Italy

Energia Verde S.p.A.

100,000 €

GDPR enforcement action by Italian Data Protection Authority (Garante) on 2025-04-29.

Rank · Sector

#65

of 167 in Transportation and Energy

Rank · Italy

#83

of 543

Rank · All fines

#489

of 3,050

Case details

Authority: Italian Data Protection Authority (Garante)
Date: 2025-04-29
Controller / Processor: Energia Verde S.p.A.
Sector: Transportation and Energy
Quoted Articles: Art. 5 GDPR, Art. 6 GDPR, Art. 7 GDPR, Art. 12 GDPR, Art. 15 GDPR, Art. 16 GDPR, Art. 17 GDPR, Art. 18 GDPR, Art. 19 GDPR, Art. 20 GDPR, Art. 21 GDPR, Art. 22 GDPR, Art. 24 GDPR, Art. 28 GDPR, Art. 31 GDPR, Art. 58 GDPR
Type of violation: Non-compliance with general data processing principles

Summary

The Italian DPA has imposed a fine of EUR 100,000 on Energia Verde S.p.A. The controller had been active in direct marketing activities. The controller processed data without a sufficient legal basis, without sufficient technical and organisational measures to ensure data security and without prior and correct identification of the roles of processors and subjects. The controller fruther failed to adequately react to requests from data subjects to exercise their rights, to demonstrate, that the controller processes data in accordance with the GDPR and adequatly cooperating with the DPA.

Open original source Links to the regulator's original publication or another source.