Enel Energia S.p.a. – €563,052 Fine (Italy, 2026)

The controller for the case is Enel Energia S.p.a., Italy’s largest energy provider. Several customers (the data subjects) filed complaints over the controller’s marketing practices. Some of the data subjects complained about unwanted marketing calls from third parties (the processors) on behalf of the data controller. Other data subjects received “customer care” calls from the controller, during which the controller also put forward marketing proposals for different contracts. All data subjects had denied their consent to the use of their data for marketing purposes. The DPA addressed all the complaints with a single investigation. The investigation revolved around three distinct issues: * the marketing propositions during “customer care”-type of calls; * the unwanted calls from the processors; * the controller’s reliance on processors for its marketing activities. Overall, the DPA concluded that the controller violated Articles 5, 6, 7, 24 and 28 GDPR as well as [https://www.garanteprivacy.it/documents/10160/0/Codice+in+materia+di+protezione+dei+dati+personali+%2528Testo+coordinato%2529.pdf/b1787d6b-6bce-07da-a38f-3742e3888c1d?version=14.0 Article 130 of the national GDPR implementation law]. On these grounds, the DPA issued a €563,052 fine. = The DPA first clarified that customer care calls are not considered a form of direct marketing. Generally, such calls are lawful under Article 6(1)(b) GDPR and can therefore take place without the data subject’s consent. However, the DPA also noted that such calls should not become an excuse to carry out non-consensual marketing. In the DPA's view, a controller may only provide marketing information during a customer care call if the recipient had previously consented to direct marketing, or if the recipient themselves requested the information. On these grounds, the DPA held that the controller processed personal data unlawfully for the purpose of marketing its services. = The investigation found that the controller used an SMS-based opt-out system for documenting consent to its so-called “call-back process”. Data subjects (customers and prospective customers alike) could enter their contact details in a form on the controller’s website and request a call with an operator. Afterwards, the controller would automatically forward an SMS to the data subject. The SMS informed the data subject that their number had been provided to the controller and prompted them to opt out of the call-back (via a link) if they had not provided the number themselves. If the data subject did not use the link, the controller would consider the data subject's consent to be valid and flag their number as usable for marketing purposes. In the controller’s view, this system was sufficient to properly document consent. The DPA, however, noted that the time limit for opting out was very short (sometimes as short as 90 seconds). The DPA also noted that it is generally inadvisable to open links found in SMSs and that many data subjects would likely dismiss the controller's message as spam or as a fraud attempt. In the DPA's view, this opt-out system could be abused for data laundering whereas a double opt-in system could prevent such a risk. On these grounds, the DPA held that the opt-out system implemented by the controller, could not document the consent of data subjects. So, the DPA concluded that the controller processed the data subjects’ numbers without a legal basis. = Finally, the DPA investigated the relationships between the controller and the third-party callers and found that the third parties were acting as processors. The DPA also found that the controller had failed to monitor the processors’ operations and that it had been careless in choosing some of its processors. In particular, the DPA observed that it had sanctioned one of the processors in the past. While engaging with this processor was in and of itself lawful, the controller had done so without auditing it and without ensuring that it had remedied its past violations. On these grounds, the DPA held that the controller violated Articles 4, 5, and 28 GDPR.