Enforcement · Italian Data Protection Authority (Garante) EN LLM context

Edison Energia S.p.A.: Non-compliance with general data processing principles

The Italian DPA has fined Edison Energia S.p.A.

€4,900,000 Fine

Edison Energia S.p.A.

ITALY

Art. 5 GDPR Art. 6 GDPR Art. 7 GDPR Art. 12 GDPR Art. 21 GDPR Art. 24 GDPR Art. 25 GDPR

Right to Object Personal Data Direct Marketing Marketing Information Provision Modalities and Communication Methods

Dec 15, 2022 Source garanteprivacy.it

Full text 2 findings

Paragraphs carrying a topic or an applied provision show those connections inline

The Italian DPA has fined Edison Energia S.p.A. EUR 4.9 million. Several person had filed complaints with the DPA regarding unlawful marketing activities of the company. During its investigation, the DPA found that the company contacted data subjects by telephone for marketing purposes without their consent. For this purpose, the company used contact lists from third parties, which in many cases, however, did not contain the free, specific, informed and documented consent of the users to the disclosure of personal data. The DPA also found that Edison Energia did not provide data subjects with a direct and easy way to exercise their right to object. In addition, Edison Energia failed to respond to data subject requests in a timely manner in several cases. In addition, the DPA found that users of the app and website simultaneously consented to the use of their data for both marketing and profiling purposes.

Right to Object Personal Data Marketing

The DPA found that such consent did not correspond to voluntary and specific consent for different purposes. Finally, the DPA found that Edison Energia failed to provide data subjects with transparent information about the processing of their personal data. GDPR Articles: Art. 5 (1) a) GDPR, Art. 5 (2) GDPR, Art. 6 GDPR, Art. 7 GDPR, Art. 12 (1), (2), (3) GDPR, Art. 21 (2) GDPR, Art. 24 (1), (2) GDPR, Art. 25 (1) GDPR Industry: Transportation and Energy

Personal Data Information Provision Modalities and Communication Methods Consent applies Art. 5(1)Art. 5(2)Art. 12(1)Art. 21(2)

How it connects

2 of 2 paragraphs apply legislation or carry a topic — see them in the full text ↓

References

All 13

Related across sources

C-154/21 RW v Österreichische Post AG The Court of Justice of the European Union (First Chamber), in response to a preliminary reference from the Oberster Gerichtshof (Austrian Supreme Court), interpreted Article… First Chamber Jan 12, 2023 Right of Access Personal Data Recipient

C-203/22 CK v Magistrat der Stadt Wien In Case C-203/22, the Court of Justice of the European Union interpreted Article 15(1)(h) of the GDPR in response to a preliminary ruling from the Verwaltungsgericht Wien… First Chamber Feb 27, 2025 Profiling Automated Decision-Making Marketing

HvJ EU 9 januari 2025, C‑394/23 (Mousse) Artikelen: 5(1)(c), 6(1), en 21 AVG Onderwerp : Beginsel van minimale gegevensverwerking Gek genoeg verwijst het HvJ EU zelf niet naar HvJ EU 1 augustus 2022, C‑184/20… HvJ EU 9 januari 2025, C‑394/23 (Mousse). Jan 9, 2025 IP Address Retention Period Identification

C-487/21 Österreichische Datenschutzbehörde v CRIF C-487/21 (Österreichische Datenschutzbehörde) Oct 26, 2023 Right of Access Right to Restriction Personal Data

C-507/17 Google LLC v CNIL C-507/17 (Google Territorial Scope) Sep 24, 2019 Territorial scope (GDPR) Right to be Forgotten Direct Marketing

C-579/21 Proceedings brought by J.M In Case C-579/21, the Court of Justice of the European Union ruled on a preliminary reference from the Itä-Suomen hallinto-oikeus (Administrative Court of Eastern Finland)… First Chamber Jun 22, 2023 Right of Access Personal Data Right to Restriction