GDPR: “Telemarketing”, fine of 11.5 million to Eni Gas and Luce
Promotional activities (telemarketing) and activation of unsolicited contracts, these are the reasons that prompted the Data Protection Authority to sanction Eni Gas and Luce (Egl) with 11.5 million euros, a record fine in Italy since the entry into force of the GDPR, the second sanction imposed in Italy after the entry into force of the GDPR, but of a significantly higher amount than the first sanction imposed last April on the Rousseau platform.
The reasons behind this assessment, in line with the provisions set by the EU Regulation, were the wide audience of the parties involved, the pervasiveness of the conduct, the duration of the violation, the economic conditions of Egl.
The amount of the fine is the result of two distinct violations:
- 5 million euros for illegal processing in telemarketing and teleselling activities following dozens of reports and complaints from data subjects.
The following illegal treatments have been highlighted:
- advertising calls made without the consent of the contacted person or despite his refusal to receive promotional calls;
- absence of specific verification procedures of the Italian Registro pubblico delle opposizioni;
- data retention beyond the allowed limits;
- acquisition of data from list providers without specific consent to the communication of those data to Egl.
Against these behaviors, the Data Protection Authority imposed on Egl the implementation of:
- procedures and systems to implement and check the status of the consents of the data subjects before the start of the campaigns.
- Automate the flow of data from their database to the blacklist of those who do not want to receive advertising used by the company.
- 3 million euros for violations in the conclusion of unsolicited contracts in the free market for the supply of energy and gas. Many requests received by the Authority came from subjects who had learned of the stipulation of new contracts from the receipt of the letter of cancellation from the old supplier or from the first invoices of Egl. These practices involved around 7200 consumers.
The Data Protection Authority has found that the causes of these illegal treatments are to be found in the methods of acquiring new customers through some external agencies and in the organizational and management methods used by Egl.
The Data Protection Authority therefore ordered Egl to adopt a series of corrective measures and specific alert systems in order to detect the procedural anomalies to be introduced and applied within the established times. The fine must instead be paid within 30 days.
Therefore, the era of sanctions seems to have started also from the Italian Authority, who has highlighted not only a particular attention in the consent acquiring processes, which are the basis of the processing for marketing purposes, but also in the internal organizational and management methods implemented by companies for the processing of personal data.