Spanish Solar Firm Fined €10,000 for Unsolicited Marketing Calls and GDPR Consent Failures
Written by AI from the linked story. Not reviewed by an editor. How this works
A Spanish solar energy company was fined €10,000 by the AEPD after making unsolicited marketing calls without being able to demonstrate valid consent from the data subject. The company also failed to provide the required GDPR Article 14 transparency information at the time data was collected, a fundamental obligation when personal data is obtained indirectly. This case highlights that consent must be documented, provable, and accompanied by clear privacy notices — not simply assumed or asserted. Regulatory fines like this are avoidable when organisations build proper consent management and data subject notification processes into their marketing workflows from the outset.
Tactical Insight
Immediate actions
- Audit all existing marketing contact lists to verify each record has documented, timestamped, and lawful consent.
- Implement a consent management platform (CMP) that captures and stores proof of consent alongside the privacy notice presented at collection.
Long-term improvements
- Embed GDPR Article 13/14 transparency notices into every data collection touchpoint, including third-party lead generation contracts.
- Establish a formal data governance policy that mandates consent verification before any outbound marketing campaign is launched.
- Train sales and marketing teams on lawful basis requirements, consent validity standards, and the consequences of non-compliance.
Detection & accountability measures
- Conduct quarterly internal audits of consent records and marketing lists to identify and purge records lacking valid consent documentation.
- Assign a designated Data Protection Officer (DPO) or compliance owner responsible for reviewing marketing practices against GDPR obligations before campaign execution.