Eni Gas e Luce S.p.A. (electricity and gas)
- Country
- Italy
- Fine
- 8,500,000 EUR
- Date
- 2019-12-11
- Articles
- Art. 5art. 6art. 7 andart. 25 of GDPR
The violations include (i) the use of advertising calls without the consent of the contacted person; (ii) the absence of adequate technical and organisational measures; (iii) the unlawful data retention and (iv) the unlawful processing of personal data ac
The key point of this decision is based on the absence of the data subjects’ consent. Infact, in doing its telemarketing and teleselling activities, Eni didn’t match in a proper way its database with the “Opt-out Register”; it considered as prevalent the general consent given by data subjects to third parties for marketing purposes (lists providers), rather than the refusal to give consent, for the same kind of data processing, expressed by the same data subjects to ENI itself. According to the Italian DPA, these unlawful data processing operations were carried out as ENI did not take and implement technical and organizational measures, suitable for recording and update the users’ willness not to receive marketing communications. Authority: Italian Data Protection Authority