The sanctioning measures adopted by the Italian Data Protection Authority against ENI (formerly ENI Gas e Luce “EGL” and today ENI Plenitude) highlight some important aspects of the discipline also of a general nature and not only in the telemarketing field.
Already in 2019, EGL was the recipient of two simultaneous sanctioning measures:
- The first for the conclusion of unsolicited contracts concerning energy services to private individuals.
- The second, for telemarketing and teleselling in the absence of legally valid consent.
Finally, on 6 June 2024, ENI itself, now called ENI Plenitude, was again fined for the processing of telephone user data for telemarketing, even if carried out by agencies on its own behalf, in the absence of valid consent.
The first sanctioning measure of 2019
With the first sanctioning measure of December 11, 2019 (web doc no. 9244358), the Italian DPA intervenes on the issue of unsolicited contracts for energy utilities, at the intersection of consumer protection and personal data protection.
According to the recalled measure, audits had revealed that ENI had conducted personal data processing that did not comply with Regulation (EU) 2016/679 through some agencies designated as data processors. These processing operations had been carried out incorrectly and unlawfully, violating the principles of correctness, accuracy and updating of data.
Although the processors had acted in violation of the instructions ENI’s controller had given them, the technical and organizational measures taken by ENI had not been adequate to the nature and risks of the processing operations, violating the principle of accountability and data integrity. The privacy policies and deficient procedural arrangements had allowed agents and salespeople to operate incorrectly, in violation of the instructions they had received, undermining the legitimacy of the processings.
The shortcomings also found in terms of procedures for controlling the work of its data processors had led to the proliferation of the conclusion of unsolicited contracts.
Basically, in this circumstance, the controller company’s violation had consisted in not having exercised adequate control over the work of its data processors, who were guilty of promoting the conclusion of contracts relating to unsuspecting users (so-called “culpa in vigilando”).The fine imposed on ENI is 3 million euros.
The second sanctioning measure of 2019
The second sanctioning measure, also dated December 11, 2019 (web doc. no. 9244365), concerns the making of promotional calls by call centers, on behalf of ENI Gas and Luce, in the absence of valid consent.
In this circumstance one is in the realm of:
- telemarketing i.e., as reported by the Italian DPA, in those “telephone contacts aimed at setting appointments with potential customers in relation to the purchase of products,” and
- teleselling i.e., in relation to “telephone contacts aimed at the commercial promotion of electricity, gas or other products and services (of ENI) aimed at ‘retail customers’.“
Again, the above activities are carried out by a network of agencies designated as data processors who use lists of telephone users from:
- ENI company CRMs
- “purchased from list providers (who in turn may acquire them from third parties called “publishers”)”
- “self-generated through the completion, by the data subjects themselves, of special forms on ENI’s” website.
In this instance, including for unlawful conduct on the part of telemarketers, it had turned out that ENI had made, through them, advertising calls without valid consent, failing to carry out adequate checks both on the status of the consents, before the start of each promotional campaign, and on the work of its agencies.
The fine imposed in this circumstance was the payment of a sum of 8.5 million euros.
