The Italian Supervisory Authority imposed two fines on Eni Gas and Luce (Egl). Fines totalling EUR 11,5 million. These are illicit processing of personal data in the context of promotional activities and the activation of unsolicited contracts.
The fines were determined in light of the parameters set out in the EU Regulation. It included the wide range of stakeholders involved, the pervasiveness of the conduct, the duration of the infringement, and the economic conditions of Egl.
The first fine of EUR 8,5 million relates to unlawful processing in connection with telemarketing activities as found during inspections and inquiries. These were carried out by the Authority following several dozens of alerts and complaints received in the immediate aftermath of the full application of the GDPR.
The verifications revealed a limited number of cases. However, pointed to ‘systematic’ conduct by Egl and highlighted serious criticalities with regard to the general processing of data. The violations brought to light include advertising calls made without the consent of the contacted person or despite that person’s refusal to receive promotional calls, or without triggering the specific procedures for verifying the public opt-out register; the absence of technical and organizational measures to take account of the indications provided by users; longer than permitted data retention periods; and the acquisition of the data on prospective customers from entities (list providers) that had not obtained any consent for the disclosure of such data.
Having declared the conduct detected as unlawful, the Italian SA ordered Egl to put in place procedures and systems in order to verify, also by examining a large sample of customers, the consent of the persons included in the contact lists prior to the start of promotional campaigns. Egl will also have to ensure full automation of data flows from its database to the company’s own blacklist. For example the list of those who do not wish to receive advertising.
The Italian SA further prohibited the company from using the data made available by the list providers. If the latter had not obtained specific consent for the communication of such data to Egl.
The second fine of EUR 3 million concerns breaches due to the conclusion of unsolicited contracts for the supply of electricity and gas under ‘free market’ conditions. Many individuals have complained to the Authority that they learned about the conclusion of a new contract only on receiving the letter of termination of the contract with the previous supplier or else the first Egl bills. In some cases, the complaints reported incorrect data in the contracts and forged signatures.
About 7200 consumers were affected by the above serious irregularities. The Authority’s findings showed that the conduct of Egl in acquiring new customers through certain external agencies operating on its behalf led, in organisational and managerial terms, to processing activities in breach of the EU Regulation as they violated the principles of data fairness, accuracy and up-to-dateness.
Having established such unlawful conduct, the Italian SA ordered Egl to take several corrective measures. Also, to introduce specific alerts in order to detect various procedural anomalies. Implementation of the above measures will have to take place and be communicated to the Authority within a set timeframe. The fines will have to be paid within 30 days.