Updated: Apr 15, 2020
The Italian Supervisory Authority imposed two fines on Eni gas and Luce (Egl), totalling EUR 11.5 million, concerning respectively illicit processing of personal data within the context of promotional activities and the activation of unsolicited contracts. The fines were determined in the light of the parameters set out in the European regulation, including the wide variety of stakeholders involved, the pervasiveness of the conduct, the duration of the infringement, and the economic conditions of Egl.
The source of this article can be found here
To read the press release in Italian, click here
the first fine of EUR 8,5 million relates to unlawful processing in connection with telemarketing and teleselling activities as located during inspections and inquiries that were carried out via the Authority following several dozens of alerts and complaints received within the immediate aftermath of the overall application of the GDPR.
The verifications revealed a limited number of cases, which however pointed to ‘systematic’ conduct by Egl and highlighted serious criticalities regarding the general processing of data.
The violations brought to light consist of marketing calls made without the consent of the contacted person or despite that individual’s refusal to receive promotional calls, or without triggering the specific procedures for verifying the public opt-out register; the absence of technical and organisational measures to take account of the indications provided by users; longer than permitted data retention periods; and the acquisition of the data on prospective customers from entities (list providers) that had not obtained any consent for the disclosure of such data.
Having declared the conduct detected as unlawful, the Italian SA ordered Egl to put in place procedures and systems to verify, also by analysing a large sample of customers, the consent of the persons included in the contact lists before the start of promotional campaigns. Egl will also have to ensure complete automation of data flows from its database to the organisation’s blacklist, i.e., the list of people who do not want to receive marketing.
The Italian SA further prohibited the organisation from the use of the data made available via the list providers if the latter had not acquired specific consent for the communication of such data to Egl.
The second fine of EUR 3 million concerns breaches due to the conclusion of unsolicited contracts for the supply of power and gas under ‘free market’ conditions. Many individuals complained to the Authority that they learned about the conclusion of a new contract only on receiving the letter of termination of the contract with the preceding supplier or else the first Egl bills. In some instances, the complaints reported incorrect data in the contracts and forged signatures.
The above serious irregularities have struck approximately 7200 consumers. The Authority’s findings confirmed that the conduct of Egl in obtaining new customers thru certain external corporations operating on its behalf led, in organisational and managerial phrases, to processing activities in breach of the European law as they violated the standards of information fairness, accuracy and up-to-dateness.
Having established such unlawful conduct, the Italian SA ordered Egl to take several corrective measures and to introduce specific alerts to detect various procedural anomalies.
Implementation of the above measures will take area and be communicated to the Authority within a set timeframe, while the fines will have to be paid within 30 days.