Spanish Utility Fined €220K for Unlawful Data Processing and Marketing

GERSTERNOVA S.A. violated GDPR by processing customer personal data for direct marketing without valid legal basis or consent, resulting in a substantial fine from Spain's data protection authority. The company failed to obtain proper authorization before conducting marketing calls and sending contracts containing sensitive personal information including ID numbers and banking details. Additionally, they violated transparency requirements by not providing mandatory information disclosures during the marketing call and failed to ensure their data processor's compliance with privacy regulations.

Tactical Insight

Immediate actions

Conduct comprehensive audit of all current data processing activities and their legal bases
Suspend any direct marketing campaigns until valid consent or legal basis is established
Review and update all data processor agreements to ensure GDPR compliance requirements

Legal compliance measures

Implement consent management systems to properly capture and document customer permissions
Develop mandatory privacy disclosure scripts for all customer-facing communications
Establish regular compliance monitoring of third-party processors handling personal data

Long-term improvements

Train all marketing and customer service staff on GDPR requirements and lawful processing principles
Implement data minimization practices to limit collection to necessary information only
Create automated systems to track and manage consent status across all marketing channels