Energia Verde S.p.a. – €100,000 Fine (Italy, 2025)

The DPA received many complaints about aggressive marketing on behalf of energy provider Energia Verde S.p.a. (the controller). Data subjects repeatedly reported similar issues: * They received unwanted calls with no legal basis; * They received calls despite having signed up for the Do Not Call registry; * The controller did not honor their request. In its responses, the controller claimed that it was unable to grant requests because it relied on third party providers for marketing and could only forward the requests to those providers. The DPA opened a broad investigation against the controller. The investigation also covered the collection of consent to direct marketing via a consent form on the controller’s website, as well as the marketing activities carried out via several processors and sub-processors. During the investigation, the DPA required detaiedl information about all telemarketing contracts concluded during one specific week (“sample week”), including proof of consent to the initial marketing communication. The DPA found that about 6% of the contracts concluded during the sample week, related to numbers that were unlawfully called despite their inclusion in the Do Not Call registry. The DPA held that the controller * Processed personal data without a legal basis and without being able to document data subjects’ consent, in violation of Articles 5, 6, 7, and 25 GDPR as well as Article 130 d. lgs. 196/2003; * Engaged several processors and sub-processors without vigilating on their compliance and without concluding a data processing agreement, in violation of Articles 5, 24 and 28 GDPR; * Failed to respond to data subject’s inquiries and to honor their requests, in violations of Articles 12 and 15-22 GDPR; * Violated Article 157 d. lgs. 193/2003 by providing a late and incomplete response to the DPA’s inquiries in the context of the investigation. With regards to the consent forms on the controller’s website, the DPA observed that data subjects were prompted to give a single consent covering a number of different purposes (such as marketing, profiling, the processing of purchases, and so on). On this basis, the DPA held that the controller failed to collect specific and granular consent. The DPA fined the controller €100,000 and ordered it to bring its direct marketing operations into compliance.