Enel Energia – Court Ruling (Italy, 2023)
Italy's data protection authority investigated Enel Energia after receiving complaints about unwanted phone calls. The company failed to respond to multiple requests for information, which matters because it shows that companies need to take complaints seriously and respond promptly. This case serves as a reminder for businesses to manage customer communications properly.
What happened
Enel Energia did not respond to several requests from the data protection authority regarding complaints about unwanted promotional calls.
Who was affected
Customers who received unwanted promotional phone calls from Enel Energia.
What the authority found
The court noted that the data protection authority had followed proper procedures in its investigation, but the case is still ongoing.
Why this matters
This case highlights the need for companies to handle customer complaints effectively and respond to regulatory inquiries in a timely manner. It sets a standard for accountability in customer communication practices.
National Law Articles
After receiving several complaints, at different times, about unwanted promotional phone calls from ENEL Energia (the controller), one of Italy's most important energy providers, the DPA initiated its investigation. At the end of 2018 and the beginning of 2019, the DPA made two requests for information to the controller. It then submitted a third request on 17 December 2019, which went unanswered. The DPA followed up with a fourth request on 10 July 2020, which the controller replied to on 14 January 2021. Then, on 14 May 2021, the DPA notified the controller of the initiation of the sanctioning procedure. On 16 December 2021, the Italian DPA fined the controller €26,513,977 with its [https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_(Italy)_-_9735672 decision of 9735672]. The controller appealed the decision to the Tribunale ordinario di Roma (Court) arguing that the Italian DPA failed to comply with the 120-day deadline for notification of the beginning of the sanctioning procedure, which the DPA should have complied with. To begin with, the Court noted that the Italian DPA had issued [https://www.garanteprivacy.it/home/docweb/-/docweb-display/docweb/9107640 Regulation No 2/2019] concerning the identification of terms and organisational units responsible for the administrative procedures. In accordance with [https://www.garanteprivacy.it/documents/10160/0/Codice+in+materia+di+protezione+dei+dati+personali+%28Testo+coordinato%29.pdf/b1787d6b-6bce-07da-a38f-3742e3888c1d?version=7.0 Article 166(5) of the Italian Privacy Code], the Regulation gives the DPA a time limit of 120 days from the establishment of the violation to notify the controller of the beginning of the sanctioning procedure. Subsequently, the Court addressed the DPA’s claim that the 120-day time limit was not mandatory. The Court stated that the time limit must be regarded as peremptory under [https://www.normattiva.it/uri-res/N2Ls?urn:nir:stato:legge:1990-08-07;241!vig=
Outcome
Court Ruling
A ruling by a national court on a data-protection matter.
Related Cases (0)
No other cases found for Enel Energia in IT
This is the only recorded case for this entity in this jurisdiction.
Details
Ruling Date
13 February 2023
Authority
Garante per la protezione dei dati personali
GDPRhub ID
gdprhub-court-7565About this data
Cite as: Cookie Fines. Enel Energia - Italy (2023). Retrieved from cookiefines.eu
Last updated: