Italy: Garante fines Eni gas e luce €11.5 M over unsolicited telemarketing and activation of unrequested contracts
The Italian data protection authority ('Garante') announced, on 17 January 2020, that it had issued two decisions against Eni gas e luce S.p.A., fining the latter €11.5 million over unsolicited telemarketing and activation of unrequested contracts. In particular, the Garante outlined that Eni gas e luce violated the General Data Protection Regulation (Regulation (EU) 2016/679) ('GDPR') by, among other things, conducting advertising calls made without the consent of the consumer or despite the consumer's refusal to receive promotional calls, or without activating the specific verification procedures of the Public Register of Oppositions. In addition, the Garante highlighted that Eni gas e luce did not have technical and organisational measures in order to receive the expressions of will of users, appropriate data retention standards, and noted that Eni gas e luce acquired potential customers' data from marketing list providers who had not acquired consent for the communication of such data.
Furthermore, the Garante found that Eni gas e luce activated unrequested energy contracts in relation to around 7,200 individuals, in violation of the principles of lawfulness and accuracy, as stipulated by the GDPR.
UPDATE (20 January 2020)
EDPB issues statement on Garante's fine against Eni gas e luce
The European Data Protection Board ('EDPB') issued, on 17 January 2020, a statement on the Garante's fine against Eni gas e luce. In particular, the EDPB outlined that the enforcement actions concerned the unlawful processing of personal data in the context of promotional activities and the activation of unsolicited contracts.
You can read the press release here.