E.ON Energia – €892,738 Fine (Italy, 2024)

After two different data subjects advanced two different complaints against the energy provider E.ON Energia, the controller, the DPA decided to merge the two complaints. The first complaint concerned a marketing call to the data subject, during which she found out that the controller was aware of her birth data, as well as contact data, including her work email. During the marketing call, the operator told the data subject that such contact information had been provided by the data subject herself through an advertising campaign on Facebook. However, the data subject does not even have a Facebook account. The data subject advanced an access request with the controller. The DPA thus contacted the controller to access information relating to the data processing of the first data subject’s data. The controller simply replied that it was likely that the data was collected from a “third party”. In relation to the lack of reply to the data subject, the controller stated that that was a simple human mistake. {{DPAdecisionBOX |Jurisdiction=Italy |DPA-BG-Color=background-color:#095d7e; |DPAlogo=LogoIT.png |DPA_Abbrevation=Garante per la protezione dei dati personali |DPA_With_Country=Garante per la protezione dei dati personali (Italy) |Case_Number_Name=10097012 |ECLI= |Original_Source_Name_1=Garante |Original_Source_Link_1=https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/10097012 |Original_Source_Language_1=Italian |Original_Source_Language__Code_1=IT |Original_Source_Name_2= |Original_Source_Link_2= |Original_Source_Language_2= |Original_Source_Language__Code_2= |Type=Complaint |Outcome=Upheld |Date_Started= |Date_Decided=27.11.2024 |Date_Published= |Year=2024 |Fine=892.738,00 |Currency=EUR |GDPR_Article_1=Article 5 GDPR |GDPR_Article_Link_1=Article 5 GDPR |GDPR_Article_2=Article 6 GDPR |GDPR_Article_Link_2=Article 6 GDPR |GDPR_Article_3=Article 7 GDPR |GDPR_Article_Link_3=Article 7 GDPR |GDPR_Article_4=Article 12 GDPR |GDPR_Article_Link_4=Article 12 GDPR |GDPR_Article_5=Article 15 GDPR |GDPR_Article_Link_5=Article 15 GDPR |GDPR_Article_6=Article 22 GDPR |GDPR_Article_Link_6=Article 22 GDPR |GDPR_Article_7=Article 24 GDPR |GDPR_Article_Link_7=Article 24 GDPR |GDPR_Article_8= |GDPR_Article_Link_8= |GDPR_Article_9= |GDPR_Article_Link_9= |EU_Law_Name_1= |EU_Law_Link_1= |EU_Law_Name_2= |EU_Law_Link_2= |National_Law_Name_1= |National_Law_Link_1= |National_Law_Name_2= |National_Law_Link_2= |Party_Name_1=E.ON Energia |Party_Link_1=https://www.eon-energia.com/ |Party_Name_2= |Party_Link_2= |Party_Name_3= |Party_Link_3= |Appeal_To_Body= |Appeal_To_Case_Number_Name= |Appeal_To_Status=Unknown |Appeal_To_Link= |Initial_Contributor=elu | }} The second complaint concerned a data subject that was already a client of the controller. At some point, the data subject started receiving undesired marketing calls from multiple companies. After the data subject advanced an access request, the controller stated that, once again due to a mere human mistake, the forms with data subjects’ consent were mixed up and written down erroneously. However, even after this reply, the data subject kept receiving advertisement calls from the controller and reiterated the request of stopping these calls to the controller. However, the controller never replied to these messages. The data subject then complained about this situation to the DPA. After the DPA contacted the controller, the controller replied that, once again only due to a human error, when transcribing the data of the data subject, an employee switched the consent by accident. With regards to the their marketing policy, the controller declared that the company to which the marketing is outsourced uses a database filtered regularly. The DPA found that the information and explanation given by the controller were insufficient. Violation of Articles 5, 6, 7 and 24 GDPR The DPA found a violation of Articles 5, 6, 7, and 24 GDPR as the controller engaged in telemarketing activities in violation of the lawfulness and accountability principle, as not only there was no legal basis for the processing, but also for a lack of technical and organisational measures that could not ensure that the processing of personal data happens in compliance with the GDPR. In fact, in relation to the telemarketing campaigns, personal data processing collected through an online form cannot be deemed to be legitimate without the presence of measures that ensure the verification of the data subjects’ source of identity. Thus, the collection through an online form without verification is deemed not enough to ensure the data is from the data subject. The fact that so many “human mistakes” have happened in relation to the telemarketing activities of the controller is indicative of the fact that the processing chain is not effectively operated. More specifically, the controller probably failed to assign roles and responsibilities, especially with regards to cases concerning the ordinary handling of client services. The omission of measures adapt to ensure that the selected partners of the controller possess the sufficient warranties to enact technical and organizational measures to comply with the GDPR. Violation of Articles 12, 15-22 GDPR The DPA further finds a violation of Articles 12, 15-22 GDPR as the controller cannot rely on the claim of a mere human mistake in relation to its failure to reply to the access request advanced by the data subjects. Fine Therefore, the DPA deemed it appropriate to fine the controller €89.273.777,20 for the violation of Articles 5, 6, 7, 12, 15 and 22 GDPR.