Eni S.p.a. – €96,000 Fine (Italy, 2026)

In 2023 two NGOs and twelve individuals (the data subjects) filed a lawsuit against, among others, energy corporation Eni S.p.a. (the controller) over the alleged non-compliance with environmental legislation. The controller later published the statement of claims on its website, including the names, personal details, and social security numbers of the data subjects. In response, the data subjects and one of the NGOs (Greenpeace) filed complaints with the DPA, claiming that their names were unlawfully published. The controller later redacted the subject's data from the document available on its website and claimed that the publication was due to a human error. In its defense, the controller also claimed that, given the media attention drawn by the lawsuit, it had a legitimate interest to both defend its public image and clarify the exact content of the lawsuit it was facing. The controller also pointed out that some of the data it published was already publicly available and that the data subjects themselves had made it publicly known to the media that they were the claimants in its lawsuit. On these grounds, the controller argued that the data could be published. The DPA first rejected the argument that the data were publicly available information. In this regard, the DPA noted that while some of the data subjects had publicly spoken about their lawsuit, they had never made their addresses and social security codes public. Furthermore, the DPA clarified that even publicly available data requires a legal basis for processing. The DPA then held that the processing of the data was not justified by the controller’s legitimate interest for two reasons. First, the processing was not necessary, as the controller could have pursued its interest by publishing a redacted copy of the statement of claims. Second, the data subjects’ rights and freedoms outweighed the controller’s interest in the case at hand. On these grounds, the DPA found a violation of Articles 5(1)(a) and 6(1) GDPR and fined the controller €96,000.