Acea Energia SPA – €3,000,000 Fine (Italy, 2025)

Energy provider Acea Energia S.p.a. (the controller) relied on a number of processors and sub-processors for marketing purposes. In particular, the controller relied on a one-person company called Stefanelli Federica (the processor), which in turn relied on sub-processor MG Company. The controller concluded a DPA with the processor. However, the processor did not conclude a DPA with the sub-processor. Additionally, the sub-processor was not registered as a marketing operator, in violation of Italian national law. The sub-processor engaged in a long list of illegal practices such as contacting prospects without their consent, lying to prospects about (non-existing) billing issues, and eluding telemarketing laws under the pretence that it engaged in door-to-door marketing rather than telemarketing. Over one and a half years, the sub-processor concluded about 30.000 contracts and earned the processor about €2,000,000 in provisions. In 2024 a popular TV show aired a report on the sub-processor’s marketing practices. The authors of the show also reported their findings to the Italian DPA. In turn, the DPA opened a joint investigation with the financial police. The controller claimed that it was unaware of the sub-controller's involvement in its telemarketing activities and blamed the processor for engaging with the sub-processor without the controller’s knowledge. The DPA rejected the argument. The controller was responsible for appointing a reliable processor, and for watching over the compliance of the data processing chain. The controller clearly failed to do so in the case at hand. The appointed processor was a one-person business with no registered employees and could not possibly have concluded tens of thousands of contracts on behalf of the controller. So, the DPA held that the controller knew or should have known that the marketing involved unauthorized personnel. For this reason, the DPA held the controller responsible for several GDPR violations, including violations committed by the sub-processor: * A large number of data subjects were contacted without their consent and without receiving any information on the processing of their data, in violation of Articles 5(1)(a), 6, and 7 GDPR as well as 130 d. lgs. 196/2003This is the Italian implementation of the e-Privacy Directive's rules on unsolicited marketing communications.; * The controller violated Articles 5(1)(f) and 32 GDPR, by allowing access to personal data from unauthorized staff (as MG Company was not appointed as a processor or sub-processor); * The controller failed to watch over the correct processing of personal data from its processor and sub-processor, in violation of Articles 24 and 25 GDPR; * Finally, the controller did not appoint the sub-processor as a processor or sub-processor, in violation of Article 28 GDPR. The DPA fined the controller €3,000,000 and ordered it to bring its marketing activities into compliance.