Enforcement · Italian Data Protection Authority (Garante) EN LLM context A cited markdown file you can paste into your AI assistant (ChatGPT, Claude, a RAG or project knowledge base) to ground it in this document. Contains: this document’s text, its sections with their topics, and the full text of every law provision it applies. Everything links back to its source on overview.legal — legal information, not advice.

Hera Comm S.p.A.: Non-compliance with general data processing principles

€5,000,000 Fine
Hera Comm S.p.A.
ITALY
Art. 5 GDPR Art. 12 GDPR Art. 15 GDPR Art. 24 GDPR Art. 28 GDPR Art. 32 GDPR
Data Subject Rights Exercise Modalities and Procedures IP Address Processing Agreement Controllers Security Personal Data Privacy by Design & Default Authority Powers for Fundamental Rights Protection
Jul 17, 2024 Source

How it connects

Related across sources

Guidance Guidelines 07/2022 on certification as a tool for transfers EDPB Case Law Data Protection Commissioner v Facebook Ireland and Maximillian Schrems CJEU Guidance Guidelines 10/2020 on restrictions under Article 23 GDPR EDPB Guidance Guidelines 07/2020 on the concepts of controller and processor in the GDPR EDPB Guidance Guidelines 4/2019 on Article 25 Data Protection by Design and by Default Version 2.0 Adopted on 20 October 2020 EDPB Case Law HvJ EU: Privacy Shield ongeldig verklaard (Schrems II) Hof van Justitie EU

Full text

The Italian DPA has imposed a fine of EUR 5 million on Hera Comm S.p.A. The investigation was launched following numerous complaints. The energy supplier had failed to take adequate protective measures, allowing door-to-door agents to unlawfully conclude electricity and gas contracts in the name of unsuspecting customers. Many data subjects only discovered the activation of new contracts when they received bills or notifications, despite never having given their consent. The door-to-door agents involved had collected customer information, for example by photographing ID documents, and unlawfully used it to conclude contracts with fake signatures. During its investigation, the DPA found that the company had failed to implement adequate technical and organizational measures to prevent the unlawful use of customer data by door-to-door agents. Additionally, the DPA found that the controller failed to respond to data subject rights requests in a timely manner.

Industry: Transportation and Energy

Original document at the source www.garanteprivacy.it

Similar Content