Enel Energia S.p.A. – €79,107,101 Fine (Italy, 2024)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
The Italian DPA fined Enel Energia S.p.A. EUR 79.1 million for failing to protect customer data from unauthorized telemarketing activities. This ruling is crucial as it shows that companies must have strong security measures to safeguard personal information. Failing to do so can result in massive fines.
What happened
Enel Energia S.p.A. did not comply with security measures to protect customer data from unauthorized telemarketing.
Who was affected
Customers whose personal data was misused for telemarketing were affected.
What the authority found
The DPA ruled that Enel Energia lacked adequate technical and organizational measures to prevent data misuse, violating GDPR rules.
Why this matters
This case highlights the need for companies to implement robust data protection measures. Organizations must ensure their systems are secure to avoid severe financial penalties.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Secondary-source text retrieved.
Review needed — 18 October 2026.
Processing notes: amount discrepancy.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
The Italian DPA has fined Enel Energia SpA EUR 79.1 million due to its lack of compliance with technical and organisational measures aimed at limiting the potential abuses by agencies that unlawfully performed telemarketing activities. According to the DPA, Enel Energia acquired as many as 978 contracts from four different previously sanctioned companies, even though they did not belong to the energy company’s sales network. Moreover, following subsequent inspections at Enel Energia, the DPA ascertained that the information systems used for customer management and service activation by the company showed the abovementioned serious security shortcomings. Enel failed to put in place all the necessary measures to prevent the unlawful activities of unauthorised agents who fuelled for years an illicit business carried out through nuisance calls, service promotions, and the signing of contracts with no real economic benefits for customers by identifying easy ‘front doors’ in the company’s information systems.
Related Enforcement Actions (0)
No other enforcement actions found for Enel Energia S.p.A. in IT
This is the only recorded action for this entity in this jurisdiction.
Details
Fine Date
8 February 2024
Authority
Garante per la protezione dei dati personali
Fine Amount
€79,107,101
Enforcement Tracker ID
ETid-2306
GDPRhub ID
gdprhub-7788About this data
Cite as: Cookie Fines. Enel Energia S.p.A. - Italy (2024). Retrieved from cookiefines.eu
Last updated: