Hera Comm S.p.A. – €5,000,000 Fine (Italy, 2024)

The DPA received several complaints from data subjects concerning a major Italian energy provider. They argued that they received some documents from the controller concerning the activation of an energy supply contract even if they had never had any contact with the controller or expressed their willingness to enter in such a contract. Furthermore, some data subjects complained that they exercised their Chapter III GDPR rights but obtained no answer from the controller. Therefore, the DPA opened an investigation, which showed that the controller outsourced their door-to-door advertising activities to several companies, that had been appointed as processors. When a data subject accepted to enter into the energy supply contract, the contract was hand signed by the data subject and a copy of their ID card was acquired by the processor. The investigation further showed that some employees of the processors forged the signatures of data subjects. The controller implemented some practices to monitor the processors’ compliance with its internal regulation. More specifically, after the processor uploaded the contract in the appropriate online platform the controller called the data subject’s number to ask if they had the real intention of entering in the contract (“check call”). Moreover, the controller also sent a “welcome letter” to the address provided in the contract. However, if the data subject did not answer the phone, only in very few cases the consequence was that the contract was then discarded. Moreover, as for data retention, the controller pointed out that data are kept for 10 years and that it does not have any other further policy since it would be too expensive and complex to implement it. Finally, concerning the choice of the processors, the controller said that it had not conducted any audit on how they operate. On the processors First, the DPA noted that the processing at hand had been carried out by some processors. The DPA found that these processing activities had been carried out in violation of the instructions given by the controller. These activities implied, for example, activating energy supply contracts to unaware data subjects. On this point, the DPA pointed out that, even though the controller did not operate this processing on its own, it is still accountable for the violations under Article 5(2) GDPR. Moreover, the DPA noted that the controller did not implement appropriate measures to ensure its processors were complying with the GDPR. The DPA found that these measures were inefficient and inadequate. This inadequateness allowed some employees of the processor to operate in violation of the GDPR. More specifically, the DPA focused on the fact that the internal instructions did not specify how personal data was to be collected in a door-to-door situation, allowing processors to collect it also on paper and to take a picture of the data subject’s ID card. According to the DPA, this led to the usage of the ID card to activate further contracts without the data subjects’ consent. In addition, the DPA found the “check call” and “welcome letter” measures not sufficient. The DPA noted that, in most cases, none of these measures actually prevented the contract from being further executed (e.g. activating the energy supply, sending invoices to the data subject). As for the check call, the controller would need to call the data subject and, if they don’t pick up the call, immediately stop the further implementation of the contract. As for the welcome letter, the DPA noted that it is sent to the address collected by the processor. The DPA found this measure useless: if the processor counterfeits the contract and puts a fake address, the letter will be sent to that address and the data subject will actually never know about the contract (and be able to express their objection). Therefore, the DPA found a violation of Article 5(1)(a), 5(1)(d), 5(1)(f), 5(2), 24 and 32 GDPR. Furthermore, the DPA noted that the controller, pursuant to Article 28(1) GDPR, was under an obligation to choose only processors providing sufficient guarantees to implement measures in order to comply with the GDPR. The DPA pointed out that this is a permanent obligation that imposes to carry out recurrent audits on the processor. Since the controller did not do so, the DPA found a violation of Article 28(1) GDPR. On the access requests Finally, the DPA held that the controller violated Article 15 GDPR in combination with Article 12(3) GDPR since it had replied late to data subjects’ access requests. On these grounds, the DPA issued a fine of €5,000,000.