DATA PROTECTION | Italian DPA fines energy provider €3 million for unlawful telemarketing activities

With a press release dated 7 May 2025, the Italian Data Protection Authority (DPA) announced the issuance of a €3 million fine against an energy provider for GDPR violations involving poorly supervised third-party sales agents. The investigation revealed that the company had failed to verify whether its data processors had adequate safeguards in place, as required by Article 28 of the GDPR.

Among the key findings, the DPA clarified that a controller cannot avoid liability by claiming unawareness of unlawful conduct by its data processor. Controllers remain accountable for ensuring that processors provide sufficient guarantees of GDPR compliance. Moreover, the DPA affirmed that the assessment of a processor’s suitability cannot rely on abstract declarations of compliance. It must include a detailed evaluation supported by documentation including data protection policies and security protocols. The effectiveness of these safeguards must be verified through structured audits, both before appointing the processor and throughout the contractual relationship.

This decision is among a growing number of enforcement measures taken by the DPA in response to non-compliant remote contracting with consumers, a sector that remains under close scrutiny.

Newsletter n. 107 – May 2025