E.ON Energia – €892,738 Fine (Italy, 2024)

After two different data subjects advanced two different complaints against the energy provider E.ON Energia, the controller, the DPA decided to merge the two complaints. The first complaint concerned a marketing call to the data subject, during which she found out that the controller was aware of her birth data, as well as contact data, including her work email. During the marketing call, the operator told the data subject that such contact information had been provided by the data subject herself through an advertising campaign on Facebook. However, the data subject does not even have a Facebook account. The data subject advanced an access request with the controller. The DPA thus contacted the controller to access information relating to the data processing of the first data subject’s data. The controller simply replied that it was likely that the data was collected from a “third party”. In relation to the lack of reply to the data subject, the controller stated that that was a simple human mistake. {{DPAdecisionBOX |Jurisdiction=Italy |DPA-BG-Color=background-color:#095d7e; |DPAlogo=LogoIT.png |DPA_Abbrevation=Garante per la protezione dei dati personali |DPA_With_Country=Garante per la protezione dei dati personali (Italy) |Case_Number_Name=10097012 |ECLI= |Original_Source_Name_1=Garante |Original_Source_Link_1=https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/10097012 |Original_Source_Language_1=Italian |Original_Source_Language__Code_1=IT |Original_Source_Name_2= |Original_Source_Link_2= |Original_Source_Language_2= |Original_Source_Language__Code_2= |Type=Complaint |Outcome=Upheld |Date_Started= |Date_Decided=27.11.2024 |Date_Published= |Year=2024 |Fine=892.738,00 |Currency=EUR |GDPR_Article_1=Article 5 GDPR |GDPR_Article_Link_1=Article 5 GDPR |GDPR_Article_2=Article 6 GDPR |GDPR_Article_Link_2=Article 6 GDPR |GDPR_Article_3=Article 7 GDPR |GDPR_Article_Link_3=Article 7 GDPR |GDPR_Article_4=Article 12 GDPR |GDPR_Article_Link_4=Ar