Italy

Energia Sostenibile S.r.l.

100,000 €

GDPR enforcement action by Italian Data Protection Authority (Garante) on 2026-05-14.

Rank · Sector

#69

of 174 in Transportation and Energy

Rank · Italy

#87

of 573

Rank · All fines

#506

of 3,106

Case details

Authority: Italian Data Protection Authority (Garante)
Date: 2026-05-14
Controller / Processor: Energia Sostenibile S.r.l.
Sector: Transportation and Energy
Quoted Articles: Art. 5 GDPR, Art. 6 GDPR, Art. 7 GDPR, Art. 12 GDPR, Art. 13 GDPR, Art. 15 GDPR, Art. 24 GDPR, Art. 28 GDPR
Type of violation: Non-compliance with general data processing principles

Summary

The Italian DPA has imposed a fine of EUR 100,000 on Energia Sostenibile S.r.l. Accounts from around 30 data subjects stated that they had received phone calls on bahlf of the controller despite being on the public opt-out register. The accounts further stated that the operators made fraudulent claims in these calls. Data processors who had been contracted by the controller for marketing purposes employed these operators. They often claimed to work on behalf of well-known companies and then tried to close supply contracts with the controller. The investigation found that during a week-long testing period of the controller's marketing activities around 50 of these fraudulent calls were made. The controller did not ensure the adequacy of its data processor, furthermore did not have a legal basis for processing the data subjects' personal data and did not adequately comply with data subjects' requests to exercise rights.

Open original source Links to the regulator's original publication or another source.