Spanish Energy Firm Fined €10,000 for GDPR Consent Failures in Third-Party Marketing Data

MÁS SOL ENERGÍA 15, S.L. made unsolicited marketing calls using personal data obtained from external providers without being able to demonstrate valid consent or a legitimate data source, directly violating GDPR Articles 6 and 13. The core failure was a lack of due diligence on the provenance and consent chain of third-party data before using it for direct marketing. This case highlights that purchasing or acquiring data from external brokers does not transfer GDPR liability — the data controller remains fully responsible for proving lawful basis. Organisations must treat third-party data suppliers as a compliance risk vector, not just a business convenience. Regulators are increasingly scrutinising 'claimed consent' via online forms, requiring demonstrable, auditable proof.

Tactical Insight

Immediate actions

Audit all existing third-party data sources to verify documented, auditable consent records before conducting any further marketing communications.
Suspend outbound marketing campaigns using externally acquired data until lawful basis and consent provenance can be formally verified.

Supply chain & vendor controls

Require data suppliers to provide contractual guarantees, consent audit trails, and data processing agreements (DPAs) compliant with GDPR Article 28 before onboarding.
Conduct periodic due diligence reviews of all third-party data providers, including sampling consent records for authenticity and recency.

Long-term compliance improvements

Implement a consent management platform (CMP) that captures, timestamps, and stores granular proof of consent for every data subject used in marketing activities.
Train marketing and procurement teams on GDPR lawful basis requirements, specifically the difference between claimed and demonstrable consent under Article 7.
Establish a Data Protection Impact Assessment (DPIA) process triggered whenever new external data sources are onboarded for direct marketing use.