Italy

Edison Energia S.p.A.

4,900,000 €

GDPR enforcement action by Italian Data Protection Authority (Garante) on 2022-12-15.

Rank · Sector

#14

of 167 in Transportation and Energy

Rank · Italy

#17

of 543

Rank · All fines

#77

of 3,050

Case details

Authority: Italian Data Protection Authority (Garante)
Date: 2022-12-15
Controller / Processor: Edison Energia S.p.A.
Sector: Transportation and Energy
Quoted Articles: Art. 5 (1) a) GDPR, Art. 5 (2) GDPR, Art. 6 GDPR, Art. 7 GDPR, Art. 12 (1), (2), (3) GDPR, Art. 21 (2) GDPR, Art. 24 (1), (2) GDPR, Art. 25 (1) GDPR
Type of violation: Non-compliance with general data processing principles

Summary

The Italian DPA has fined Edison Energia S.p.A. EUR 4.9 million. Several person had filed complaints with the DPA regarding unlawful marketing activities of the company. During its investigation, the DPA found that the company contacted data subjects by telephone for marketing purposes without their consent. For this purpose, the company used contact lists from third parties, which in many cases, however, did not contain the free, specific, informed and documented consent of the users to the disclosure of personal data. The DPA also found that Edison Energia did not provide data subjects with a direct and easy way to exercise their right to object. In addition, Edison Energia failed to respond to data subject requests in a timely manner in several cases. In addition, the DPA found that users of the app and website simultaneously consented to the use of their data for both marketing and profiling purposes. The DPA found that such consent did not correspond to voluntary and specific consent for different purposes. Finally, the DPA found that Edison Energia failed to provide data subjects with transparent information about the processing of their personal data.

Open original source Links to the regulator's original publication or another source.