[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fgneOouOB9WntBrIuW7P-nlMwws6WFfP4dv5jnorGMV8":3},{"article":4,"iocs":45,"watch_terms":46,"solutions":47,"lesson":50},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":23,"category":24,"article_tags":28},"b39ad89b-7ac9-48de-b9e6-8d8ee3f3964c","AEPD (Spain) - PS\u002F00249\u002F2025","aepd-spain-ps-00249-2025-b4448e","Created page with \"{{DPAdecisionBOX |Jurisdiction=Spain |DPA-BG-Color= |DPAlogo=LogoES.jpg |DPA_Abbrevation=AEPD |DPA_With_Country=AEPD (Spain) |Case_Number_Name=PS\u002F00249\u002F2025 |ECLI= |Original_Source_Name_1=AEPD |Original_Source_Link_1=https:\u002F\u002Fwww.aepd.es\u002Fdocumento\u002Fps-00249-2025.pdf |Original_Source_Language_1=Spanish; Castilian |Original_Source_Language__Code_1=ES |Original_Source_Name_2= |Original_Source_Link_2= |Original_Source_Language_2= |Original_Source_Language__Code_2= |Type...\" Show changes","The Spanish Data Protection Agency (AEPD) has fined MÁS SOL ENERGÍA 15, S.L. €10,000 for making unsolicited marketing calls without valid consent and failing to provide required GDPR information. The company obtained data from external providers and could not prove the data subject had consented or that the data source was legitimate, despite claims of online form acceptance.","Spain's AEPD fines solar company €10,000 for unsolicited marketing calls.","https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=AEPD_(Spain)_-_PS\u002F00249\u002F2025&diff=52639&oldid=0","https:\u002F\u002Fgdprhub.eu\u002Fimages\u002F5\u002F59\u002FLogoES.jpg","2026-08-07T09:56:53+00:00","2026-08-07T10:00:10.296068+00:00",7,[17,20],{"name":18,"type":19},"AEPD","vendor",{"name":21,"type":22},"GDPR","product","c5c77cdb-f7d7-4990-9436-c81dcbff1163",{"id":23,"icon":25,"name":26,"slug":27},null,"Policy","policy",[29,33,38,40],{"category":30},{"id":31,"icon":25,"name":21,"slug":32},"3f0f8451-91df-4b6c-9a73-ef3b2509b7f1","gdpr",{"category":34},{"id":35,"icon":25,"name":36,"slug":37},"53f9c4b6-8bc6-4964-9169-d09e5cd41d72","Compliance","compliance",{"category":39},{"id":23,"icon":25,"name":26,"slug":27},{"category":41},{"id":42,"icon":25,"name":43,"slug":44},"d95477d7-eb04-4fad-a2dc-be1428040ce7","Privacy Fines","privacy-fines",[],[18,21],{"controls":48,"vendors":49},[],[],{"slug":51,"title":52,"body":53,"framework_refs":54,"framework_notes":66},"spanish-energy-firm-fined-10000-for-gdpr-consent-failures-in-third-party-marketing-data","Spanish Energy Firm Fined €10,000 for GDPR Consent Failures in Third-Party Marketing Data","MÁS SOL ENERGÍA 15, S.L. made unsolicited marketing calls using personal data obtained from external providers without being able to demonstrate valid consent or a legitimate data source, directly violating GDPR Articles 6 and 13. The core failure was a lack of due diligence on the provenance and consent chain of third-party data before using it for direct marketing. This case highlights that purchasing or acquiring data from external brokers does not transfer GDPR liability — the data controller remains fully responsible for proving lawful basis. Organisations must treat third-party data suppliers as a compliance risk vector, not just a business convenience. Regulators are increasingly scrutinising 'claimed consent' via online forms, requiring demonstrable, auditable proof.",[55,56,57,58,59,60,61,62,63,64,65],"GDPR Article 6 (Lawfulness of processing)","GDPR Article 7 (Conditions for consent)","GDPR Article 13 (Information to be provided where personal data are collected from the data subject)","GDPR Article 28 (Processor obligations and Data Processing Agreements)","GDPR Article 58 (Powers of supervisory authorities)","NIST SP 800-53 PT-1 (Privacy Policy and Procedures)","NIST SP 800-53 PT-5 (Privacy Notice)","CIS Control 3 (Data Protection)","ISO\u002FIEC 27701:2019 (Privacy Information Management)","ITIL Service Design – Supplier Management","ePrivacy Directive Article 13 (Unsolicited communications)",{}]