Energia Verde S.p.a. – €100,000 Fine (Italy, 2025)

The Italian DPA has imposed a fine of EUR 100,000 on Energia Verde S.p.A. The controller had been active in direct marketing activities. The controller processed data without a sufficient legal basis, without sufficient technical and organisational measures to ensure data security and without prior and correct identification of the roles of processors and subjects. The controller fruther failed to adequately react to requests from data subjects to exercise their rights, to demonstrate, that the controller processes data in accordance with the GDPR and adequatly cooperating with the DPA.