Facile.Energy SRL – €100,000 Fine (Italy, 2024)

Between January 2022 and March 2023, the DPA received several complaints against an electricity company (Facile.Energy SRL). The data subjects complained that they had received unwanted telemarketing phone calls. According to them, the controller did not collect their consent before performing the phone call. Moreover, some of them further argued that they had previously signed up for the Italian Public Opt-out Registry (Registro Pubblico delle Opposizioni - RPO). The RPO is an Italian registry extended to all national phone numbers, which allows citizens to opt-out of unwanted telemarketing calls. Furthermore, they stressed the fact that the controller had, without their request, activated for them an energy supply contract at unfair prices. Therefore, they believe they suffered material and non-material damage as a consequence of the illegal processing of their data. The controller argued that its processing was lawful. More specifically, it pointed out that the data subjects had not been contacted by the controller itself, but by a “teleseller”, which had the role of finding the phone numbers of potential customers and contacting them on behalf of the controller. The controller explained that it had entered in a “teleselling contract” with the processor. This contract laid down an obligation for the processor to collect data subjects’ consent before contacting them. Moreover, it contained an indemnification clause, so that the controller would not have any liability as for the processor’s compliance with data protection law. The DPA criticised the conduct of the controller, arguing that the evidence collected showed a “worrying outline of non-compliance with the GDPR”. The DPA rejected the controller’s argument leaning on the “teleselling” contract. It was of the view that such an agreement cannot exempt a controller from respecting GDPR and prevent it from being liable if a violation occurs. The DPA’s reasoning is based on several articles of the GDPR. Firstly, as provided for by Article 24(1) GDPR, the controller must implement appropriate technical and organisational measures to ensure and to be able to demonstrate that the processing is performed in accordance with GDPR. Secondly, as for Article 28(1) GDPR, the controller must only choose processors that provides sufficient guarantees to comply with the GDPR and must then constantly supervise the processing activities of the processor. The DPA found this supervision to be purely formal, as it was only based on a contractual clause and no further checks were performed. Therefore, the DPA hold that the controller had violated Article 5(1)(f), 5(2), 24(1), 25(1), 28(1) and 32 GDPR. As a consequence, this lack of supervision resulted in the absence of any legal basis for the processing of these personal data. The DPA stressed the fact that more than 5000 contracts were concluded through this unlawful processing. Therefore, the DPA found a violation of Article 6(1)(a) in combination with Article 5(1)(a) GDPR. As for the RPO, the DPA observed that [https://www.normattiva.it/atto/caricaDettaglioAtto?atto.dataPubblicazioneGazzetta=2003-07-29&atto.codiceRedazionale=003G0218&atto.articolo.numero=130&atto.articolo.sottoArticolo=1&atto.articolo.sottoArticolo1=0&qId=&tabID=0.28576398859424823&title=lbl.dettaglioAtto Article 130(3-bis) of the Italian Data Protection Code] provides for an “opt-out” mechanism: when a data subject signs up for this registry, data controllers are not allowed anymore to contact them at their phone numbers for marketing purposes. In other words, this registration results in a revocation of the data subject’s consent towards all controllers which would wish to process their data for marketing purposes. Since 106 data subjects who had signed up for the RPO were however contacted, the DPA further hold the controller had violated [https://www.normattiva.it/atto/caricaDettaglioAtto?atto.dataPubblicazioneGazzetta=2003-07-29&atto.codiceRedazionale=003G0218&atto.articolo.numero=130&atto.articolo.sottoArticolo=1&atto.articolo.sottoArticolo1=0&qId=&tabID=0.28576398859424823&title=lbl.dettaglioAtto Article 130(3)] and [https://www.normattiva.it/atto/caricaDettaglioAtto?atto.dataPubblicazioneGazzetta=2003-07-29&atto.codiceRedazionale=003G0218&atto.articolo.numero=130&atto.articolo.sottoArticolo=1&atto.articolo.sottoArticolo1=0&qId=&tabID=0.28576398859424823&title=lbl.dettaglioAtto 130(3-bis)] of the Italian Data Protection Code and, more generally, Article 5(1)(a) and 6(1)(a) GDPR. As for the fine calculation, the DPA criticised the behaviour of the controller during the proceedings. It deemed the latter “heedless” of the procedural rules of the authority, as it asked for several deadlines extensions without then providing the DPA with meaningful pleadings. Moreover, the DPA considered the violation particularly serious under Article 83(2)(a) GDPR. On these grounds , the DPA issued a fine of €100,000.