Enel Energia Spa – €26,513,877 Fine (Italy, 2021)

Enel Energia is one of Italy's most important energy providers. Following hundreds of reports and complaints from users who complained about receiving unwanted promotional phone calls by Enel Energia including, including pre-recorded calls, the Italian DPA (GPDP) opened an investigation. The GPDP received complaints from citizens regarding a persistent and disturbing sense of interference in their sphere of privacy due to these practices, which are often accompanied by behavior that complainants perceived as not only invasive, but also particularly aggressive. The GPDP ascertained the following violations by Enel Energia: Violation of Article 31 GDPR, for failing to provide any response to the request sent by the GPDP to the Company on 17 December 2019. The company only replied to the GPDP until it was requested to do so a third time. It did not provide, in a collaborative and proactive manner, analytical and detailed answers on the different cases reported, so as to facilitate any appropriate assessment by the Authority. Violation of Article 5(2) GDPR and Article 25(1) GDPR, for not having taken effective action against undue promotional contacts made in its name by exercising its duties of accountability and privacy by design (through elements of prevention, functionality, security, transparency of treatment and centrality of the person concerned). Violation of Article 5(2) GDPR, for failing to provide evidence of compliance with data protection legislation in the case of unsolicited promotional communications by a business partner. Violation of Article 5(2) and Article 24 GDPR, for failing to control the activities of its business partners, including through appropriate technical and organisational measures. Violation of Article 5(1)(d) GDPR, for having mistakenly associated the number from which a call had been made to the company's free phone number with the claimant's personal data (presumably a landline used once only once by the claimant). Violation of Article 5(1)(d) and Article 6 GDPR, for having sent, via invoices, personal data to a user other than the holder of the contract following the association of the tax code of the claimant with another company user, because of the alleged similarity between the two codes. Violation of Article 12 GDPR, by failing to provide the necessary and timely feedback to the data subjects on the legitimate requests to exercise their rights (in this case, the right of access and the right to object). Violation of Article 5(1)(a) and Article 12(2) GDPR for providing a contradictory response to a further request for the exercise of rights made by the data subject in relation to the receipt of promotional calls via a pre-recorded message. Violation of Article 21 GDPR and Article 130(1) and (2) [https://www.garanteprivacy.it/codice Italian Privacy Act (Codice Privacy)], for having unduly sent promotional communications by e-mail, despite the refusal expressed by the data subject, both when signing the energy supply contract with respect to the data processing for marketing purposes, and through the subsequent opposition to the processing expressly addressed to the dedicated e-mail box. Violation of Article 130(4) Italian Privacy Act for having sent a communication concerning registration in the company's loyalty programme without the claimant's consent or an applicable exception under this provision, or GPDP decision [https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/2542348 2542348 of 4 July 2013]. Violation of Article 31 GDPR, for having offered insufficient cooperation to the supervisory authority, having failed to provide any information on how to issue consents for marketing and profiling purposes in the context of the use of digital services, despite two requests from the GPDP and specific indications from the data subject on the matter. Violation of Article 5(1)(a), Article 12 and Article 13 GDPR, for having presented to the users of the website two pieces of information which differ from each other regarding the identification of the data controller. The user, in fact, who intends to create a Unique Profile, is first redirected to a page where he is informed, by means of a brief communication, of the fact that Enel Energia and Enel Italia S.p.a. will manage their data as "autonomous data controllers". Subsequently, in a second statement, only mentions Enel Energia as the independent data controller. The GPDP held that this could generate confusion, and does not reflect the essential principle of transparency of information aimed at enabling the data subject to make an informed expression of consent. Violation of Article 12 and Article 13 GDPR, for providing the data subjects deficient information regarding third parties to whom the data are to be disclosed, both within the context of the Enel Group as well as an unspecified group of commercial partners. Violation of Article 6(1) GDPR, as well as Article 130 (1) and (2) Italian Privacy Act, for not having acquired a specific and appropriate consent from the data subjects with regard to processing carried out by different subjects in their capacity as independent data controllers. For these reasons, the Italian DPA imposed multiple corrective measures and a fine of € 26,513,977 to Enel Energia according to its faculties under Article 58(2)(a), Article 58(2)(b) and Article 58(2)(d), as well as Article 83(5) GDPR,