[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f6fwdv8OrEfwFLD2IDEyPezqKv5bBGjNadMQGyEU111c":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":23,"status":24,"created_at":25,"published_at":26,"article":27,"tags":31,"podcasts":50,"controls":51},"c88b5d16-98b3-4089-b78a-42febe027c44","spanish-energy-firm-fined-10000-for-gdpr-consent-failures-in-third-party-marketing-data","b39ad89b-7ac9-48de-b9e6-8d8ee3f3964c","Spanish Energy Firm Fined €10,000 for GDPR Consent Failures in Third-Party Marketing Data","MÁS SOL ENERGÍA 15, S.L. made unsolicited marketing calls using personal data obtained from external providers without being able to demonstrate valid consent or a legitimate data source, directly violating GDPR Articles 6 and 13. The core failure was a lack of due diligence on the provenance and consent chain of third-party data before using it for direct marketing. This case highlights that purchasing or acquiring data from external brokers does not transfer GDPR liability — the data controller remains fully responsible for proving lawful basis. Organisations must treat third-party data suppliers as a compliance risk vector, not just a business convenience. Regulators are increasingly scrutinising 'claimed consent' via online forms, requiring demonstrable, auditable proof.","**Immediate actions:**\n- Audit all existing third-party data sources to verify documented, auditable consent records before conducting any further marketing communications.\n- Suspend outbound marketing campaigns using externally acquired data until lawful basis and consent provenance can be formally verified.\n\n**Supply chain & vendor controls:**\n- Require data suppliers to provide contractual guarantees, consent audit trails, and data processing agreements (DPAs) compliant with GDPR Article 28 before onboarding.\n- Conduct periodic due diligence reviews of all third-party data providers, including sampling consent records for authenticity and recency.\n\n**Long-term compliance improvements:**\n- Implement a consent management platform (CMP) that captures, timestamps, and stores granular proof of consent for every data subject used in marketing activities.\n- Train marketing and procurement teams on GDPR lawful basis requirements, specifically the difference between claimed and demonstrable consent under Article 7.\n- Establish a Data Protection Impact Assessment (DPIA) process triggered whenever new external data sources are onboarded for direct marketing use.",[12,13,14,15,16,17,18,19,20,21,22],"GDPR Article 6 (Lawfulness of processing)","GDPR Article 7 (Conditions for consent)","GDPR Article 13 (Information to be provided where personal data are collected from the data subject)","GDPR Article 28 (Processor obligations and Data Processing Agreements)","GDPR Article 58 (Powers of supervisory authorities)","NIST SP 800-53 PT-1 (Privacy Policy and Procedures)","NIST SP 800-53 PT-5 (Privacy Notice)","CIS Control 3 (Data Protection)","ISO\u002FIEC 27701:2019 (Privacy Information Management)","ITIL Service Design – Supplier Management","ePrivacy Directive Article 13 (Unsolicited communications)",{},"published","2026-08-07T10:20:35.944704+00:00","2026-08-07T10:20:35.631+00:00",{"id":7,"url":28,"slug":29,"title":30},"https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=AEPD_(Spain)_-_PS\u002F00249\u002F2025&diff=52639&oldid=0","aepd-spain-ps-00249-2025-b4448e","AEPD (Spain) - PS\u002F00249\u002F2025",[32,38,44],{"id":33,"name":34,"slug":35,"description":36,"color":37},"c0dcc566-3654-4d70-8ede-262a198e732f","Regulatory Compliance","regulatory-compliance","GDPR, NIS2, DORA, sector-specific violations","#ec4899",{"id":39,"name":40,"slug":41,"description":42,"color":43},"c8b843a5-d5a7-41d1-8d3b-cabded09d2ef","Data Protection","data-protection","Unencrypted data, missing DLP, poor classification","#3b82f6",{"id":45,"name":46,"slug":47,"description":48,"color":49},"f0c2a0af-58aa-4128-87c9-6acd30f2dc48","Supply Chain","supply-chain","Third-party risk, compromised dependencies","#8b5cf6",[],[]]