[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fEwDnaJm8vkiz8yWe3KkL1GPItt-sBZ1-FuuKg_nL_es":3},{"article":4,"iocs":41,"watch_terms":42,"solutions":43,"lesson":63},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":20,"category":21,"article_tags":25},"ae4c7884-7d20-485b-a7bc-ca7bd57bbf97","AEPD (Spain) - PS\u002F00249\u002F2025","aepd-spain-ps-00249-2025-d521e1","← Older revision Revision as of 10:18, 7 August 2026 Line 104: Line 104: }} }} The DPA fined a solar energy company €10,000 for making an unsolicited marketing call without proving valid consent and for failing to provide [[Article 14 GDPR|Article 14 GDPR]] information. The DPA fined a solar energy company €10,000 for making an unsolicited marketing call without proving valid consent and for failing to provide [[Article 14 GDPR]] information. == English Summary == == English Summary == Line 118: Line 118: As evidence, the controller provided a record containing the data subject’s details, an IP address, a timestamp and consent indicators, as well as a generic version of the relevant online form. However, the form was blank and did not contain any information specifically identifying the data subject. The controller also acknowledged that it did not independently verify the validity of the consent provided by its external supplier. As evidence, the controller provided a record containing the data subject’s details, an IP address, a timestamp and consent indicators, as well as a generic version of the relevant online form. However, the form was blank and did not contain any information specifically identifying the data subject. The controller also acknowledged that it did not independently verify the validity of the consent provided by its external supplier. === Holding === === Holding === The DPA held that the controller violated Article 66(1)(b) LGTel and [[Article 14 GDPR|Article 14 GDPR]]. The DPA held that the controller violated [https:\u002F\u002Fwww.boe.es\u002Fbuscar\u002Fact.php?id=BOE-A-2022-10757 Article 66(1)(b) LGTel] and [[Article 14 GDPR]]. First, regarding the commercial call, the DPA considered that the controller had not demonstrated that the data subject had given valid consent within the meaning of [[Article 4 GDPR|Article 4(11) GDPR]]. The documentation provided did not establish that the data subject personally completed the registration, entered the telephone number or could be linked to the IP address contained in the record. Moreover, the controller did not provide the privacy policy applicable when the alleged consent was obtained, meaning that it could not establish the purposes or third parties covered by that consent. First, regarding the commercial call, the DPA considered that the controller had not demonstrated that the data subject had given valid consent within the meaning of [[Article 4 GDPR|Article 4(11) GDPR]]. The documentation provided did not establish that the data subject personally completed the registration, entered the telephone number or could be linked to the IP address contained in the record. Moreover, the controller did not provide the privacy policy applicable when the alleged consent was obtained, meaning that it could not establish the purposes or third parties covered by that consent. The DPA recalled that, pursuant to Articles 5(2) and 7 GDPR, it is for the controller to demonstrate that valid consent was obtained. This responsibility could not be transferred to the external data provider through contractual guarantees. The controller remained responsible for establishing a valid legal basis for using the purchased data for its own marketing campaign. The DPA recalled that, pursuant to [[Article 5 GDPR|Articles 5(2)]] and [[Article 7 GDPR|7 GDPR]], it is for the controller to demonstrate that valid consent was obtained. This responsibility could not be transferred to the external data provider through contractual guarantees. The controller remained responsible for establishing a valid legal basis for using the purchased data for its own marketing campaign. This was particularly relevant because the data subject's telephone number was registered with the Robinson List. In the absence of sufficiently demonstrated specific consent allowing the controller to contact the data subject notwithstanding that registration, the controller could not rely on the exception under Article 23(4) LOPDGDD. Consequently, the DPA found that the unsolicited call lacked a valid legal basis and violated Article 66(1)(b) LGTel. This was particularly relevant because the data subject's telephone number was registered with the Robinson List. In the absence of sufficiently demonstrated specific consent allowing the controller to contact the data subject notwithstanding that registration, the controller could not rely on the exception under [https:\u002F\u002Fwww.boe.es\u002Fbuscar\u002Fact.php?id=BOE-A-2018-16673 Article 23(4) LOPDGDD]. Consequently, the DPA found that the unsolicited call lacked a valid legal basis and violated [https:\u002F\u002Fwww.boe.es\u002Fbuscar\u002Fact.php?id=BOE-A-2022-10757 Article 66(1)(b) LGTel]. Second, the DPA found a violation of [[Article 14 GDPR|Article 14 GDPR]]. Since the controller had obtained the personal data from a third party, it was required to provide the information listed in [[Article 14 GDPR|Article 14 GDPR]]. During the call, the agent merely referred to an unspecified “database” and did not adequately inform the data subject about the source of the data, the controller's identity, the legal basis for the processing or his data protection rights. The duration or termination of the call did not relieve the controller of this obligation, and the controller had not demonstrated that the required information was provided through another channel. Second, the DPA found a violation of [[Article 14 GDPR]]. Since the controller had obtained the personal data from a third party, it was required to provide the information listed in [[Article 14 GDPR]]. During the call, the agent merely referred to an unspecified “database” and did not adequately inform the data subject about the source of the data, the controller's identity, the legal basis for the processing or his data protection rights. The duration or termination of the call did not relieve the controller of this obligation, and the controller had not demonstrated that the required information was provided through another channel. The DPA imposed a fine of €5,000 for the violation of Article 66(1)(b) LGTel and a further €5,000 for the violation of [[Article 14 GDPR|Article 14 GDPR]], resulting in a total fine of €10,000. The DPA imposed a fine of €5,000 for the violation of [https:\u002F\u002Fwww.boe.es\u002Fbuscar\u002Fact.php?id=BOE-A-2022-10757 Article 66(1)(b) LGTel] and a further €5,000 for the violation of [[Article 14 GDPR]], resulting in a total fine of €10,000. == Comment == == Comment ==","Spain's data protection authority (AEPD) has fined a solar energy company €10,000 for making unsolicited marketing calls without valid consent and failing to provide GDPR Article 14 information. The company could not prove the data subject had given consent, nor did it provide the applicable privacy policy at the time of consent.","Spain's AEPD fines solar company €10,000 for unsolicited marketing calls.","https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=AEPD_(Spain)_-_PS\u002F00249\u002F2025&diff=52640&oldid=52639","https:\u002F\u002Fgdprhub.eu\u002Fimages\u002F5\u002F59\u002FLogoES.jpg","2026-08-07T10:18:31+00:00","2026-08-07T12:00:06.437453+00:00",7,[17],{"name":18,"type":19},"AEPD","vendor","c5c77cdb-f7d7-4990-9436-c81dcbff1163",{"id":20,"icon":22,"name":23,"slug":24},null,"Policy","policy",[26,31,36],{"category":27},{"id":28,"icon":22,"name":29,"slug":30},"3f0f8451-91df-4b6c-9a73-ef3b2509b7f1","GDPR","gdpr",{"category":32},{"id":33,"icon":22,"name":34,"slug":35},"53f9c4b6-8bc6-4964-9169-d09e5cd41d72","Compliance","compliance",{"category":37},{"id":38,"icon":22,"name":39,"slug":40},"d95477d7-eb04-4fad-a2dc-be1428040ce7","Privacy Fines","privacy-fines",[],[18],{"controls":44,"vendors":62},[45],{"slug":46,"name":47,"problem":48,"products":49},"compliance-automation","Compliance automation (GRC)","Evidence for NIS2, DORA and ISO 27001 is collected continuously, not in a rush before the audit.",[50,56],{"vendor_slug":51,"vendor_name":52,"vendor_logo":53,"product_slug":51,"product_name":52,"url":54,"description":55},"vanta","Vanta","\u002Fvendor-logos\u002Fvanta.png","https:\u002F\u002Fwww.vanta.com\u002F","Automated evidence collection and continuous monitoring for ISO 27001, SOC 2, NIS2 and other frameworks.",{"vendor_slug":57,"vendor_name":58,"vendor_logo":59,"product_slug":57,"product_name":58,"url":60,"description":61},"drata","Drata","\u002Fvendor-logos\u002Fdrata.png","https:\u002F\u002Fdrata.com\u002F","Continuous control monitoring and audit readiness across security frameworks.",[],{"slug":64,"title":65,"body":66,"framework_refs":67,"framework_notes":77},"spanish-solar-firm-fined-10000-for-unsolicited-marketing-calls-and-gdpr-consent-failures","Spanish Solar Firm Fined €10,000 for Unsolicited Marketing Calls and GDPR Consent Failures","A Spanish solar energy company was fined €10,000 by the AEPD after making unsolicited marketing calls without being able to demonstrate valid consent from the data subject. The company also failed to provide the required GDPR Article 14 transparency information at the time data was collected, a fundamental obligation when personal data is obtained indirectly. This case highlights that consent must be documented, provable, and accompanied by clear privacy notices — not simply assumed or asserted. Regulatory fines like this are avoidable when organisations build proper consent management and data subject notification processes into their marketing workflows from the outset.",[68,69,70,71,72,73,74,75,76],"GDPR Article 6(1)(a) — Lawfulness of processing (consent)","GDPR Article 7 — Conditions for consent","GDPR Article 14 — Information to be provided where personal data have not been obtained from the data subject","GDPR Article 83(5) — Administrative fines","NIST SP 800-53 PT-2 (Authority to Process Personally Identifiable Information)","NIST SP 800-53 PT-5 (Privacy Notice)","CIS Control 3 — Data Protection","ISO\u002FIEC 27701:2019 — Privacy Information Management (PIMS)","ITIL — Service Design: Information Security and Data Management Policies",{}]