Spain's Data Protection Agency Closes Octopus Energy Identity Theft Case After Remediation Steps

Key Takeaways

• The AEPD examined a claim that Octopus Energy España allowed a fraudulent online contract in a victim's name, followed by an erroneous delinquency listing of EUR $246.
• The document provided is a truncated resolution to close proceedings.
• It shows the regulator weighing identity verification controls, risk analysis, and data accuracy.
• It also shows the weight a controller's prompt remediation carries.

Deep Dive

Note on scope: the text is cut off mid-sentence in the controller's second response, at the identity verification discussion (page 10 of 17). The AEPD's final reasoning and the formal basis for closure are therefore not visible. The title "AI-00313-2025" and the 2026 date also do not match the file number (EXP202500496) and the 2025 events described, so the date should be verified. Any conclusions below are limited to the facts presented.

The case arose from a claim filed on 9 December 2024. A third party allegedly used the claimant's identity data to sign electricity and gas contracts through Octopus's website on 12 June 2024. The IP address was reportedly traced to Lima, Peru, and the email address differed from the claimant's. The prior supplier's cancellation followed on 17 June 2024. Octopus continued service and billing for more than four months, issuing six invoices between July and November 2024. It terminated the contracts only after the claimant's withdrawal request in October 2024. On 3 August 2025, Octopus also reported a EUR $246 debt to the Badexcug file through Experian. Octopus later attributed this to human error, specifically a mis-assigned internal identifier for a debt it had already agreed to cancel. Experian certified deletion on 23 September 2025.

The AEPD's inquiries focused on several GDPR issues. These were the lawful basis (Article 6.1.b, relied on until fraud was known), data minimization, the adequacy of risk analysis and technical measures, and accuracy (Article 5.1.d). Octopus rated the onboarding risk as "low" in its records of processing activities. It relied on a digital signature and email delivery as sufficient identity assurance. It then deployed fraud detection tools in October or November 2024, and the two dates conflict within its own submissions. Octopus reported blocking more than 20,000 fraudulent registrations since then. It also described alerts for repeated attempts from the same device, monitoring of access from unusual locations outside Spain, staff communications, a 2025 training plan, and a review of validation procedures before any report to delinquency files.

Recommended actions for compliance teams: - Reassess risk ratings for remote onboarding. A "low" rating for identity-based fraud is hard to defend where impersonation is a known sector problem (slamming). - Verify that identity assurance goes beyond self-declared data, for example through geolocation or IP anomaly checks, device fingerprinting, and document or bank-account verification. - Establish a pre-listing validation step for credit bureau reporting. It should include reconciling cancelled or disputed debts and checking for identity theft claims before any submission. - Maintain incident response processes that quickly stop billing and processing once a fraud allegation arises. - Keep documented evidence of remediation and training, as it appears to have been central to the outcome. - Ensure internal records are consistent, including the dates of control implementation.

Risk implications: exposure includes GDPR fines for inadequate security and accuracy failures, civil claims from affected individuals, and reputational harm from wrongful credit listings. The closure suggests that prompt correction and strengthened controls can mitigate enforcement outcomes. It should not be read as an endorsement of the pre-incident controls, because the final reasoning is not in the excerpt.

Source: Spanish Data Protection Agency (Agencia Española de Protección de Datos)