DATA PROTECTION | Italian DPA fines Enel Energia for telemarketing

On 8 February 2024, the Italian Data Protection Authority (Italian DPA) issued an order imposing a fine of 79 million Euro – the highest fine ever issued by the Authority – on Enel Energia, due to deficiencies in the processing of the personal data of electricity and gas customers for telemarketing purposes. The fine stems from an earlier investigation conducted by the Italian Guardia di Finanza, which fined four companies 1.8 million Euro and seized their databases, as they were associated with unlawful activities. Enel Energia was found to have acquired 978 contracts from such companies. Moreover, subsequent inspections revealed security shortcomings in Enel’s customer management systems, allowing unauthorised agents to conduct various illicit activities, including making nuisance calls and signing contracts that provided no tangible benefit to customers. Such violations resulted in the activation of at least 9,300 contracts over time.

Newsletter n. 94 – March 2024