Background information
Date of final decision: 17 August 2021
Cross-border case or national case: National case
Controller: Vattenfall Europe Sales GmbH
Legal Reference: Transparency (Article 13, 13)
Decision: Fine
Summary of the Decision
Origin of the case
Vattenfall Europe Sales GmbH (Vattenfall) offers electricity supply contracts with a new customer bonus. In order to find out whether new contractors had already been Vattenfall customers in the past, the company carried out comparisons with customer data from previous years, which had been stored according to tax and commercial law. This check was intended to prevent customers from concluding such bonus contracts so regularly that this offer to attract new customers was no longer profitable for the company.
Key Findings
After examining the process, the Hamburg Commissioner for Data Protection and Freedom of Information came to the conclusion that Vattenfall violated the transparency obligations under data protection law (Article 12, 13 GDPR) through this procedure, as the customers were not sufficiently informed about the data comparison. A total of around 500,000 people were affected.
Decision
The Hamburg DPA subsequently imposed a fine of EUR 901,388.84 on Vattenfall. The established illegality does not refer to the data processing per se, but is limited to the insufficiently fulfilled transparency obligations. Vattenfall Europe Sales GmbH has accepted the fine.
The fine imposed does not affect the further question of whether such a comparison is permissible at all. This is not explicitly regulated in the GDPR; there are no clear legal requirements in this respect. Vattenfall has cooperated fully with the Hamburg Commissioner in the proceedings and stopped the non-transparent data comparison immediately after the DPA’s first action. The company has agreed a procedure with the DPA on how to inform first time and existing customers in a transparent and comprehensive manner about the data comparison and its purpose. Consumers will be able to make an informed decision as to whether they want to conclude a discounted bonus contract that includes the internal verification of their status as a new customer or a non-discounted contract without such a comparison.
For further information, please contact the Hamburg DPA: presse@datenschutz.hamburg.de
The original press release is available in German here: https://datenschutz-hamburg.de/pressemitteilungen/2021/09/2021-09-25-vattenfall2
The news published here does not constitute official EDPB communication, nor an EDPB endorsement. This news item was originally published by the national supervisory authority and was published here at the request of the SA for information purposes. Any questions regarding this news item should be directed to the supervisory authority concerned