Illumia – €678,897 Fine (Italy, 2024)

Two complaints were advanced by two data subjects against the energy supply company Illumia, the controller. The first data subject claimed to have been contacted for telemarketing purposes on their telephone number, without a relevant legal basis and although he was listed in the “Opposition Register” (in Italian “Registro delle Opposizioni”), a register where consumers can express their preference not to be contacted for telemarketing purposes. The second data subject, who was already a client of the controller, claimed that she was called on her son´s contact number (the contact number put down for energy supplies exchanges) from an operator from the commercial office of the controller. During the conversation, this operator claimed that the controller was aware of the intention of the data subject to switch to another operator for energy and gas supplies. They also considered that the contract switch that the data subject requested would not be feasible and then the data subject would need to conclude a new contract with the controller. The DPA decided to start investigating on this matter and advanced two information requests, asking the controller to prove that its telemarketing activities complied with data protection rules. The controller replied that, before contacting data subjects, all agencies belonging to their commercial sphere were required to check the numbers that they are going to contact. The controller considered that neither the number of the operator from the commercial office nor the data subjects´ numbers were present in the controller´s registers. The controller also submitted that they already advanced a complaint against an unknown party to the Postal Police due to these circumstances. The DPA concluded its investigation and found the following violations. Violation of Articles 5, 6 and 7 of the GDPR The DPA started its analysis by stating that, in relation to the second complaint, it is clear that the operator was aware of some personal information that, used jointly, could have only came from the controller, without the data subject´s consent to being contacted. Thus, the DPA found a violation of Article 5, Article 6 and Article 7 GDPR. Violation of Articles 5(2), 24, and 28 of the GDPR The DPA continued its analysis by stating that the obligations of the controller as per Article 24 and Article 28 GDPR were not fully respected. More specifically, the fact that the controller fully outsourced its telemarketing activities is particularly problematic as this decision was not followed by any additional safeguard. When selecting the firms to outsource telemarketing activities, the “Disciplinare tecnico Acquisizione Agenzie” was the relevant policy. This policy completely disregarded any type of necessary privacy checklist, and merely considered size and economic reliability of these firms. A privacy check-list was only implemented on 1 January 2024 but only six out of the seventeen agencies were put under contract in 2024, meaning that the “older” agencies continue to process persona data without complying with Article 28 GDPR. The DPA continues its analysis by considering that, under the accountability principle, as laid out under Article 5(2) GDPR. According to the DPA, the principle of accountability gives the data controller a wide freedom of choice with respect to the implementation of its data protection governance to which is related a complex concept of accountability. The obligations to which the controller is subject under Article 28 GDPR cannot be deemed to be fulfilled through the imposition of an ex-post privacy check list. Thus, the DPA found a violation of Article 5(2), Article 24 and Article 28 GDPR. Violation of Articles 5, 25 and 32 of the GDPR The DPA further finds a violation of Article 5, Article 25 and Article 32 GDPR, as the principle of integrity, principle of data protection by design and default and the security of the processing were not respected. More specifically, the controller did not provide any element indicating that they are adopting measures to avoid the further conclusion of contract stemming from an illegal contact. The DPA considered that, as Illumia is able to retrace the contract to the operator that inserted the contract in the firm´s database, it should be able to implement measures that restrict the access to the contact information in the first place, and it failed to do so. Imposition of the fine Due to the amount of the occurred violations, the DPA found it appropriate to impose a fine of €678,897.