AEPD (Spain) - PS/00249/2025
Spain's AEPD fines solar company €10,000 for unsolicited marketing calls.
The Spanish Data Protection Agency (AEPD) has fined MÁS SOL ENERGÍA 15, S.L. €10,000 for making unsolicited marketing calls without valid consent and failing to provide required GDPR information. The company obtained data from external providers and could not prove the data subject had consented or that the data source was legitimate, despite claims of online form acceptance.
AI summary of the linked source. Not reviewed by an editor. How this works
Run AEPD?
Get an email when a new story names AEPD, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonMÁS SOL ENERGÍA 15, S.L. made unsolicited marketing calls using personal data obtained from external providers without being able to demonstrate valid consent or a legitimate data source, directly violating GDPR Articles 6 and 13. The core failure was a lack of due diligence on the provenance and consent chain of third-party data before using it for direct marketing. This case highlights that purchasing or acquiring data from external brokers does not transfer GDPR liability — the data controller remains fully responsible for proving lawful basis. Organisations must treat third-party data suppliers as a compliance risk vector, not just a business convenience. Regulators are increasingly scrutinising 'claimed consent' via online forms, requiring demonstrable, auditable proof.