EstEnergy S.p.A.

Summary

The Italian DPA has imposed a fine of EUR 1,400,000 on EstEnergy S.p.A. EstEnergy is an energy retailer in the Hera Group, active in North-East Italy. The controller assessed the creditworthiness of prospective customers using a credit score (CGS-X) supplied by an external provider, which combined scores and sub-scores drawn from a credit reference agency and a commercial information provider. The controller received and retained far more scoring data than the single value it used to accept or refuse applications, set no retention period for it, and unlawfully repurposed it to refine its own creditworthiness model. It also failed to respond adequately to data subject requests, telling applicants that it did not hold the details behind the score and referring them to the external providers, although the investigation established that the data were in its systems; in one case the controller redacted the sub-scores from a report before sending it to the applicant. The controller further shared customer arrears data with another sales company in the group without informing data subjects, and the instructions given to the group parent acting as processor did not cover that activity. The data sharing was placed on a lawful footing by a joint-controllership agreement in August 2024. The conduct affected around one million people and led in most complaint cases to refusal of an energy supply contract.