ENDESA (energy supplyer)

The complainant's bank account was debited by ENDESA, whose beneficiary was a third party who had been convicted of criminal offences and had been granted a two-year injunction in respect of the applicant, her residence and her work. Instead, at the request of the plaintiff, ENDESA erroneously deleted her data and inserted the data of the third party. The AEPD found that the disclosure of the applicant's data to the third party constituted a serious breach of the principle of confidentiality. Authority: Spanish Data Protection Authority (aepd)