Enforcement · Italian Data Protection Authority (Garante) EN LLM context A cited markdown file you can paste into your AI assistant (ChatGPT, Claude, a RAG or project knowledge base) to ground it in this document. Contains: this document’s text, its sections with their topics, and the full text of every law provision it applies. Everything links back to its source on overview.legal — legal information, not advice.

Eni Gas e Luce: Insufficient legal basis for data processing

€8,500,000 Fine
Eni Gas e Luce
ITALY
Art. 5 GDPR Art. 6 GDPR Art. 17 GDPR Art. 21 GDPR
Fines Integrity and Confidentiality Principle Personal Data Direct Marketing Processing Right to Object Retention Period Storage Limitation
Dec 11, 2019 Source

How it connects

Related across sources

Guidance EDPB Annual Report 2021 EDPB Guidance Art. 29 WP Guidelines on GDPR transparency requirements (WP260 rev.01) EDPB Case Law Judgment of the Court (Third Chamber) of 11 April 2024.#GP v juris GmbH.#Request for a preliminary ruling from the Landgericht Saarbrücken.#Reference for a preliminary ruling – Protection of natural persons with regard to the processing of personal data – Regulation (EU) 2016/679 – Article 82 – Right to compensation for damage caused by data processing that infringes that regulation – Concept of ‘non-material damage’ – Impact of the seriousness of the damage suffered – Liability of the controlle Court of Justice of the European Union Case Law Meta Platforms v noyb CJEU Guidance Guidelines 10/2020 on restrictions under Article 23 GDPR EDPB Guidance EDPB Annual Report 2023 EDPB

Full text

The Italian supervisory authority imposed two fines totalling EUR 11,5 million on Eni Gas and Luce (Egl) for unlawful processing of personal data in the context of advertising activities and activation of unsolicited contracts. The first fine of EUR 8.5 million relates to the unlawful processing in connection with telemarketing and telesales activities. Amongst others, promotional calls were made without the consent of the person contacted or despite that person's refusal to receive promotional calls, or without triggering the special procedures for checking the public opt-out register. In addition, there was lack of technical and organisational measures to take account of the information provided by users; data was processed longer than the permitted data retention periods; and data on potential customers was collected from entities (list providers) who had not obtained consent to the disclosure of such data.

Industry: Transportation and Energy

Original document at the source www.gpdp.it

Similar Content