[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fw65BSFh1W9jbLV_ntca_hiCSPl2MSjgHcFm089ARieQ":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":21,"status":22,"created_at":23,"published_at":24,"article":25,"tags":29,"podcasts":48,"controls":49},"e81db5a4-3e83-41ae-b402-a1cecaf835d8","spanish-solar-firm-fined-10000-for-unsolicited-marketing-calls-and-gdpr-consent-failures","ae4c7884-7d20-485b-a7bc-ca7bd57bbf97","Spanish Solar Firm Fined €10,000 for Unsolicited Marketing Calls and GDPR Consent Failures","A Spanish solar energy company was fined €10,000 by the AEPD after making unsolicited marketing calls without being able to demonstrate valid consent from the data subject. The company also failed to provide the required GDPR Article 14 transparency information at the time data was collected, a fundamental obligation when personal data is obtained indirectly. This case highlights that consent must be documented, provable, and accompanied by clear privacy notices — not simply assumed or asserted. Regulatory fines like this are avoidable when organisations build proper consent management and data subject notification processes into their marketing workflows from the outset.","**Immediate actions:**\n- Audit all existing marketing contact lists to verify each record has documented, timestamped, and lawful consent.\n- Implement a consent management platform (CMP) that captures and stores proof of consent alongside the privacy notice presented at collection.\n\n**Long-term improvements:**\n- Embed GDPR Article 13\u002F14 transparency notices into every data collection touchpoint, including third-party lead generation contracts.\n- Establish a formal data governance policy that mandates consent verification before any outbound marketing campaign is launched.\n- Train sales and marketing teams on lawful basis requirements, consent validity standards, and the consequences of non-compliance.\n\n**Detection & accountability measures:**\n- Conduct quarterly internal audits of consent records and marketing lists to identify and purge records lacking valid consent documentation.\n- Assign a designated Data Protection Officer (DPO) or compliance owner responsible for reviewing marketing practices against GDPR obligations before campaign execution.",[12,13,14,15,16,17,18,19,20],"GDPR Article 6(1)(a) — Lawfulness of processing (consent)","GDPR Article 7 — Conditions for consent","GDPR Article 14 — Information to be provided where personal data have not been obtained from the data subject","GDPR Article 83(5) — Administrative fines","NIST SP 800-53 PT-2 (Authority to Process Personally Identifiable Information)","NIST SP 800-53 PT-5 (Privacy Notice)","CIS Control 3 — Data Protection","ISO\u002FIEC 27701:2019 — Privacy Information Management (PIMS)","ITIL — Service Design: Information Security and Data Management Policies",{},"published","2026-08-07T12:20:52.477087+00:00","2026-08-07T12:20:52.204+00:00",{"id":7,"url":26,"slug":27,"title":28},"https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=AEPD_(Spain)_-_PS\u002F00249\u002F2025&diff=52640&oldid=52639","aepd-spain-ps-00249-2025-d521e1","AEPD (Spain) - PS\u002F00249\u002F2025",[30,36,42],{"id":31,"name":32,"slug":33,"description":34,"color":35},"7261eb8f-acd4-4d93-a489-7fdd652ec0ea","Security Awareness","security-awareness","Phishing, social engineering, human error","#22c55e",{"id":37,"name":38,"slug":39,"description":40,"color":41},"c0dcc566-3654-4d70-8ede-262a198e732f","Regulatory Compliance","regulatory-compliance","GDPR, NIS2, DORA, sector-specific violations","#ec4899",{"id":43,"name":44,"slug":45,"description":46,"color":47},"c8b843a5-d5a7-41d1-8d3b-cabded09d2ef","Data Protection","data-protection","Unencrypted data, missing DLP, poor classification","#3b82f6",[],[50],{"slug":51,"name":52,"problem":53},"compliance-automation","Compliance automation (GRC)","Evidence for NIS2, DORA and ISO 27001 is collected continuously, not in a rush before the audit."]