Iren Mercato S.p.A.
- Country
- Italy
- Fine
- 2,856,169 EUR
- Date
- 2021-05-13
- Sector
- Electricity and gas
- Articles
- art. 6, par. 1, lett. a)art. 7, par. 1art. 5, par. 1, lett. a) and par. 2 of GDPR
Insufficient legal basis for data processing, improper use of the legitimate interest as a legal basis for data processing and breach of the principles of accountability.
Following several complaints and reports, the Italian DPA verified that the Socieity had processed personal data for telemarketing activities, which it had not collected directly, but had acquired from other sources. In fact, Iren had obtained lists of personal data from a third company, which in turn had acquired them, in the capacity of independent data controller, from two other companies. The latter companies had obtained the consent of potential customers for telemarketing carried out both by them and by third parties, but this consent did not cover the transfer of customer data from those third parties to other third parties, including Iren.