Sanction procedure opened for not responding to the request for information made in order to investigate the facts identified in a complaint. The complainant requested the exclusion of his data from a debts file -Asnef - by an alleged debt to the energy supply company -Iberdrola-.
The complaint was transferred to Iberdrola and it was required to forward to the AEPD the information and documents requested in the letter. After receiving no response, the complaint was accepted.
Investigations were then carried out and the entity was again required to report on the facts denounced. This new request was also not answered. In a nutshell, Iberdrola had not provided the information required and consequently hindered the investigative powers that each supervisory authority has, infringing Article 58.1 of the GDPR.
This infringement is typified in Article 83.5(e) of the GDPR and is classified for prescription purposes as very serious. It has also been taken into account that Iberdrola is a large undertaking, not newly created and therefore should have established procedures for the fulfilment of the obligations under the data protection regulations, including provide any information required by the supervisory authority. For this reason, it was sanctioned with 5,000 euros, reduced to 4,000 euros as it benefited from voluntary payment reduction according to the Spanish Procedure Law.
To read the full decision in Spanish, click here
For further information, please contact the Spanish DPA: prensa@aepd.es