Acea Energia SPA – €3,000,000 Fine (Italy, 2025)

Energy provider Acea Energia S.p.a. (the controller) relied on a number of processors and sub-processors for marketing purposes. In particular, the controller relied on a one-person company called Stefanelli Federica (the processor), which in turn relied on sub-processor MG Company. The controller concluded a DPA with the processor. However, the processor did not conclude a DPA with the sub-processor. Additionally, the sub-processor was not registered as a marketing operator, in violation of Italian national law. The sub-processor engaged in a long list of illegal practices such as contacting prospects without their consent, lying to prospects about (non-existing) billing issues, and eluding telemarketing laws under the pretence that it engaged in door-to-door marketing rather than telemarketing. Over one and a half years, the sub-processor concluded about 30.000 contracts and earned the processor about €2,000,000 in provisions. In 2024 a popular TV show aired a report on the sub-processor’s marketing practices. The authors of the show also reported their findings to the Italian DPA. In turn, the DPA opened a joint investigation with the financial police. The controller claimed that it was unaware of the sub-controller's involvement in its telemarketing activities and blamed the processor for engaging with the sub-processor without the controller’s knowledge. The DPA rejected the argument. The controller was responsible for appointing a reliable processor, and for watching over the compliance of the data processing chain. The controller clearly failed to do so in the case at hand. The appointed processor was a one-person business with no registered employees and could not possibly have concluded tens of thousands of contracts on behalf of the controller. So, the DPA held that the controller knew or should have known that the marketing involved unauthorized personnel. For this reason, the DPA held the controller responsible for several GDPR violations, including vi