Eni Plenitude S.p.A. Società Benefit – €6,419,631 Fine (Italy, 2024)

The DPA received 108 informal reports and 7 complaints about unsolicited phone calls by Eni Plenitude S.p.A. The data subjects complained that they had received phone calls by the controller, promoting its energy services. They argued that they either had never given their specific consent for telemarketing purposes or that they had signed up for the Italian national opt-out registry (Registro Pubblico delle Opposizioni – RPO). According to [https://www.normattiva.it/uri-res/N2Ls?urn:nir:stato:legge:2018-01-11;5~art1-com5 Article 1(5) of Law 5/2018], when a data subject signs up for the RPO, this has the effect of revoking the previous consent given for marketing purposes. However, consent is deemed valid if it was given in the context of a contract which is still in place and only if a simplified way to revoke the consent is provided. First of all, the controller pointed out that some calls had been made by employees of partner companies in violation of the internal instructions given by the controller. Additionally, the controller stated that certain phone numbers were acquired during a “co-marketing campaign”. The phone number was first collected by a third party, who contacted the data subject to promote other companies’ products. Then, if the data subject showed interest towards the controller’s products, this third party would have made another phone call to them. In the latter case, this entity would have acted as a processor. Other phone calls were made for “win back” purposes, contacting former clients to propose them a new energy supply contract. The controller relied on the fact that [https://www.normattiva.it/uri-res/N2Ls?urn:nir:stato:legge:2018-01-11;5~art1-com5 Article 1(5) of Law 5/2018] allows to contact former customers – without checking if their phone number is in the RPO – if their contract was ceased no earlier than 30 days. Moreover, the controller argued that some of the data subjects’ phone numbers were not in its list of contacted users. The controller classified these phone calls as “third party suspicious phone calls”. It argued that these phone calls had been made by third parties which were not authorised by the controller and that illegally used the controller’s name to promote other companies’ products. Furthermore, the controller stated that it had been using two processors, which had the task of acquiring new phone numbers and making sure that their processing was relying on a legitimate legal basis (consent). Finally, as for the RPO, it argued that most of the data subjects were called as they had specifically consented to that processing as per [https://www.normattiva.it/uri-res/N2Ls?urn:nir:stato:legge:2018-01-11;5~art1-com5 Article 1(5) of Law 5/2018]. Firstly, the DPA pointed out that the controller contacted 746 data subjects who had signed up for the RPO. The DPA rejected the argument of the controller about the applicability of the exception contained in [https://www.normattiva.it/uri-res/N2Ls?urn:nir:stato:legge:2018-01-11;5~art1-com5 Article 1(5) of Law 5/2018]. It noted that the exception applies only if a simplified way of revocation was provided and found that this was not the case. Therefore, the DPA stated that the controller should have consulted the RPO before making the calls in order to make sure that the phone numbers were not in that register. As a consequence, the DPA held that the processing lacked of a lawful legal basis and found a violation of Article 5(1)(a) and 6 GDPR and [https://www.normattiva.it/atto/caricaDettaglioAtto?atto.dataPubblicazioneGazzetta=2003-07-29&atto.codiceRedazionale=003G0218&atto.articolo.numero=130&atto.articolo.sottoArticolo=1&atto.articolo.sottoArticolo1=0&qId=&tabID=0.9898227749003787&title=lbl.dettaglioAtto Article 130 of the Italian Data Protection Code]. Secondly, as for the “co-marketing” campaigns, the DPA believed that this processing was not compliant with the GDPR. The DPA noted that, also in this case, the controller did not consult the RPO before performing the call. It held that the original consent cannot be used for further purposes and therefore found a violation of Article 5(1)(a) and 6 GDPR and [https://www.normattiva.it/atto/caricaDettaglioAtto?atto.dataPubblicazioneGazzetta=2003-07-29&atto.codiceRedazionale=003G0218&atto.articolo.numero=130&atto.articolo.sottoArticolo=1&atto.articolo.sottoArticolo1=0&qId=&tabID=0.9898227749003787&title=lbl.dettaglioAtto Article 130 of the Italian Data Protection Code]. Thirdly, as for the “win back” campaign, the DPA noted that, generally speaking, this processing activity could be legitimate. However, it needs to be performed in a limited period of time after the data subject quits the contract. On the contrary, in some cases the data subject was contacted even 4 years after the termination of the contract. Moreover, the DPA noted that the controller implemented insufficient technical and organisational measures to ensure that the whole processing activities were compliant with GDPR. According to the DPA, the controller should have implemented a structure to effectively monitor how processors were operating. On the contrary, the DPA found “major shortcomings” regarding the processors oversight, as the controller performed only formal checks and conducted audits only after an incident occurred. Therefore, the DPA found a violation of Article 5(1)(f), 5(2), 24, 25 and 28 GDPR. On these grounds, the DPA issued a fine of €6,419,631.