- Enforcing jurisdiction
- Italy · Geography does not establish applicable law.
- Confirmed applicable legislation
- Privacy topics
Signore XX (the data subject) – €1,000,000 Fine (Italy, 2022)
Privacy enforcement record
This record is classified outside cookie consent. Subject classification does not confirm an applicable law. It is not included in cookie statistics or the Risk Calculator.
Areti spa, an electricity supplier in Italy, was fined €1 million for incorrectly classifying a customer as insolvent. This mistake prevented the customer from switching suppliers and potentially saving money. The ruling highlights the importance of accurate data management for companies.
What happened
Areti spa classified a customer as insolvent due to outdated and inaccurate data.
Who was affected
A customer who was incorrectly labeled as insolvent, along with approximately 47,000 others affected by the same issue.
What the authority found
The Italian data protection authority found that Areti spa violated GDPR by failing to maintain accurate data and not properly responding to data access requests.
Why this matters
This case underscores the need for companies to ensure their data is accurate and up-to-date. It also shows that companies can be held accountable for the consequences of their data management practices.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Entities Involved
Source checks
Linked-source text retrieved.
Automated check recorded — 5 March 2026.
Processing notes: articles corrected.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
Areti spa, a company that distributes electricity in the Italian capital (the controller), accidentally classified a customer (the data subject) as insolvent. As would become clear later, this inaccurate profile was shared with the insolvency registry. The data subject was consequently unable to switch to another supplier and thus lost any potential savings. The data subject lodged a complaint with the DPA on 6 March 2021. The investigations from the DPA revealed that it was impossible for the user to change supplier as a result of the processing of inaccurate and outdated data. Due to a misalignment of the controller’s internal systems, incorrect information regarding customer accounts (in particular, customers with ongoing arrears) was communicated to the Integrated Information System (IIS), the database consulted by suppliers before signing a new contract. Incoming suppliers were able to assess the convenience of acquiring a new customer in the free market by consulting the IIS, which included information provided by the controller. Unfortunately, however, during the period of December 2016 until January 2022, the methods used by the controller to extract information from its own systems had, due to a series of technical and application errors, actually resulted in the fact that a number of data subjects were declared insolvent. As a consequence, on the basis of this inaccurate information, the incoming sellers had denied over 47,767 potential customers. Issuing its decision, the Italian DPA found that the incorrect use of the query for the extraction of delinquency data for the period between December 2016 and 4 January 2022 constituted a violation of Article Article 5(1)(d) GDPR. In addition, the DPA also contested the controller's inadequate data retention time (breach of Article 5(1)(e) GDPR); the migration of inaccurate data within its systems (breach of Article 5(1)(d) GDPR); and the inadequate response to access requests filed by the data subject, in vio
Related Enforcement Actions (0)
No other enforcement actions found for Signore XX (the data subject) in IT
This is the only recorded action for this entity in this jurisdiction.
Details
Fine Date
24 November 2022
Authority
Garante per la protezione dei dati personali
Fine Amount
€1,000,000
About this data
Cite as: Cookie Fines. Signore XX (the data subject) - Italy (2022). Retrieved from cookiefines.eu
Last updated: