Enforcement · Italian Data Protection Authority (Garante) EN LLM context A cited markdown file you can paste into your AI assistant (ChatGPT, Claude, a RAG or project knowledge base) to ground it in this document. Contains: this document’s text, its sections with their topics, and the full text of every law provision it applies. Everything links back to its source on overview.legal — legal information, not advice.

Edison Energia S.p.A.: Non-compliance with general data processing principles

€4,900,000 Fine
Edison Energia S.p.A.
ITALY
Art. 5 GDPR Art. 6 GDPR Art. 7 GDPR Art. 12 GDPR Art. 21 GDPR Art. 24 GDPR Art. 25 GDPR
Right to Object Data Subject Rights Exercise Modalities and Procedures IP Address Personal Data Direct Marketing Marketing Processing Agreement Consent
Dec 15, 2022 Source

How it connects

Related across sources

Case Law Google LLC v CNIL CJEU Case Law CJEU Bavarian Lager: Disclosing personal data in access-to-documents requests is CJEU Case Law HvJ EU 9 januari 2025, C‑394/23 (Mousse). CJEU Guidance Guidelines 07/2022 on certification as a tool for transfers EDPB Guidance Guidelines 10/2020 on restrictions under Article 23 GDPR EDPB Guidance Guidelines 07/2020 on the concepts of controller and processor in the GDPR EDPB

Full text

The Italian DPA has fined Edison Energia S.p.A. EUR 4.9 million. Several person had filed complaints with the DPA regarding unlawful marketing activities of the company. During its investigation, the DPA found that the company contacted data subjects by telephone for marketing purposes without their consent. For this purpose, the company used contact lists from third parties, which in many cases, however, did not contain the free, specific, informed and documented consent of the users to the disclosure of personal data. The DPA also found that Edison Energia did not provide data subjects with a direct and easy way to exercise their right to object. In addition, Edison Energia failed to respond to data subject requests in a timely manner in several cases. In addition, the DPA found that users of the app and website simultaneously consented to the use of their data for both marketing and profiling purposes. The DPA found that such consent did not correspond to voluntary and specific consent for different purposes. Finally, the DPA found that Edison Energia failed to provide data subjects with transparent information about the processing of their personal data.

Industry: Transportation and Energy

Original document at the source www.garanteprivacy.it

Similar Content