Italian Supervisory Authority (SA) – fines of 3 million euros imposed on an energy company and 850 000 euros on agencies involved in illegal telemarketing activities

       The National Center for Personal Data Protection (NCPDP), for informational and practical purposes, reports on the fines imposed by the Italian Supervisory Authority (SA) in the amount of 3 million euros for the company Acea Energia spa and 850 00 euros to the agencies involved for violating art. 5 paragraph. (1), art. 6, art. 7, art. 13, art. 24, art. 25, art. 28, art. 29, art. 32 of the GDPR and art. 130 of the National Personal Data Protection Code.

       The Italian SA conducted investigations, together with the Guardia di Finanza, following a complaint regarding the illegal activity of unauthorized call centers. They were contacting people for offers regarding energy or telephony suppliers, using databases obtained without consent and without being registered in the Register of Communications Operators (ROC).

        Investigations revealed that the personal data of customers who had recently changed their energy supplier was being used to persuade them, through deceptive methods, to sign new contracts. The data came from the network of partner companies, without the information of the individuals concerned.

       Although representatives of the energy company were in contact with the telemarketing agencies, the company revoked the collaboration and applied corrective measures once it learned of the irregularities.

       In this context, the Italian SA imposed fines of 3 million euros on the Acea Energia company spa and 850 000 euros on the agencies involved. The company must notify affected individuals and verify the legality of sub-processors, and agencies can no longer use legally unjustified contact lists.

       NCPDP, as the national supervisory authority for the processing of personal data, emphasizes the responsibility of personal data controllers to comply with the provisions of the legislative framework on the protection of personal data and to ensure that personal data processing operations comply with the legislation in force.