Fine in the amount of EUR 26.5 million applied by Italian Data Protection Authority to Enel Enegia for illegal personal data processing
The National Center for Personal Data Protection (NCPDP), for information and application purposes, communicates about the fine in the amount of of EUR 26.5 million applied by Italian Data Protection Authority (SA) to Enel Enegia for illegal personal data processing.
The decision was issued following complex inquiries the SA had started on account of hundreds of complaints by users who had received unsolicited calls made on behalf of Enel Energia, some of them based on pre-recorded messages.
The inquiries by the SA showed an invasive reliance on unsolicited promotional calls without the required consent addressed to users, additionally, the feedback to users’ requests to access their personal data or to object to processing for marketing purposes was delayed or missing altogether.
In the light of the infringements found, the Italian SA imposed a fine of EUR 26.5 million to Enel Energia and ordered to bring all personal data processing into compliance with legal provisions, in order to demonstrate that promotional services or contracts are only activated following promotional calls addressed to numbers that are listed in the Register of Communications Operators. Furthermore, Enel Energia will also have to implement further technical and organisational measures to handle data subjects’ requests to exercise their rights including, in particular, the right to object to processing for promotional purposes – so as to provide feedback on those requests by no later than thirty days.
The NCPDP, as national supervisory authority for personal data processing, emphasizes the responsibility of personal data controllers to comply with the provisions of legal framework on personal data protection and to ensure that personal data processing operations are in accordance with the legislation in force.