Eni Gas e Luce S.p.A. (electricity and gas)
- Country
- Italy
- Fine
- 3,000,000 EUR
- Date
- 2019-12-11
- Articles
- Art. 5 andart. 32 of GDPR
Breaches due to the conclusion of unsolicited contracts for the supply of electricity and gas under ‘deregulated market’ conditions, due to the inadequacy of privacy policies adopted by Eni Gas e Luce S.p.A.
The investigation of the Italian DPA showed that, although the unlawful processing operations were carried out by data processors (agents and sellers) who acted in partial violation of the instructions given by ENI, the technical and organizational measures adopted by ENI were not adequate to the nature, context, purposes and risks of the processing, thus violating the principle of "accountability" imposed by GDPR. Several gaps emerged in the privacy policies implemented by ENI, that appeared to be deficient and ineffective, especially in terms of guaranteeing the accuracy of the data processed, the security of the processing and the control of the actions carried out by ENI’s data processors. Authority: Italian Data Protection Authority