.
Watium informed these facts to the Spanish Competition Authority (Comisión Nacional de los Mercados y la Competencia - CNMC) and the Spanish DPA (AEPD) in January 2018.
At the time, the AEPD issued a report stating that it could be concluded that processing of personal data carried out by I-DE violated data protection law (legal basis and data protection principles). The report highlighted that the appropriate legal basis would have been contractual necessity (Article 6(1)(c)) but the processing of personal data of the consumer (who acts by way of an intermediary) is not necessary for the fulfillment of that contract as the intermediary is precisely there to deal with the communication with these types of communications. The AEPD at the time added that I-DE violated the principles of purpose limitation and data minimisation (Article 5(1)(b) and (c)).
In January 2020, Energia y Servicios Aby 2018 SL (ESA 2018), another electric power trading company subscribed to I-DE complained to the AEPD about identical letters of non-payment sent directly to end consumers.
The CNMC outlined that it could not be concluded that I-DE had not acted anti-competitively in breach of Competition Law.
Dispute
Did sending a letter to require an end consumer of an energy distributor to get in touch with regards to a unpaid invoice when an intermediary was set up communicate with the end user breach Articles 6(1)(b), 5(1)(b) and 5(1)(c) GDPR?
Holding
The Spanish DPA (AEPD) deemed itself competent under Article 58(2) GDPR in conjunction with Article 47 of the Spanish Data Protection Law (LOPDGDD) despite the Competition Law aspect of the case.
The DPA went on to outline that the contract between the two complainants and I-DE were network access contracts (ATR) which refer to Articles 3(2) and 3(3) of the Royal Decree 1435/2002 (which regulates the conditions for contract for the acquisition of energy and access to low voltage network). The DPA analysed the wording of the contract against Article 3(2) Royal Decree 1435/2002 and outlined that this provision refers to data protection law in relation to processing of personal data. The DPA specified that the principle of purpose limitation (Article 5(1)(b) GDPR) was relevant. In this ATR contract, reference to Article 3(2) of the Royal Decree established that the purpose for transferring personal data to I-DE would be exclusively so it provides the end consumer with electricity. Therefore, the letters of non-payment that I-DE sent to end consumers directly breached the contract terms and were incompatible with the purpose stated in Article 3(2) of the Royal Decree. Similarly, the principle of data minimisation (Article 5(1)(c) GDPR) was infringed as a result.
In relation to the reference to Article 3(3) of the Royal Decree, the Spanish DPA outlined that this meant that if the distributor (I-DE) wishes to address the end consumer, it should only do so through the "marketer" acting as an intermediary (i.e. Watium or ESA 2018). Therefore, the distributor should not directly communicate with the end consumer since there is an intermediary for this.
The DPA conceded that Article 4(4) of the Royal Decree 1164/2001 provides that the distributor can suspend the electricity supply as a result of non-payment and can contact the end user with the sole aim of requiring payment. Therefore, communication between the distributor and the end consumer is limited. However, the Spanish DPA held that in this context, I-DE sent an informational letter, to request them to get in touch to comply with the contractual obligations. Therefore it cannot be said that I-DE's action fell within the permission granted under with Article 4(4) of the Royal Decree 1164/2001.
The DPA went on to address the intervention of the Spanish Competition Authority. It clarified that the Competition Authority notified the Spanish DPA that it did not consider I-DE's actions to be anti-competitive in breach of competition law. It also accepted the fact that the Competition Authority had been aware that I-DE sent letters. However, it was not information received from I-DE directly.
In relation to the legal basis for processing data, the Spanish DPA clarified that I-DE claimed to rely on Article 6(1)(f) GDPR. However, the DPA held that I-DE provided no reasoning nor evidence of balancing the interests at stake. There was therefore nearly no justifications for relying on Article 6(1)(f) in ID-E's submissions. The DPA outlined that I-DE would have had to demonstrate, after a balancing of factors, that there was a legitimate interest pursued by the distributor or marketer that outweigh the end consumer's rights and freedoms. According to the DPA, the nature of the letter by I-DE appeared almost like a threat or pressure to contact the distributor. Therefore, it did not count as a legitimate interest that outweighed the rights and freedoms of the end consumer even if the ultimate end interest for the distributor was getting the payment owed. The DPA concluded that the distributor would have a right to recover the money owed, but this should not be confused with an illegal processing of personal data.
As such, the Spanish DPA imposed a fine of € 200000 on I-DE for the violation of Article 6(1)(b), Articles 5(1)(b) and Article 5(1)(c) GDPR.
Comment
This decision is interesting given the ongoing discussion on cooperation between national data protection authorities and national competition authorities. It is clear that the two legal fields are increasingly interacting with one another.
It is interesting that there was interactions between the Spanish DPA and Spanish Competition Authority in the assessment of facts.
Additionally, the DPA investigated the wording of the legislation on network access contracts in light of data protection law.
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Spanish original. Please refer to the Spanish original for more details.
