Eni Plenitude S.p.A. Società Benefit – €6,419,631 Fine (Italy, 2024)

The DPA received 108 informal reports and 7 complaints about unsolicited phone calls by Eni Plenitude S.p.A. The data subjects complained that they had received phone calls by the controller, promoting its energy services. They argued that they either had never given their specific consent for telemarketing purposes or that they had signed up for the Italian national opt-out registry (Registro Pubblico delle Opposizioni – RPO). According to [https://www.normattiva.it/uri-res/N2Ls?urn:nir:stato:legge:2018-01-11;5~art1-com5 Article 1(5) of Law 5/2018], when a data subject signs up for the RPO, this has the effect of revoking the previous consent given for marketing purposes. However, consent is deemed valid if it was given in the context of a contract which is still in place and only if a simplified way to revoke the consent is provided. First of all, the controller pointed out that some calls had been made by employees of partner companies in violation of the internal instructions given by the controller. Additionally, the controller stated that certain phone numbers were acquired during a “co-marketing campaign”. The phone number was first collected by a third party, who contacted the data subject to promote other companies’ products. Then, if the data subject showed interest towards the controller’s products, this third party would have made another phone call to them. In the latter case, this entity would have acted as a processor. Other phone calls were made for “win back” purposes, contacting former clients to propose them a new energy supply contract. The controller relied on the fact that [https://www.normattiva.it/uri-res/N2Ls?urn:nir:stato:legge:2018-01-11;5~art1-com5 Article 1(5) of Law 5/2018] allows to contact former customers – without checking if their phone number is in the RPO – if their contract was ceased no earlier than 30 days. Moreover, the controller argued that some of the data subjects’ phone numbers were not in its list of contacted users. T