Garante per la protezione dei dati personali (Italy) - 10238270
From GDPRhub
| Garante per la protezione dei dati personali - 10238270 | |
|---|---|
 | |
| Authority: | Garante per la protezione dei dati personali (Italy) |
| Jurisdiction: | Italy |
| Relevant Law: | Article 5(1)(a) GDPR Article 6(1) GDPR |
| Type: | Complaint |
| Outcome: | Upheld |
| Started: | 19.03.2024 |
| Decided: | 26.03.2026 |
| Published: | |
| Fine: | 96,000 EUR |
| Parties: | Eni S.p.a. Greenpeace Onlus |
| National Case Number/Name: | 10238270 |
| European Case Law Identifier: | n/a |
| Appeal: | Unknown |
| Original Language(s): | Italian |
| Original Source: | GPDP (in IT) |
| Initial Contributor: | carloc |
The DPA fined an energy provider €96,000 for unlawfully publishing on its website the personal data of the plaintiffs involved in a lawsuit against the company's alleged non-compliance with environmental legislation.
English Summary
Facts
In 2023 two NGOs and twelve individuals (the data subjects) filed a lawsuit against, among others, energy corporation Eni S.p.a. (the controller) over the alleged non-compliance with environmental legislation. The controller later published the statement of claims on its website, including the names, personal details, and social security numbers of the data subjects.
In response, the data subjects and one of the NGOs (Greenpeace) filed complaints with the DPA, claiming that their names were unlawfully published.
The controller later redacted the subject's data from the document available on its website and claimed that the publication was due to a human error.
In its defense, the controller also claimed that, given the media attention drawn by the lawsuit, it had a legitimate interest to both defend its public image and clarify the exact content of the lawsuit it was facing.
The controller also pointed out that some of the data it published was already publicly available and that the data subjects themselves had made it publicly known to the media that they were the claimants in its lawsuit. On these grounds, the controller argued that the data could be published.
Holding
The DPA first rejected the argument that the data were publicly available information. In this regard, the DPA noted that while some of the data subjects had publicly spoken about their lawsuit, they had never made their addresses and social security codes public. Furthermore, the DPA clarified that even publicly available data requires a legal basis for processing.
The DPA then held that the processing of the data was not justified by the controller’s legitimate interest for two reasons. First, the processing was not necessary, as the controller could have pursued its interest by publishing a redacted copy of the statement of claims. Second, the data subjects’ rights and freedoms outweighed the controller’s interest in the case at hand.
On these grounds, the DPA found a violation of Articles 5(1)(a) and 6(1) GDPR and fined the controller €96,000.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Italian original. Please refer to the Italian original for more details.
SEE ALSO Newsletter of April 15, 2026 [web doc. no. 10238270] Measure of March 26, 2026 Register of Measures No. 207 of March 26, 2026 THE ITALIAN DATA PROTECTION AUTHORITY IN today's meeting, attended by Professor Pasquale Stanzione, President, Professor Ginevra Cerrina Feroni, Vice President, Dr. Agostino Ghiglia, Members, and Dr. Luigi Montuori, Secretary General; HAVING REGARD TO Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (hereinafter the "Regulation"); HAVING REGARD TO Legislative Decree No. 207 of June 30, 2003 196 (Personal Data Protection Code, hereinafter the "Code"), as amended by Legislative Decree No. 101 of August 10, 2018, containing "Provisions for the adaptation of national legislation to the provisions of Regulation (EU) 2016/679"; HAVING SEEN the report from the "Greenpeace Onlus" Association, submitted on March 19, 2024, complaining of violations of the personal data protection regulations relating to the processing of information concerning certain data subjects by Eni S.p.A. on its website; HAVING EXAMINED the documentation in the file; HAVING SEEN the observations made by the Secretary General pursuant to Article 15 of the Guarantor's Regulation No. 1/2000; REPORTER: Professor Ginevra Cerrina Feroni; WHEREAS 1. The report against the Company and the investigation. Reference is made to the report from the "Greenpeace Onlus" Association, submitted to this Authority on March 19, 2024, containing the attached requests from Messrs. XX, XX, XX, XX, XX, XX, XX, XX, XX, XX, XX, XX, XX, XX, XX, XX, XX, XX, in which Greenpeace Onlus complained of certain violations of the personal data protection regulations relating to the processing of information concerning them by Eni S.p.A. (hereinafter "the Company"). Indeed, the aforementioned petition contested—in light of the Company's publication "on its website of a page entirely dedicated to the lawsuit" filed on May 9, 2023, at the Civil Court of Rome by "the organizations Greenpeace Onlus and ReCommon APS and 12 ordinary citizens (...) against Eni S.p.A., the Ministry of Economy and Finance, and Cassa Depositi e Prestiti S.p.A."—the specific circumstance that "on this page, Eni [had] published [the relevant] full summons without obscuring any of the data" identifying the interested parties, including their place and date of birth, tax code, and residential address (see note dated March 19, 2024, page 1). In light of the petitioners' concerns, an investigation was initiated against Eni S.p.A. on July 30, 2024. via a request for information. All of this is intended to obtain useful information regarding the application of the personal data protection regulations to the reported situation, with particular regard to the purposes of the aforementioned processing and the legal grounds for its lawfulness. The Company responded to this request in a letter received on September 23, 2024. A review of the request revealed the following: The publication of the contested personal data occurred following the data subjects' initiation of litigation against the Company—currently pending before the judicial authorities—for an alleged violation of the Paris Climate Agreement. This case falls within the broader framework of so-called climate litigation, "i.e., legal actions aimed at compelling states or companies to comply with certain standards regarding emissions reductions for the purpose of combating climate change." According to Eni S.p.A.'s assertions, these actions often share a strategy implemented by the actors involved, which focuses specifically on the potential media impact of such actions and therefore involves widespread publicity for the disputes in question through various media outlets. This is done with the aim, "on the one hand, of provoking public outcry and indignation [as well as] promoting the initiatives of NGOs and other plaintiffs and, on the other, demonizing the role of large corporations" (i.e., in this case, Eni S.p.A.) in relation to the underlying cause (named, in this case, "La Giusta Causa" by the promoters themselves; see, to this effect, the Company's note dated September 23, 2024, pp. 3-4). From this perspective, "the publication of the [disputed] procedural documents" in a dedicated subsection of the website by Eni S.p.A., in general terms, "is intended to defend [the latter's] position within this media campaign and to allow for the correct presentation of the facts," with the intent, therefore, to "rebalance the communication message to civil society and protect ENI from false narratives" (see the company's statement dated September 23, 2024, page 5); In particular, the aforementioned "publication (...) is intended to defend the Company, both in terms of its image and reputation on the market and with its stakeholders, and in terms of protecting its rights." The Company "also believes that the publication in question is (..) suitable for pursuing a further and widespread legitimate interest, coinciding on the one hand with the interest of public opinion and of the general membership in correct, truthful and transparent information regarding the identity and work of NGOs and activists/promoters, as well as, on the other, in updates on the work of the Judicial Authority in relation to a topic of extreme relevance and collective interest such as climate change". Furthermore, given that, with respect to the processing in question, "there are no risks to the rights and freedoms of the data subjects, both due to the nature of the data and the fact that such data, for the most part, was disseminated by the data subjects themselves and is easily available online or in the press," it follows that "the legal basis for the Processing is therefore to be found in the legitimate interest pursuant to Article 6, paragraph 1, letter (f) of the GDPR" (see the Company's note dated September 23, 2024, pages 6 and 7); It is also noteworthy that the applicants "never sent any prior request to the Company, which therefore became aware of their intention to contest the processing in question only following the request for information sent [by the Authority] on July 30, 2024" (see the Company's note dated September 23, 2024, page 3). Indeed, "with regard to the processing of personal data at issue in the complaint, the private plaintiffs have never exercised their rights against ENI under personal data protection legislation (including, for example, the right to erasure of their personal data pursuant to Article 17 of the GDPR)" (see Company note dated September 23, 2024, page 7). Finally, Eni S.p.A. wished to clarify that, in any case, "the Company had no intention of specifically processing the personal data of the 12 Private Plaintiffs (whose names, in fact, never appear in the comments to the Dispute that ENI published on its website)" (see Company note dated September 23, 2024, page 8). The Authority also stated that, "as evidence of its good faith," the Company "−as soon as (...) it was made aware of the Petition− made available on its website a version of the Summons from which the information regarding the Plaintiffs was omitted" (see the Company's note dated September 23, 2024, page 3). 2. Notification of violations. With the note dated January 21, 2025, the Authority, in initiating formal proceedings against the Company, charged the latter, pursuant to Article 166, paragraph 5, of the Code, with violations of Article 5, paragraph 1, letter a) and Article 6, paragraph 1, of the Regulation. In this regard, the Company submitted its defense briefs on February 14, 2025, clarifying first of all that: - the purpose of the contested processing is strictly related to the need "to protect the Company from the media campaign launched against it." From this perspective, making available to the "public the trial documentation" containing "not only the expert opinions acknowledging the correctness of its conduct, but also additional information relating to the ongoing procedural context" was therefore intended to provide "those who were reached by the aforementioned media campaign" with the tools "to further investigate Eni's version, [also] with a view to ensuring the accuracy and transparency of the facts, [as well as] to defend [the Company] from claims (...) damaging to its reputation." Eni S.p.A. therefore deemed that all of this "could represent a legitimate interest" (see the Company's note dated February 14, 2025, pages 2-4 and 5); - to demonstrate the Company's good faith, in this case, the following circumstances must be taken into consideration: a) "a significant portion of the personal data [in question] had already been made public by the [interested parties] through the website of the NGO Greenpeace." Furthermore, they "directly contributed to the dissemination of information relating to them through interviews given [to certain newspapers]" regarding the ongoing dispute against Eni S.p.A., as well as through their participation in public events on the subject; b) "the applicants never contacted Eni to obtain the removal of their personal data from the website, but rather exclusively and directly to this Authority through the request [referred to in the introduction] (...) submitted (...) through [the intermediary] of Greenpeace"; c) finally, as soon as the Company "became aware of the data subjects' concerns, it immediately remedied the situation by obscuring all personal data [of the 12 actors] published" on its website, also implementing internal "further awareness-raising activities aimed at preventing the recurrence [of similar situations] in the future" (see the Company's note dated February 14, 2025, pages 3-4 and 10); - from all this, it follows that "the alleged violation was absolutely unintended in its purposes and [the underlying processing] was in no way intended to infringe the rights [of the aforementioned] data subjects, but merely 'incidental' to the need to protect the Company from the media campaign launched against it" (see the Company's note dated February 14, 2025, page 4). Without prejudice to the foregoing, Eni S.p.A., in the aforementioned briefs, also sought to clarify the following: - the nature of the disputed information, in this case, "can be defined as 'common'." Furthermore, its publication, on the one hand, concerned a small number of interested parties (12 in total), being limited to "a couple of records for each," and, on the other, refers to information that "had largely already been made available [by the latter]" as it was also disclosed by "Greenpeace on its website through the publication of the trial documents," and as they had expressed their support for the case in various public contexts (see Company note dated February 14, 2025, pages 6-7 and 9); - the scope of the processing "is minimal given that the summons in question was only accessible on an internal page of the Company's website, presumably through a specific search, which could therefore only be found by those genuinely interested in learning more about the matter. This section, in fact, was not even directly accessible from the main web page (...) and no specific media or social media campaign had been launched to highlight it." Furthermore, in the section dedicated to the litigation, which contains the Company's general reconstructions and considerations on the matter, "there is no reference to the identity and personal data of the data subjects, who are simply referred to as 'certain private actors'" (see the Company's note dated February 14, 2025, pages 6 and 9); - regarding the duration of the violation, it "was extremely limited in time and the Company immediately took action to remedy it," involving its Data Protection Officer and promptly removing the personal data relating to the data subjects from its website upon becoming aware of the report; this was "regardless of the definition [of the latter] by the Guarantor or the exercise of the rights of the data subjects themselves" (see Company memo dated February 14, 2025, pp. 7-8). - regarding the subjective nature of Eni S.p.A.'s conduct, "the contested violation is entirely negligent. In fact, Eni had no intention of specifically processing the 12 data subjects" (see Company memo dated February 14, 2025, pp. 7-8). Finally, the Company stated that Eni S.p.A. "is extremely attentive to issues relating to the protection of personal data" and has, in fact, "equipped itself with a comprehensive data protection framework that includes internal policies and procedures aimed at ensuring compliance with the relevant principles by its employees" (see Company memo dated February 14, 2025, pp. 8-9). 3. The Authority's assessments and the outcome of the proceedings. First and foremost, it is stated that, unless the act constitutes a more serious crime, anyone who, in proceedings before the Data Protection Authority, falsely declares or certifies information or circumstances, or produces false records or documents, is liable pursuant to Article 168 of the Code, "False declarations to the Data Protection Authority and interruption of the performance of the duties or exercise of the powers of the Data Protection Authority." Without prejudice to the foregoing, it is noted that, following an examination of the documentation on file and the statements made by the data controller during the proceedings, it emerged that Eni S.p.A. has unlawfully processed the personal data of the data subjects mentioned in the preamble. This is because the aforementioned processing was carried out in violation of the general principles of lawfulness set forth in Article 5, paragraph 1, letter a) of the Regulation, as well as Article 6, paragraph 1 of the Regulation. The unlawful conduct in this case relates to the online dissemination of the personal data of the data subjects contained in the aforementioned summons; this is due to the Company's publication of a full copy of the summons on its website, in a specific section dedicated to the case in question. In this regard, it should be noted, first of all, that the information contained therein included the name, date and place of birth, tax code, and residential address of the data subjects involved in the matter being reported. This information constitutes, for all intents and purposes, the data subject's personal data (see Article 4, No. 1 of the Regulation) and has therefore been disclosed by the data controller through the publication of the aforementioned summons (Article 4, No. 2 of the Regulation). As a preliminary matter, regarding the circumstance, repeatedly raised by the Company, that the identity of the data subjects and their support for the cause were factors that had already been disclosed by them in various public contexts (see above, section 2), it is stated, albeit in general terms, that "the fact that personal data have been manifestly made public does not automatically mean that they can be processed pursuant to Article 6, paragraph 1, letter f), GDPR" (although this aspect constitutes "a factor to be taken into account when carrying out the balancing test"; on this point, see below and cf. the Data Protection Board, hereinafter "EDPB," Guidelines No. 1/2024 on the processing of personal data based on Article 6, paragraph 1, letter f), GDPR, adopted on 8 October 2024, paragraph 43). Without prejudice to the foregoing, what is relevant in this case is that the processing carried out by Eni S.p.A. −through the contested online publication− concerned a variety of personal information attributable to all 12 interested parties, including, in addition to their names, their date and place of birth, tax code, and residential address. And on this point, it is worth noting, among other things, that although "in October 2023, the 12 parties gave their consent for [the aforementioned summons] to be published on the websites of the two organizations Greenpeace Onlus and ReCommon APS," this consent was nevertheless conditioned by the measure "of the blacking out of the personal data of the undersigned parties, [such as] their place and date of birth, tax code, and residential address" (see, in this regard, the Greenpeace Onlus report of March 19, 2024, page 1). Having duly stated this, it is noted that the data controller must process personal data in accordance with Chapter II of the Regulation, which requires compliance, among other things, with the principles set forth in Article 5, paragraph 1, of the Regulation and the lawfulness requirements set forth in Article 6, paragraph 1, of the Regulation. More generally, the data controller is responsible for conducting, when carrying out a personal data processing operation—such as publishing documents containing data concerning a data subject—an in-depth analysis of the principles and lawfulness requirements underlying the processing (Articles 5 and 6 of the Regulation); this is to ensure compliance with the Regulation. As is well known, the processing of personal data must comply with the principles set forth in Article 5 of the Regulation, including "lawfulness, fairness, and transparency," according to which personal data must be "processed lawfully, fairly, and in a transparent manner in relation to the data subject." Furthermore, for processing to be lawful, it must always be based on an appropriate legal basis. This is identified, for so-called "common" data, pursuant to Article 6 of the Regulation, as the data subject's consent "or another legitimate basis laid down by law in this Regulation or in Union or Member State law" (see also Council Regulation 40 of the Regulation). This includes the case where "processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data" (Article 6, paragraph 1, letter f) of the Regulation). With respect to the case at hand, the processing carried out by Eni S.p.A. was therefore found to be unlawful pursuant to Article 5, paragraph 1, letter a) and Article 6 of the Regulation. by publishing the aforementioned summons in full on its website; this is because, in the absence of a suitable legal basis, it led to the disclosure of personal information relating to its subscribers. In this regard, the Company's argument regarding the applicability of the lawfulness requirement set forth in Article 6, paragraph 1, letter f) of the Regulation cannot be accepted. This requirement is attributable to Eni S.p.A.'s legitimate interest in defending its position in the media campaign related to the case in question, and furthermore, in "providing correct, (...) and transparent information [on the facts, including procedural ones] in relation to a topic of extreme relevance and collective interest such as climate change" (see paragraphs 1 and 2 above). As is well known, in order to determine whether the processing of personal data can be based on Article 6, paragraph 1, letter f), of the Regulation, the controller must conduct a careful and complex legal assessment to verify that all the conditions identified by the legislator are met. In this context, the aforementioned assessment must aim, among other things, to ascertain whether the controller needs to process personal data for the purposes of the legitimate interests pursued. The latter, in fact, can rely on this legal basis "only if it has (...) assessed and concluded that the envisaged processing is strictly necessary for the purposes of that legitimate interest and that the interests or fundamental rights and freedoms of the data subject do not prevail" over the aforementioned interest (see, in this regard, EDPB Guidelines No. 1/2024, cited above, paragraph 13). In particular, the assessment of what is "necessary" involves verifying whether, in practice, the legitimate interests pursued cannot reasonably be achieved, equally effectively, by other means that are less restrictive of the data subjects' rights and freedoms. It follows that, if "reasonable alternatives that are equally effective but less intrusive exist, the processing cannot be considered 'necessary'" and, therefore, the latter cannot be based on Article 6, paragraph 1, letter f), of the Regulation (EDPB, Guidelines No. 1/2024, cited in paragraph 29). Indeed, the Court of Justice of the European Union (hereinafter “CJEU”) itself has, on several occasions, underlined that “processing should be carried out «only to the extent strictly necessary» for the purposes of the legitimate interest identified” (see, in this regard, CJEU, judgment of 7 December 2023, joined cases C-26/22 and C-64/22, SCHUFA Holding (Libération de reliquat de dette), paragraph 88; CJEU, judgment of 4 July 2023, case C-252/21, Meta/Bundeskartellamt, paragraph 126) and has at the same time expressly reiterated “that the condition relating to the necessity of the processing must be examined in conjunction with the principle of data minimisation enshrined in Article 5, paragraph 1, letter c), GDPR, according to which personal data must be «adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed»” (see, on this point, EDPB, Guidelines No. 1/2024, cited above, paragraph 29, and the case law cited therein, i.e., ECJ, Case C-252/21, Meta v Bundeskartellamt, cited above, paragraph 109; ECJ, Judgment of 11 December 2019, Case C-708/18, Asociaţia de Proprietari bloc M5A-ScaraA, paragraph 48; ECJ, Judgment of 4 October 2024, Case C-621/22, Koninklijke Nederlandse Lawn Tennisbond, paragraphs 42-43 and 51-52. From an examination of the documents in the case file and the evidence acquired during the investigation, it clearly emerged that a proper analysis by Eni S.p.A.—with respect to the pursuit of the interest it claimed to have underpinned the dissemination of data subjects' data on its website—should have led, if carried out in the manner specified above by the data controller, to the non-applicability of the contested necessity of processing. As evidence of the above, it is noted that Eni S.p.A. itself, during the proceedings, clarified that the publication of the full summons was "merely 'incidental' to the need to protect the Company from the media campaign launched against it" and that "the Company had no intention of specifically processing the personal data of the 12 Private Plaintiffs" (see above, section 2). Furthermore, in the section of the website dedicated to the case—which contains the Company's reconstructions and considerations regarding the ongoing litigation—"there is no reference to the identity or further personal data of the interested parties, who are simply referred to as 'certain private actors'" (see paragraphs 1 and 2 above). Precisely because the Company does not actually need to process the information in question, Eni S.p.A. is perfectly capable of defending its position by adopting other methods aimed at minimizing its use—such as, in this case, the prior obscuring of the plaintiffs' personal data—as well as providing, in the public interest, a complete and transparent overview of the facts surrounding the procedural process in question, so as not to compromise the fundamental rights and freedoms of the data subjects (see, in this regard, also the Provision of the Italian Data Protection Authority dated 26 September 2024, web doc. no. 10071261). Furthermore, in addition to the requirement that the processing be necessary—which, in this case, for the reasons explained above, does not appear to be demonstrated by the documentation—it is also necessary to consider the assessments that the data controller should have made as part of the so-called balancing test that, as required by Article 6, paragraph 1, letter f), of the Regulation, the latter is required to carry out. Indeed, an adequate "weighing of competing interests and rights" (i.e., those of the data controller, on the one hand, and those of the data subject, on the other), which forms the basis of the aforementioned test, depends on the circumstances of the case and "always requires full consideration of a number of factors," including "the impact of the processing on the data subject" (which must also be assessed in relation to the nature of the data to be processed, their accessibility, and the consequences the processing may have), as well as "the data subject's reasonable expectations regarding the processing" (see EDPB, Guidelines No. 1/2024, cited above, p. 2 and paragraphs 31-60; in this regard, see, in particular, CJEU, Case C-252/21, Meta v. Bundeskartellamt, paragraphs 108 and 116). In any case, therefore, the existence of a legitimate interest requires "a careful assessment [by the controller], including whether the data subject may reasonably expect at the time and in the context of the collection of personal data that processing for that purpose may take place" (see EDPB, Guidelines No. 1/2024, cited above, paragraphs 50-54 and also Council Regulation (EC) No. 47 of the Regulation). It follows that such "reasonable" expectations play "an important role in the [abovementioned] balancing test," as they aim to "limit the risk that data subjects will be unduly surprised by the processing or its consequences or implications" (see EDPB, Guidelines No. 1/2024, cited above, p. 2 and paragraph 52). These factors, however, do not appear to have been taken into account by Eni S.p.A. In the case at hand, particularly with regard to, at the very least, additional and different information beyond that (i.e., their names) already made accessible by the same interested parties in various other contexts. Specifically, this concerns the data relating to the "place and (...) date of birth, tax code, and residential address"; these, as is known, are also contained in the summons in question. This is because the applicants could not reasonably expect, based on the context in which such information was collected and the specific circumstances of the case, that it would be further processed by Eni S.p.A. through its publication on the Company's website and for the purposes described. Furthermore, this data – specifically those indicated above – involves personal data whose disclosure, given its strictly confidential nature (for example, residential address) and its significant identifying function (such as tax code, as well as the indication of place and date of birth), may have negative consequences on the rights and freedoms of individuals. The free access to such information via the Internet to a potentially unlimited number of individuals exposes data subjects to potential risks to their privacy, both in terms of their personal security and peace of mind, and in terms of the potential unlawful use of such personal data by third parties (regarding the particularly sensitive nature of such information and the risks arising from its dissemination, see EDPB, Guidelines 1/2024, paragraph 41; but also, with regard to the residential address, the Provision of the Italian Data Protection Authority of 9 October 2025, web doc. no. 10192784; and, with regard to the tax code, the Guidelines on the processing of personal data, including those contained in administrative records and documents, carried out for purposes of advertising and transparency on the web by public bodies and other obligated entities, adopted by the Italian Data Protection Authority on 15 May 2014, web doc. no. 3134436). From all of the above, it follows that Eni S.p.A. failed, in this case, to effectively and fully weigh the competing interests at stake, failing to take due account of the legitimate expectations of the data subjects, as well as the impact that the processing in question could have on them. For all of the reasons stated above, the legal basis of legitimate interest cannot be applied in the case at hand, as the conditions set out in Article 6, paragraph 1, letter f) of the Regulation, as also cited by the CJEU, are not met. The latter has, in fact, clarified that "this provision establishes three cumulative conditions for the processing of personal data it covers to be lawful, namely, first, the pursuit of a legitimate interest of the data controller or a third party; second, the necessity of processing the personal data for the purposes of the legitimate interest pursued; and, third, the condition that the interests or fundamental rights and freedoms of the data subject do not prevail over the legitimate interests of the data controller or a third party" (see ECJ, Case C-252/21, Meta v. Bundeskartellamt, paragraph 106). Therefore, given that the aforementioned lawfulness requirement does not apply to the case at hand, and since no other lawfulness requirement exists to justify, in this case, the online dissemination of data by the Company, the processing of the data subjects' data referred to in the preamble was carried out by Eni S.p.A. in violation of Article 13 of the GDPR. 6, paragraph 1 of the Regulation and in conflict with the aforementioned general principles of lawfulness referred to in art. 5, paragraph 1, letter a) of the Regulation. 4. Conclusions: Declaration of unlawful processing. In light of the findings, the Authority believes that the statements, documentation, and reconstructions provided by the data controller during the investigation do not address the concerns notified by the Office in the initiation of the proceedings and are therefore not suitable for dismissing the present proceedings. Furthermore, none of the cases provided for in Article 11 of the Garante Regulation No. 1/2019 apply. The processing of personal data carried out by Eni S.p.A. is, in fact, unlawful, in the terms set out above, with reference to the violation of Article 5, paragraph 1, letter a), and Article 6, paragraph 1, of the Regulation. Furthermore, given the fact that the Company has, during the proceedings, ceased all processing of data subjects' data on its website, it is believed that, at this stage, the conditions for the adoption of further corrective measures pursuant to Article 58, paragraph 2 of the Regulation are not met. 5. Adoption of the injunction order for the application of the administrative pecuniary sanction and additional sanctions (Articles 58, paragraph 2, letter i), and 83 of the Regulation; Article 166, paragraph 7, of the Code). The Guarantor, pursuant to Article 58, paragraph 2, letter i) of the Regulation and Article 166 of the Code, has the power to impose an administrative pecuniary sanction pursuant to Article 58, paragraph 2, letter i), of the Regulation and Article 166 of the Code. 83 of the Regulation, by issuing an injunction (Article 18 of Law No. 689 of 24 November 1981) in relation to the processing of personal data carried out by Eni S.p.A., which has been found to be unlawful, in the terms set out. Violation of the above provisions entails the application of the administrative sanction provided for in Article 83, paragraph 5, letter a), of the Regulation. We believe it is appropriate to apply Article 83, paragraph 3 of the Regulation, which provides that "if, in relation to the same or linked processing operations, a controller […] infringes, intentionally or negligently, several provisions of this Regulation, the total amount of the administrative fine shall not exceed the amount specified for the most serious infringement." The total amount of the fine is calculated so as not to exceed the maximum fine provided for in the same Article 83, paragraph 5 of the Regulation. With reference to the elements listed in Article 83, paragraph 3 of the Regulation, 83, paragraph 2 of the Regulation for the purposes of applying the administrative pecuniary sanction and its quantification, taking into account that the sanction must be "effective, proportionate and dissuasive in each individual case" (Article 83, paragraph 1 of the Regulation), it is noted that, in the case under consideration, the following circumstances were taken into account: - pursuant to Article 83, paragraph 2, letters a) and g) of the Regulation, the nature of the violation, given that the publication of the summons in question led to the online dissemination of the plaintiffs' personal data, in the absence of a valid basis for legitimacy, its duration (the dissemination having occurred over a moderate period of time, likely not exceeding 6 months), the number of data subjects involved (12 in total), as well as the type of information subject to the violation, which, although not classified as data belonging to the special categories referred to in Article 9 of the Regulation, has a particular private nature as highlighted in paragraph 1. 3 of this decision (see Article 83, paragraph 2, letter g), of the Regulation). In favor of the infringer, consideration is given to the fact that, at least, the names of the plaintiffs were shared on the websites of the two organizations, Greenpeace Onlus and ReCommon APS, and that a large portion of the identities of the interested parties had been disclosed by them in the context of various initiatives undertaken by the latter in various public contexts, with reference to the cause referred to in the contested summons; - the negligent nature of the violation and the moderate degree of liability of the data controller (Article 83, paragraph 2, letters b) and d) of the Regulation), given first and foremost that − as indicated in the statements obtained during the investigation − the violation was "incidental" in that there was no actual intent on the part of Eni S.p.A. to implement specific processing of the data contained in the published summons, but rather to make information regarding the ongoing legal proceedings available to the public, so that those affected by the media campaign related to the so-called "Just Cause" would have the tools to further investigate the Company's position and obtain a complete picture of the facts. The manner in which this publication was carried out is also relevant, given that the section of the website—which contains the Company's reconstructions and considerations regarding the dispute in question—contains no reference to the identity or other personal data of the data subjects, and that the aforementioned summons, which instead contains the applicants' data, "was accessible only on an internal page thereof, likely through a specific search that could be traced" (see Company note dated February 14, 2025, pages 6 and 9); - the aforementioned actions, spontaneously initiated by Eni S.p.A. prior to notification of a breach, to bring the processing into compliance with the Regulation and repair the damage suffered by the data subjects, given that the latter promptly and proactively remedied the breach raised once it became aware of it following the submission by the Authority of the aforementioned report (see Article 83, paragraph 2, letter c) of the Regulation); - the fact that the Company cooperated with the Authority during the proceedings (Article 83, paragraph 2, letter f) of the Regulation) and the absence of previous relevant breaches against it (Article 83, paragraph 2, letter e) of the Regulation). Finally, the Company's stated initiatives, particularly those aimed at raising awareness among its staff, aimed at preventing the recurrence of situations similar to the one being contested, were also taken into account in favor of the offender (Article 83, paragraph 2, letter k) of the Regulations) to prevent the recurrence of situations similar to the one being contested (see, in this regard, note dated February 14, 2025, page 10). Furthermore, it is noted that, in this specific case, due to the aforementioned principles of effectiveness, proportionality, and dissuasiveness to which the Authority must adhere in determining the amount of the fine (Article 83, paragraph 1, of the Regulations), the offender's financial circumstances, determined on the basis of the Company's turnover, as reported in the financial statements for 2024 (the latest available), are relevant. In light of the above elements and the assessments made in this specific case, the following provisions apply to Eni S.p.A.: the administrative sanction of the payment of a sum equal to €96,000.00 (ninety-six thousand). It is also considered that, pursuant to Article 166, paragraph 7, of the Code and Article 16, paragraph 1, of the Italian Data Protection Authority Regulation No. 1/2019, this chapter containing the injunction order should be published on the Italian Data Protection Authority's website. This is in consideration of the fact that, as highlighted above, the publication resulted in the online dissemination of personal data identifying the data subjects without any lawful basis. Finally, it is noted that the conditions set forth in Article 17 of the Italian Data Protection Authority Regulation No. 1/2019 concerning internal procedures with external relevance, aimed at carrying out the tasks and exercising the powers delegated to the Italian Data Protection Authority, are met. NOW CONSIDERING ALL THE FOREGOING, THE ITALIAN DATA PROTECTION AUTHORITY pursuant to Article 57, paragraph 1, letter f) of the Regulation, declares the unlawfulness of the processing carried out by Eni S.p.A., with registered office in Rome (RM), VAT no. 00905811006, within the terms set out in the grounds, for violation of Article 5, paragraph 1, letter a) and Article 6, paragraph 1, of the Regulation; ORDERS Eni S.p.A., pursuant to Article 58, paragraph 2, letter i) of the GDPR, to pay the sum of €96,000.00 (ninety-six thousand.00) as an administrative fine for the violations indicated in this order. ORDERS pursuant to Article 58, paragraph 2, letter i) of the GDPR, i) of the Regulations, to the same Company, to pay the sum of €96,000.00 (ninety-six thousand.00) as an administrative fine for the violations indicated in this order, according to the procedures illustrated in the attachment, within thirty days of notification of this order, under penalty of the adoption of the subsequent enforcement proceedings pursuant to Article 27 of Law No. 689/1981. It is hereby stated that, pursuant to Article 166, paragraph 8 of the Code, the violator retains the right to settle the dispute by paying an amount equal to half of the fine imposed within the deadline set forth in Article 10, paragraph 3, of Legislative Decree No. 150 of September 1, 2011, provided for filing an appeal as indicated below; ORDERS - pursuant to Article 166, paragraph 7, of the Code and Article 16, paragraph 1, of the Regulation of the Data Protection Authority No. 1/2019, the publication of the injunction order on the website of the Data Protection Authority; - pursuant to Article 154-bis, paragraph 3, of the Code and Article 37 of the Regulation of the Data Protection Authority No. 1/2019, the publication of this provision on the website of the Data Protection Authority; - pursuant to Article 17 of Regulation No. 1/2019, the recording of the violations and measures adopted pursuant to Article 58, paragraph 2, of the Regulation, in the internal register of the Authority provided for by Article 57, paragraph 1, letter u) of the Regulation. Pursuant to Article 78 of Regulation (EU) 2016/679, as well as Articles 152 of the Code and Article 10 of Legislative Decree No. 1 of September 1, 2011. 150, an appeal against this provision may be lodged with the ordinary judicial authority, with an appeal filed with the ordinary court of the place identified in the same Article 10, within thirty days from the date of notification of the provision itself, or sixty days if the appellant resides abroad. Rome, March 26, 2026 THE PRESIDENT Stanzione THE REPORTER Cerrina Feroni THE SECRETARY GENERAL Montuori SEE ALSO Newsletter of April 15, 2026 [web doc. no. 10238270] Measure of March 26, 2026 Register of Measures no. 207 of March 26, 2026 THE DATA PROTECTION AUTHORITY IN today's meeting, attended by Professor Pasquale Stanzione, President, Professor Ginevra Cerrina Feroni, Vice President, and Dr. Agostino Ghiglia, members, and Dr. Luigi Montuori, Secretary General; HAVING SEEN Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (hereinafter the "Regulation"); HAVING SEEN Legislative Decree No. 196 of 30 June 2003 (Personal Data Protection Code, hereinafter the "Code"), as amended by Legislative Decree No. 101 of 10 August 2018, containing "Provisions for the adaptation of national legislation to the provisions of Regulation (EU) 2016/679"; HAVING SEEN the report from the "Greenpeace Onlus" Association, submitted on 19 March 2024, complaining of violations of the personal data protection regulations relating to the processing of information concerning certain data subjects by Eni S.p.A. on its website; HAVING EXAMINED the documentation in the file; HAVING SEEN the observations made by the Secretary General pursuant to Article 15 of the Italian Data Protection Authority's Regulation No. 1/2000; REPORTER: Professor Ginevra Cerrina Feroni; WHEREAS 1. The complaint against the Company and the investigation. Reference is made to the complaint from the "Greenpeace Onlus" Association, submitted to this Authority on March 19, 2024, containing the attached requests from Messrs. XX, ... Indeed, the aforementioned petition contested—in light of the Company's publication "on its website of a page entirely dedicated to the lawsuit" filed on May 9, 2023, at the Civil Court of Rome by "the organizations Greenpeace Onlus and ReCommon APS and 12 ordinary citizens (...) against Eni S.p.A., the Ministry of Economy and Finance, and Cassa Depositi e Prestiti S.p.A."—the specific circumstance that "on this page, Eni [had] published [the relevant] full summons without obscuring any of the data" identifying the interested parties, including their place and date of birth, tax code, and residential address (see note dated March 19, 2024, page 1). In light of the petitioners' concerns, an investigation was initiated against Eni S.p.A. on July 30, 2024. via a request for information. All of this is intended to obtain useful information regarding the application of the personal data protection regulations to the reported situation, with particular regard to the purposes of the aforementioned processing and the legal grounds for its lawfulness. The Company responded to this request in a letter received on September 23, 2024. A review of the request revealed the following: The publication of the contested personal data occurred following the data subjects' initiation of litigation against the Company—currently pending before the judicial authorities—for an alleged violation of the Paris Climate Agreement. This case falls within the broader framework of so-called climate litigation, "i.e., legal actions aimed at compelling states or companies to comply with certain standards regarding emissions reductions for the purpose of combating climate change." According to Eni S.p.A.'s assertions, these actions often share a strategy implemented by the actors involved, which focuses specifically on the potential media impact of such actions and therefore involves widespread publicity for the disputes in question through various media outlets. This is done with the aim, "on the one hand, of provoking public outcry and indignation [as well as] promoting the initiatives of NGOs and other plaintiffs and, on the other, demonizing the role of large corporations" (i.e., in this case, Eni S.p.A.) in relation to the underlying cause (named, in this case, "La Giusta Causa" by the promoters themselves; see, to this effect, the Company's note dated September 23, 2024, pp. 3-4). From this perspective, "the publication of the [disputed] procedural documents" in a dedicated subsection of the website by Eni S.p.A., in general terms, "is intended to defend [the latter's] position within this media campaign and to allow for the correct presentation of the facts," with the intent, therefore, to "rebalance the communication message to civil society and protect ENI from false narratives" (see the company's statement dated September 23, 2024, page 5); In particular, the aforementioned "publication (...) is intended to defend the Company, both in terms of its image and reputation on the market and with its stakeholders, and in terms of protecting its rights." The Company "also believes that the publication in question is (..) suitable for pursuing a further and widespread legitimate interest, coinciding on the one hand with the interest of public opinion and of the general membership in correct, truthful and transparent information regarding the identity and work of NGOs and activists/promoters, as well as, on the other, in updates on the work of the Judicial Authority in relation to a topic of extreme relevance and collective interest such as climate change". Furthermore, given that, with respect to the processing in question, "there are no risks to the rights and freedoms of the data subjects, both due to the nature of the data and the fact that such data, for the most part, was disseminated by the data subjects themselves and is easily available online or in the press," it follows that "the legal basis for the Processing is therefore to be found in the legitimate interest pursuant to Article 6, paragraph 1, letter (f) of the GDPR" (see the Company's note dated September 23, 2024, pages 6 and 7); It is also noteworthy that the applicants "never sent any prior request to the Company, which therefore became aware of their intention to contest the processing in question only following the request for information sent [by the Authority] on July 30, 2024" (see the Company's note dated September 23, 2024, page 3). Indeed, "with regard to the processing of personal data at issue in the complaint, the private plaintiffs have never exercised their rights against ENI under personal data protection legislation (including, for example, the right to erasure of their personal data pursuant to Article 17 of the GDPR)" (see Company note dated September 23, 2024, page 7). Finally, Eni S.p.A. wished to clarify that, in any case, "the Company had no intention of specifically processing the personal data of the 12 Private Plaintiffs (whose names, in fact, never appear in the comments to the Dispute that ENI published on its website)" (see Company note dated September 23, 2024, page 8). The Authority also stated that, "as evidence of its good faith," the Company "−as soon as (...) it was made aware of the Petition− made available on its website a version of the Summons from which the information regarding the Plaintiffs was omitted" (see the Company's note dated September 23, 2024, page 3). 2. Notification of violations. With the note dated January 21, 2025, the Authority, in initiating formal proceedings against the Company, charged the latter, pursuant to Article 166, paragraph 5, of the Code, with violations of Article 5, paragraph 1, letter a) and Article 6, paragraph 1, of the Regulation. In this regard, the Company submitted its defense briefs on February 14, 2025, clarifying first of all that: - the purpose of the contested processing is strictly related to the need "to protect the Company from the media campaign launched against it." From this perspective, making available to the "public the trial documentation" containing "not only the expert opinions acknowledging the correctness of its conduct, but also additional information relating to the ongoing procedural context" was therefore intended to provide "those who were reached by the aforementioned media campaign" with the tools "to further investigate Eni's version, [also] with a view to ensuring the accuracy and transparency of the facts, [as well as] to defend [the Company] from claims (...) damaging to its reputation." Eni S.p.A. therefore deemed that all of this "could represent a legitimate interest" (see the Company's note dated February 14, 2025, pages 2-4 and 5); - to demonstrate the Company's good faith, in this case, the following circumstances must be taken into consideration: a) "a significant portion of the personal data [in question] had already been made public by the [interested parties] through the website of the NGO Greenpeace." Furthermore, they "directly contributed to the dissemination of information relating to them through interviews given [to certain newspapers]" regarding the ongoing dispute against Eni S.p.A., as well as through their participation in public events on the subject; b) "the applicants never contacted Eni to obtain the removal of their personal data from the website, but rather exclusively and directly to this Authority through the request [referred to in the introduction] (...) submitted (...) through [the intermediary] of Greenpeace"; c) finally, as soon as the Company "became aware of the data subjects' concerns, it immediately remedied the situation by obscuring all personal data [of the 12 actors] published" on its website, also implementing internal "further awareness-raising activities aimed at preventing the recurrence [of similar situations] in the future" (see the Company's note dated February 14, 2025, pages 3-4 and 10); - from all this, it follows that "the alleged violation was absolutely unintended in its purposes and [the underlying processing] was in no way intended to infringe the rights [of the aforementioned] data subjects, but merely 'incidental' to the need to protect the Company from the media campaign launched against it" (see the Company's note dated February 14, 2025, page 4). Without prejudice to the foregoing, Eni S.p.A., in the aforementioned briefs, also sought to clarify the following: - the nature of the disputed information, in this case, "can be defined as 'common'." Furthermore, its publication, on the one hand, concerned a small number of interested parties (12 in total), being limited to "a couple of records for each," and, on the other, refers to information that "had largely already been made available [by the latter]" as it was also disclosed by "Greenpeace on its website through the publication of the trial documents," and as they had expressed their support for the case in various public contexts (see Company note dated February 14, 2025, pages 6-7 and 9); - the scope of the processing "is minimal given that the summons in question was only accessible on an internal page of the Company's website, presumably through a specific search, which could therefore only be found by those genuinely interested in learning more about the matter. This section, in fact, was not even directly accessible from the main web page (...) and no specific media or social media campaign had been launched to highlight it." Furthermore, in the section dedicated to the litigation, which contains the Company's general reconstructions and considerations on the matter, "there is no reference to the identity and personal data of the data subjects, who are simply referred to as 'certain private actors'" (see the Company's note dated February 14, 2025, pages 6 and 9); - regarding the duration of the violation, it "was extremely limited in time and the Company immediately took action to remedy it," involving its Data Protection Officer and promptly removing the personal data relating to the data subjects from its website upon becoming aware of the report; this was "regardless of the definition [of the latter] by the Guarantor or the exercise of the rights of the data subjects themselves" (see Company memo dated February 14, 2025, pp. 7-8). - regarding the subjective nature of Eni S.p.A.'s conduct, "the contested violation is entirely negligent. In fact, Eni had no intention of specifically processing the 12 data subjects" (see Company memo dated February 14, 2025, pp. 7-8). Finally, the Company stated that Eni S.p.A. "is extremely attentive to issues relating to the protection of personal data" and has, in fact, "equipped itself with a comprehensive data protection framework that includes internal policies and procedures aimed at ensuring compliance with the relevant principles by its employees" (see Company memo dated February 14, 2025, pp. 8-9). 3. The Authority's assessments and the outcome of the proceedings. First and foremost, it is stated that, unless the act constitutes a more serious crime, anyone who, in proceedings before the Data Protection Authority, falsely declares or certifies information or circumstances, or produces false records or documents, is liable pursuant to Article 168 of the Code, "False declarations to the Data Protection Authority and interruption of the performance of the duties or exercise of the powers of the Data Protection Authority." Without prejudice to the foregoing, it is noted that, following an examination of the documentation on file and the statements made by the data controller during the proceedings, it emerged that Eni S.p.A. has unlawfully processed the personal data of the data subjects mentioned in the preamble. This is because the aforementioned processing was carried out in violation of the general principles of lawfulness set forth in Article 5, paragraph 1, letter a) of the Regulation, as well as Article 6, paragraph 1 of the Regulation. The unlawful conduct in this case relates to the online dissemination of the personal data of the data subjects contained in the aforementioned summons; this is due to the Company's publication of a full copy of the summons on its website, in a specific section dedicated to the case in question. In this regard, it should be noted, first of all, that the information contained therein included the name, date and place of birth, tax code, and residential address of the data subjects involved in the matter being reported. This information constitutes, for all intents and purposes, the data subject's personal data (see Article 4, No. 1 of the Regulation) and has therefore been disclosed by the data controller through the publication of the aforementioned summons (Article 4, No. 2 of the Regulation). As a preliminary matter, regarding the circumstance, repeatedly raised by the Company, that the identity of the data subjects and their support for the cause were factors that had already been disclosed by them in various public contexts (see above, section 2), it is stated, albeit in general terms, that "the fact that personal data have been manifestly made public does not automatically mean that they can be processed pursuant to Article 6, paragraph 1, letter f), GDPR" (although this aspect constitutes "a factor to be taken into account when carrying out the balancing test"; on this point, see below and cf. the Data Protection Board, hereinafter "EDPB," Guidelines No. 1/2024 on the processing of personal data based on Article 6, paragraph 1, letter f), GDPR, adopted on 8 October 2024, paragraph 43). Without prejudice to the foregoing, what is relevant in this case is that the processing carried out by Eni S.p.A. −through the contested online publication− concerned a variety of personal information attributable to all 12 interested parties, including, in addition to their names, their date and place of birth, tax code, and residential address. And on this point, it is worth noting, among other things, that although "in October 2023, the 12 parties gave their consent for [the aforementioned summons] to be published on the websites of the two organizations Greenpeace Onlus and ReCommon APS," this consent was nevertheless conditioned by the measure "of the blacking out of the personal data of the undersigned parties, [such as] their place and date of birth, tax code, and residential address" (see, in this regard, the Greenpeace Onlus report of March 19, 2024, page 1). Having duly stated this, it is noted that the data controller must process personal data in accordance with Chapter II of the Regulation, which requires compliance, among other things, with the principles set forth in Article 5, paragraph 1, of the Regulation and the lawfulness requirements set forth in Article 6, paragraph 1, of the Regulation. More generally, the data controller is responsible for conducting, when carrying out a personal data processing operation—such as publishing documents containing data concerning a data subject—an in-depth analysis of the principles and lawfulness requirements underlying the processing (Articles 5 and 6 of the Regulation); this is to ensure compliance with the Regulation. As is well known, the processing of personal data must comply with the principles set forth in Article 5 of the Regulation, including "lawfulness, fairness, and transparency," according to which personal data must be "processed lawfully, fairly, and in a transparent manner in relation to the data subject." Furthermore, for processing to be lawful, it must always be based on an appropriate legal basis. This is identified, for so-called "common" data, pursuant to Article 6 of the Regulation, as the data subject's consent "or another legitimate basis laid down by law in this Regulation or in Union or Member State law" (see also Council Regulation 40 of the Regulation). This includes the case where "processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data" (Article 6, paragraph 1, letter f) of the Regulation). With respect to the case at hand, the processing carried out by Eni S.p.A. was therefore found to be unlawful pursuant to Article 5, paragraph 1, letter a) and Article 6 of the Regulation. by publishing the aforementioned summons in full on its website; this is because, in the absence of a suitable legal basis, it led to the disclosure of personal information relating to its subscribers. In this regard, the Company's argument regarding the applicability of the lawfulness requirement set forth in Article 6, paragraph 1, letter f) of the Regulation cannot be accepted. This requirement is attributable to Eni S.p.A.'s legitimate interest in defending its position in the media campaign related to the case in question, and furthermore, in "providing correct, (...) and transparent information [on the facts, including procedural ones] in relation to a topic of extreme relevance and collective interest such as climate change" (see paragraphs 1 and 2 above). As is well known, in order to determine whether the processing of personal data can be based on Article 6, paragraph 1, letter f), of the Regulation, the controller must conduct a careful and complex legal assessment to verify that all the conditions identified by the legislator are met. In this context, the aforementioned assessment must aim, among other things, to ascertain whether the controller needs to process personal data for the purposes of the legitimate interests pursued. The latter, in fact, can rely on this legal basis "only if it has (...) assessed and concluded that the envisaged processing is strictly necessary for the purposes of that legitimate interest and that the interests or fundamental rights and freedoms of the data subject do not prevail" over the aforementioned interest (see, in this regard, EDPB Guidelines No. 1/2024, cited above, paragraph 13). In particular, the assessment of what is "necessary" involves verifying whether, in practice, the legitimate interests pursued cannot reasonably be achieved, equally effectively, by other means that are less restrictive of the data subjects' rights and freedoms. It follows that, if "reasonable alternatives that are equally effective but less intrusive exist, the processing cannot be considered 'necessary'" and, therefore, the latter cannot be based on Article 6, paragraph 1, letter f), of the Regulation (EDPB, Guidelines No. 1/2024, cited in paragraph 29). Indeed, the Court of Justice of the European Union (hereinafter “CJEU”) itself has, on several occasions, underlined that “processing should be carried out «only to the extent strictly necessary» for the purposes of the legitimate interest identified” (see, in this regard, CJEU, judgment of 7 December 2023, joined cases C-26/22 and C-64/22, SCHUFA Holding (Libération de reliquat de dette), paragraph 88; CJEU, judgment of 4 July 2023, case C-252/21, Meta/Bundeskartellamt, paragraph 126) and has at the same time expressly reiterated “that the condition relating to the necessity of the processing must be examined in conjunction with the principle of data minimisation enshrined in Article 5, paragraph 1, letter c), GDPR, according to which personal data must be «adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed»” (see, on this point, EDPB, Guidelines No. 1/2024, cited above, paragraph 29, and the case law cited therein, i.e., ECJ, Case C-252/21, Meta v Bundeskartellamt, cited above, paragraph 109; ECJ, Judgment of 11 December 2019, Case C-708/18, Asociaţia de Proprietari bloc M5A-ScaraA, paragraph 48; ECJ, Judgment of 4 October 2024, Case C-621/22, Koninklijke Nederlandse Lawn Tennisbond, paragraphs 42-43 and 51-52. From an examination of the documents in the case file and the evidence acquired during the investigation, it clearly emerged that a proper analysis by Eni S.p.A.—with respect to the pursuit of the interest it claimed to have underpinned the dissemination of data subjects' data on its website—should have led, if carried out in the manner specified above by the data controller, to the non-applicability of the contested necessity of processing. As evidence of the above, it is noted that Eni S.p.A. itself, during the proceedings, clarified that the publication of the full summons was "merely 'incidental' to the need to protect the Company from the media campaign launched against it" and that "the Company had no intention of specifically processing the personal data of the 12 Private Plaintiffs" (see above, section 2). Furthermore, in the section of the website dedicated to the case—which contains the Company's reconstructions and considerations regarding the ongoing litigation—"there is no reference to the identity or further personal data of the interested parties, who are simply referred to as 'certain private actors'" (see paragraphs 1 and 2 above). Precisely because the Company does not actually need to process the information in question, Eni S.p.A. is perfectly capable of defending its position by adopting other methods aimed at minimizing its use—such as, in this case, the prior obscuring of the plaintiffs' personal data—as well as providing, in the public interest, a complete and transparent overview of the facts surrounding the procedural process in question, so as not to compromise the fundamental rights and freedoms of the data subjects (see, in this regard, also the Provision of the Italian Data Protection Authority dated 26 September 2024, web doc. no. 10071261). Furthermore, in addition to the requirement that the processing be necessary—which, in this case, for the reasons explained above, does not appear to be demonstrated by the documentation—it is also necessary to consider the assessments that the data controller should have made as part of the so-called balancing test that, as required by Article 6, paragraph 1, letter f), of the Regulation, the latter is required to carry out. Indeed, an adequate "weighing of competing interests and rights" (i.e., those of the data controller, on the one hand, and those of the data subject, on the other), which forms the basis of the aforementioned test, depends on the circumstances of the case and "always requires full consideration of a number of factors," including "the impact of the processing on the data subject" (which must also be assessed in relation to the nature of the data to be processed, their accessibility, and the consequences the processing may have), as well as "the data subject's reasonable expectations regarding the processing" (see EDPB, Guidelines No. 1/2024, cited above, p. 2 and paragraphs 31-60; in this regard, see, in particular, CJEU, Case C-252/21, Meta v. Bundeskartellamt, paragraphs 108 and 116). In any case, therefore, the existence of a legitimate interest requires "a careful assessment [by the controller], including whether the data subject may reasonably expect at the time and in the context of the collection of personal data that processing for that purpose may take place" (see EDPB, Guidelines No. 1/2024, cited above, paragraphs 50-54 and also Council Regulation (EC) No. 47 of the Regulation). It follows that such "reasonable" expectations play "an important role in the [abovementioned] balancing test," as they aim to "limit the risk that data subjects will be unduly surprised by the processing or its consequences or implications" (see EDPB, Guidelines No. 1/2024, cited above, p. 2 and paragraph 52). These factors, however, do not appear to have been taken into account by Eni S.p.A. In the case at hand, particularly with regard to, at the very least, additional and different information beyond that (i.e., their names) already made accessible by the same interested parties in various other contexts. Specifically, this concerns the data relating to the "place and (...) date of birth, tax code, and residential address"; these, as is known, are also contained in the summons in question. This is because the applicants could not reasonably expect, based on the context in which such information was collected and the specific circumstances of the case, that it would be further processed by Eni S.p.A. through its publication on the Company's website and for the purposes described. Furthermore, this data – specifically those indicated above – involves personal data whose disclosure, given its strictly confidential nature (for example, residential address) and its significant identifying function (such as tax code, as well as the indication of place and date of birth), may have negative consequences on the rights and freedoms of individuals. The free access to such information via the Internet to a potentially unlimited number of individuals exposes data subjects to potential risks to their privacy, both in terms of their personal security and peace of mind, and in terms of the potential unlawful use of such personal data by third parties (regarding the particularly sensitive nature of such information and the risks arising from its dissemination, see EDPB, Guidelines 1/2024, paragraph 41; but also, with regard to the residential address, the Provision of the Italian Data Protection Authority of 9 October 2025, web doc. no. 10192784; and, with regard to the tax code, the Guidelines on the processing of personal data, including those contained in administrative records and documents, carried out for purposes of advertising and transparency on the web by public bodies and other obligated entities, adopted by the Italian Data Protection Authority on 15 May 2014, web doc. no. 3134436). From all of the above, it follows that Eni S.p.A. failed, in this case, to effectively and fully weigh the competing interests at stake, failing to take due account of the legitimate expectations of the data subjects, as well as the impact that the processing in question could have on them. For all of the reasons stated above, the legal basis of legitimate interest cannot be applied in the case at hand, as the conditions set out in Article 6, paragraph 1, letter f) of the Regulation, as also cited by the CJEU, are not met. The latter has, in fact, clarified that "this provision establishes three cumulative conditions for the processing of personal data it covers to be lawful, namely, first, the pursuit of a legitimate interest of the data controller or a third party; second, the necessity of processing the personal data for the purposes of the legitimate interest pursued; and, third, the condition that the interests or fundamental rights and freedoms of the data subject do not prevail over the legitimate interests of the data controller or a third party" (see ECJ, Case C-252/21, Meta v. Bundeskartellamt, paragraph 106). Therefore, given that the aforementioned lawfulness requirement does not apply to the case at hand, and since no other lawfulness requirement exists to justify, in this case, the online dissemination of data by the Company, the processing of the data subjects' data referred to in the preamble was carried out by Eni S.p.A. in violation of Article 13 of the GDPR. 6, paragraph 1 of the Regulation and in conflict with the aforementioned general principles of lawfulness referred to in art. 5, paragraph 1, letter a) of the Regulation. 4. Conclusions: Declaration of unlawful processing. In light of the findings, the Authority believes that the statements, documentation, and reconstructions provided by the data controller during the investigation do not address the concerns notified by the Office in the initiation of the proceedings and are therefore not suitable for dismissing the present proceedings. Furthermore, none of the cases provided for in Article 11 of the Garante Regulation No. 1/2019 apply. The processing of personal data carried out by Eni S.p.A. is, in fact, unlawful, in the terms set out above, with reference to the violation of Article 5, paragraph 1, letter a), and Article 6, paragraph 1, of the Regulation. Furthermore, given the fact that the Company has, during the proceedings, ceased all processing of data subjects' data on its website, it is believed that, at this stage, the conditions for the adoption of further corrective measures pursuant to Article 58, paragraph 2 of the Regulation are not met. 5. Adoption of the injunction order for the application of the administrative pecuniary sanction and additional sanctions (Articles 58, paragraph 2, letter i), and 83 of the Regulation; Article 166, paragraph 7, of the Code). The Guarantor, pursuant to Article 58, paragraph 2, letter i) of the Regulation and Article 166 of the Code, has the power to impose an administrative pecuniary sanction pursuant to Article 58, paragraph 2, letter i), of the Regulation and Article 166 of the Code. 83 of the Regulation, by issuing an injunction (Article 18 of Law No. 689 of 24 November 1981) in relation to the processing of personal data carried out by Eni S.p.A., which has been found to be unlawful, in the terms set out. Violation of the above provisions entails the application of the administrative sanction provided for in Article 83, paragraph 5, letter a), of the Regulation. We believe it is appropriate to apply Article 83, paragraph 3 of the Regulation, which provides that "if, in relation to the same or linked processing operations, a controller […] infringes, intentionally or negligently, several provisions of this Regulation, the total amount of the administrative fine shall not exceed the amount specified for the most serious infringement." The total amount of the fine is calculated so as not to exceed the maximum fine provided for in the same Article 83, paragraph 5 of the Regulation. With reference to the elements listed in Article 83, paragraph 3 of the Regulation, 83, paragraph 2 of the Regulation for the purposes of applying the administrative pecuniary sanction and its quantification, taking into account that the sanction must be "effective, proportionate and dissuasive in each individual case" (Article 83, paragraph 1 of the Regulation), it is noted that, in the case under consideration, the following circumstances were taken into account: - pursuant to Article 83, paragraph 2, letters a) and g) of the Regulation, the nature of the violation, given that the publication of the summons in question led to the online dissemination of the plaintiffs' personal data, in the absence of a valid basis for legitimacy, its duration (the dissemination having occurred over a moderate period of time, likely not exceeding 6 months), the number of data subjects involved (12 in total), as well as the type of information subject to the violation, which, although not classified as data belonging to the special categories referred to in Article 9 of the Regulation, has a particular private nature as highlighted in paragraph 1. 3 of this decision (see Article 83, paragraph 2, letter g), of the Regulation). In favor of the infringer, consideration is given to the fact that, at least, the names of the plaintiffs were shared on the websites of the two organizations, Greenpeace Onlus and ReCommon APS, and that a large portion of the identities of the interested parties had been disclosed by them in the context of various initiatives undertaken by the latter in various public contexts, with reference to the cause referred to in the contested summons; - the negligent nature of the violation and the moderate degree of liability of the data controller (Article 83, paragraph 2, letters b) and d) of the Regulation), given first and foremost that − as indicated in the statements obtained during the investigation − the violation was "incidental" in that there was no actual intent on the part of Eni S.p.A. to implement specific processing of the data contained in the published summons, but rather to make information regarding the ongoing legal proceedings available to the public, so that those affected by the media campaign related to the so-called "Just Cause" would have the tools to further investigate the Company's position and obtain a complete picture of the facts. The manner in which this publication was carried out is also relevant, given that the section of the website—which contains the Company's reconstructions and considerations regarding the dispute in question—contains no reference to the identity or other personal data of the data subjects, and that the aforementioned summons, which instead contains the applicants' data, "was accessible only on an internal page thereof, likely through a specific search that could be traced" (see Company note dated February 14, 2025, pages 6 and 9); - the aforementioned actions, spontaneously initiated by Eni S.p.A. prior to notification of a breach, to bring the processing into compliance with the Regulation and repair the damage suffered by the data subjects, given that the latter promptly and proactively remedied the breach raised once it became aware of it following the submission by the Authority of the aforementioned report (see Article 83, paragraph 2, letter c) of the Regulation); - the fact that the Company cooperated with the Authority during the proceedings (Article 83, paragraph 2, letter f) of the Regulation) and the absence of previous relevant breaches against it (Article 83, paragraph 2, letter e) of the Regulation). Finally, the Company's stated initiatives, particularly those aimed at raising awareness among its staff, aimed at preventing the recurrence of situations similar to the one being contested, were also taken into account in favor of the offender (Article 83, paragraph 2, letter k) of the Regulations) to prevent the recurrence of situations similar to the one being contested (see, in this regard, note dated February 14, 2025, page 10). Furthermore, it is noted that, in this specific case, due to the aforementioned principles of effectiveness, proportionality, and dissuasiveness to which the Authority must adhere in determining the amount of the fine (Article 83, paragraph 1, of the Regulations), the offender's financial circumstances, determined on the basis of the Company's turnover, as reported in the financial statements for 2024 (the latest available), are relevant. In light of the above elements and the assessments made in this specific case, the following provisions apply to Eni S.p.A.: the administrative sanction of the payment of a sum equal to €96,000.00 (ninety-six thousand). It is also considered that, pursuant to Article 166, paragraph 7, of the Code and Article 16, paragraph 1, of the Italian Data Protection Authority Regulation No. 1/2019, this chapter containing the injunction order should be published on the Italian Data Protection Authority's website. This is in consideration of the fact that, as highlighted above, the publication resulted in the online dissemination of personal data identifying the data subjects without any lawful basis. Finally, it is noted that the conditions set forth in Article 17 of the Italian Data Protection Authority Regulation No. 1/2019 concerning internal procedures with external relevance, aimed at carrying out the tasks and exercising the powers delegated to the Italian Data Protection Authority, are met. NOW CONSIDERING ALL THE FOREGOING, THE ITALIAN DATA PROTECTION AUTHORITY pursuant to Article 57, paragraph 1, letter f) of the Regulation, declares the unlawfulness of the processing carried out by Eni S.p.A., with registered office in Rome (RM), VAT no. 00905811006, within the terms set out in the grounds, for violation of Article 5, paragraph 1, letter a) and Article 6, paragraph 1, of the Regulation; ORDERS Eni S.p.A., pursuant to Article 58, paragraph 2, letter i) of the GDPR, to pay the sum of €96,000.00 (ninety-six thousand.00) as an administrative fine for the violations indicated in this order. ORDERS pursuant to Article 58, paragraph 2, letter i) of the GDPR, i) of the Regulations, to the same Company, to pay the sum of €96,000.00 (ninety-six thousand.00) as an administrative fine for the violations indicated in this order, according to the procedures illustrated in the attachment, within thirty days of notification of this order, under penalty of the adoption of the subsequent enforcement proceedings pursuant to Article 27 of Law No. 689/1981. It is hereby stated that, pursuant to Article 166, paragraph 8 of the Code, the violator retains the right to settle the dispute by paying an amount equal to half of the fine imposed within the deadline set forth in Article 10, paragraph 3, of Legislative Decree No. 150 of September 1, 2011, provided for filing an appeal as indicated below; ORDERS - pursuant to Article 166, paragraph 7, of the Code and Article 16, paragraph 1, of the Regulation of the Data Protection Authority No. 1/2019, the publication of the injunction order on the website of the Data Protection Authority; - pursuant to Article 154-bis, paragraph 3, of the Code and Article 37 of the Regulation of the Data Protection Authority No. 1/2019, the publication of this provision on the website of the Data Protection Authority; - pursuant to Article 17 of Regulation No. 1/2019, the recording of the violations and measures adopted pursuant to Article 58, paragraph 2, of the Regulation, in the internal register of the Authority provided for by Article 57, paragraph 1, letter u) of the Regulation. Pursuant to Article 78 of Regulation (EU) 2016/679, as well as Articles 152 of the Code and Article 10 of Legislative Decree No. 1 of September 1, 2011. 150, an appeal against this provision may be lodged with the ordinary judicial authority, with an appeal filed with the ordinary court of the place identified in the same Article 10, within thirty days from the date of notification of the provision itself, or sixty days if the appellant resides abroad. Rome, March 26, 2026 THE PRESIDENT Stanzione THE REPORTER Cerrina Feroni THE SECRETARY GENERAL Montuori
