Date of final decision: 16 December 2021
Cross-border case or national case: National case
Controller: Enel Energia S.p.a.
Legal Reference: Principles relating to processing of personal data (Article 5); Lawfulness of processing (Article 6); Conditions for consent (Article 7); Transparent information, communication and modalities for the exercise of the rights of the data subject (Article 12); Information to be provided where personal data are collected from the data subject (Article 13); Right to object (Article 21); Accountability of the controller (Article 24); Data protection by design and by default (Article 25); Imposition of corrective measures (Article 58(2).
Decision: The Italian SA imposed a fine amounting to EUR 25,513,977. Enel Energia was ordered to bring all processing of data by its sales network into compliance. It will have to implement further technical and organisational measures to handle data subjects’ requests to exercise their rights.
Key words: Marketing, database, information and access to personal data, promotional calls, unsolicited communications, processing and disclosure of personal data, technical and organisational measures, informed consent.
Summary of the Decision
Origin of the case
The decision was issued following complex inquiries the SA had started on account of hundreds of complaints by users who had received unsolicited calls made on behalf of Enel Energia, some of them based on pre-recorded messages.
The inquiries by the SA showed pervasive as well as increasingly invasive reliance on unsolicited promotional calls without the required consent, addressed to off-directory users or to users listed in the opt-out register; additionally, the feedback to users’ requests to access their personal data or to object to processing for marketing purposes was delayed or missing altogether.
In the light of the infringements found, the Italian SA imposed a fine amounting to EUR 25,513,977.
Enel Energia was additionally ordered to bring all processing of data by its sales network into compliance with suitable arrangements and measures to demonstrate that promotional schemes and services or contracts are only activated following promotional calls addressed to numbers that are listed in the Register of Communications Operators (RCO).
Enel Energia will also have to implement further technical and organisational measures to handle data subjects’ requests to exercise their rights including, in particular, the right to object to processing for promotional purposes - so as to provide feedback on those requests by no later than thirty days.
For further information: https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/9735672
The news published here does not constitute official EDPB communication, nor an EDPB endorsement. This news item was originally published by the national supervisory authority and was published here at the request of the SA for information purposes. Any questions regarding this news item should be directed to the supervisory authority concerned.