Energia Pulita S.r.l. – €300,000 Fine (Italy, 2025)

The Italian data protection authority received many complaints of aggressive telemarketing practices carried out on behalf of energy company Energia Pulita S.r.l. (the data controller). Some of the complainants reported deceitful marketing practices. Others were called despite their number’s inclusion in Italy’s Do Not Call registry. In November 2023 the authority started a broad investigation on the controller. Additionally, the authority required information about all of the purchase offers from February 5 to February 12 2024. Privacy compliance and quality controls The authority inquired about the measures taken by the data controller to ensure privacy compliance both in its own marketing activities, and in the marketing activities of its subcontractors (acting as data processors or sub-processors). The controller implemented some technical and organizational measures to implement data protection principles, including quality check calls and checks for the recipient’s consent to marketing. Starting March 2024, the controller implemented a more robust privacy compliance program: for instance, the controller provided its employees with privacy training and adopted more robust privacy standards for its contractors. The authority found these measures to be insufficient. The authority held that the data controller failed to vigilate over the privacy practices of its subcontractors. Additionally, the controller failed to choose subcontractors with robust privacy practices. In this regard, the authority pointed out that it still received complaints about aggressive marketing on behalf of the controller after March 2024. The authority also observed that controllers must adopt appropriate technical and organisational measures to ensure the implementation of data protection principles from the very beginning of the data processing (data protection by default). Consent and the Do Not Call registry The data controller pointed out that some of the recipients (the data subjects) consented to the processing of their data for marketing purposes after their inclusion in the Do Not Call Registry. These consents were collected via four third-party websites where users provided their personal data in order to receive commercial offers. In the controller’s view, the data subjects’ consents authorized its marketing calls. The authority found issues with the consents. Three websites (nuoveofferte.com, offertenergetiche.it, and ricercaofferte.it) prompted users to consent to marketing for a very broad range of products and services. After consent collection, personal data were shared with an undefined number of companies for marketing purposes, each acting as the data controller. Additionally, users could not choose the form of the marketing communications they would receive. A fourth website (Offerte-gas-luce.it) lacked a privacy notice altogether. For these reasons, the authority held that the websites did not collect granular and free consent. In this regard, the authority referred to its own guidance on telemarketingSee [https://www.garanteprivacy.it/home/docweb/-/docweb-display/docweb/2543820 Garante per la protezione dei dati personali (Italy) - 2543820]. The data controller also defended its practices by pointing out that energy contracts were not concluded over the phone: the phone calls only served to initiate contact and to direct prospective customers to the controller's website. For this reason, the controller argued that the calls were not a form of telemarketing and did not fall under the Italian rules relating to the Do Not Call registry. The authority rejected the controller’s argument. In the authority’s view, calls that merely initiate contract with the customer, are nonetheless telemarketing. In this regard, the authority referred to the Code of Conduct on telemarketing and telesellingThe Code of Conduct is a non-binding code available on [https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9993890 the GPDP's website].. Job candidates and privacy notices The authority inquired on the provision of information to the controller’s job applicants. Individuals could apply for a job with the controller by providing personal data on its website. Initially, the controller would provide applicants with a privacy notice before the job interview. The data controller provided no notice at a collection and provided no information at all to applicants who did not show up for the job interview. The data controller eventually improved its practices. Starting July 2024, the data controller started providing applicants with a notice at collection. The authority held that the data controller violated its transparency obligations until July 2024. Additionally, the authority held that the controller did not correctly identify the legal bases for processing applicant’s data in the earlier version of its privacy notice. Overall, the authority held that the controller violated Articles 5, 6, 9, 12, 13, 24, 25, 28, 29, and 32 GDPR as well as Articles 111-bis and 130 d. lgs. 196/2003D. lgs. 196/2003 is Italy's so-called "Privacy Code". Article 111-bis provides for specific rules for processing the CVs of job applicants while Article 130 regulates unsolicited marketing communications.. The authority fined the controller €300,000. The authority also ordered the controller to implement better data protection measures through the marketing value chain and to document its follow-up. Finally, the authority ordered the controller to inform 68 complainants of the outcome of the procedure.