Garante per la protezione dei dati personali (Italy) - 10145986

Garante per la protezione dei dati personali - 10145986
Authority:	Garante per la protezione dei dati personali (Italy)
Jurisdiction:	Italy
Relevant Law:	Article 5 GDPR Article 6 GDPR Article 7 GDPR Article 24 GDPR Article 25 GDPR Article 28 GDPR Article 31 GDPR Art. 130 d. lgs. 196/2003 Art. 157 d. lgs. 196/2003
Type:	Investigation
Outcome:	Violation Found
Started:	09.12.2024
Decided:	29.04.2025
Published:
Fine:	100,000 EUR
Parties:	Energia Verde S.p.a.
National Case Number/Name:	10145986
European Case Law Identifier:	n/a
Appeal:	Unknown
Original Language(s):	Italian
Original Source:	GPDP (in IT)
Initial Contributor:	cci

The DPA fined an energy provider €100,000 for the unlawful processing of personal data for direct marketing and for engaging processors without a processing agreement.

English Summary

Facts

The DPA received many complaints about aggressive marketing on behalf of energy provider Energia Verde S.p.a. (the controller).

Data subjects repeatedly reported similar issues:

• They received unwanted calls with no legal basis;
• They received calls despite having signed up for the Do Not Call registry;
• The controller did not honor their request. In its responses, the controller claimed that it was unable to grant requests because it relied on third party providers for marketing and could only forward the requests to those providers.

The DPA opened a broad investigation against the controller. The investigation also covered the collection of consent to direct marketing via a consent form on the controller’s website, as well as the marketing activities carried out via several processors and sub-processors.

During the investigation, the DPA required detaiedl information about all telemarketing contracts concluded during one specific week (“sample week”), including proof of consent to the initial marketing communication. The DPA found that about 6% of the contracts concluded during the sample week, related to numbers that were unlawfully called despite their inclusion in the Do Not Call registry.

Holding

The DPA held that the controller

• Processed personal data without a legal basis and without being able to document data subjects’ consent, in violation of Articles 5, 6, 7, and 25 GDPR as well as Article 130 d. lgs. 196/2003;
• Engaged several processors and sub-processors without vigilating on their compliance and without concluding a data processing agreement, in violation of Articles 5, 24 and 28 GDPR;
• Failed to respond to data subject’s inquiries and to honor their requests, in violations of Articles 12 and 15-22 GDPR;
• Violated Article 157 d. lgs. 193/2003 by providing a late and incomplete response to the DPA’s inquiries in the context of the investigation.

With regards to the consent forms on the controller’s website, the DPA observed that data subjects were prompted to give a single consent covering a number of different purposes (such as marketing, profiling, the processing of purchases, and so on). On this basis, the DPA held that the controller failed to collect specific and granular consent.

The DPA fined the controller €100,000 and ordered it to bring its direct marketing operations into compliance.

Comment

On Energia Pulita

Energia Pulita S.r.l. was the main processor engaged by the controller. The company was recently fined €300,000 in another case about direct marketing: see Garante per la protezione dei dati personali (Italy) - 10114967.

On processors and sub-processors

As in many cases related to direct marketing, the data controller claimed that it was not responsible for the operations of its third-party contractors because said parties were (allegedly) sole controllers of personal data rather than processors. The DPA clarified once again that “controller” and “processor” are substantive notions that do not depend upon the wording of an agreement. On this basis, the DPA held that the third parties were in fact data processors (and that the controller engaged them without concluding a DPA).

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Italian original. Please refer to the Italian original for more details.

[web doc. no. 10145986]
Provision of April 29, 2025
Register of Provisions
No. 248 of April 29, 2025
THE ITALIAN DATA PROTECTION AUTHORITY
IN today's meeting, attended by Professor Pasquale Stanzione, President, Professor Ginevra Cerrina Feroni, Vice President, Dr. Agostino Ghiglia and Guido Scorza, members, and Dr. Claudio Filippi, Acting Secretary General;
CONSIDERING Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation, hereinafter "Regulation");
HAVING SEEN the Personal Data Protection Code (Legislative Decree No. 196 of June 30, 2003), as amended by Legislative Decree No. 101 of August 10, 2018, containing provisions for the adaptation of national legislation to the aforementioned Regulation (hereinafter the "Code");
HAVING SEEN the documentation in the file;
HAVING SEEN the observations formulated by the Secretary General pursuant to Article 15 of the Guarantor's Regulation No. 1/2000, adopted by resolution of June 28, 2000;
REPORTER: Attorney Guido Scorza;
1. INVESTIGATIVE ACTIVITY
1.1. Introduction
With document No. 144777/24 of December 9, 2024 (notified on the same date by certified email), which is to be considered reproduced here in its entirety, the Office initiated, pursuant to Article 166, paragraph 5, of the Code, a proceeding for the adoption of the measures referred to in Article 58, paragraph 2, of the Regulation against Energia Verde S.p.A. (hereinafter "Energia Verde" or "Data Controller" or "Company"), represented by its legal representative pro tempore, with registered office in Salerno (SA), Corso Garibaldi, 150, Tax Code 05959600650.
The proceeding stems from an investigation initiated following the receipt of numerous complaints and reports lodged against Energia Verde, in which the data subjects complained of receiving unwanted calls aimed at promoting energy supply contracts made without an appropriate legal basis, as well as the failure and/or inadequate response to the data subjects' requests to exercise their rights.
1.2. Information Requests Made by the Authority
With a note dated April 11, 2024 (see Prot. No. 45119/24), the Authority sent Energia Verde a cumulative request for information, formulated pursuant to Articles 157 of the Code and 58, paragraph 1, letter a) of the Regulation, to assist in assessing numerous complaints and reports (i.e., nearly one hundred from June 2023 until the opening of the cumulative investigation). These reports brought to the Authority's attention the receipt of unwanted promotional calls, made in the interest of Energia Verde, to numbers registered in the Public Register of Opposition (hereinafter also "RPO") and in the absence of an appropriate legal basis. In all cases, the calling numbers indicated in the aforementioned complaints were not registered in the Register of Communications and Postal Operators (hereinafter also "ROC"). Some applicants also complained about the lack of and/or inadequate response to requests to exercise data subjects' rights submitted pursuant to Articles 15 et seq. of the Regulation. More specifically, when data subjects had previously contacted the data controller, they had received a standardized response, in which the Company clarified that it used external sales agencies and was therefore unable to directly provide the requested response. In such cases, Energia Verde communicated that it had asked its agencies to remove the data subject's name from their database if they were present.
With the same request for information, the Company was also asked to provide "a list of purchase proposals from its sales network that resulted in the activation of energy services in the period from January 15, 2024, to January 22, 2024, inclusive" (the so-called sample week).
On that occasion, the Office also noted that, following access to the website www.energiaverdeitalia.it as part of the preliminary investigation, it was discovered that the "CONTACTS" page contained a form for users to request contact and assistance. The bottom of the form contained the following text: "I consent to the processing of my data pursuant to the privacy policy" and "to view*." However, clicking the "to view*" button did not work, and a check automatically appeared in the box next to the text "I consent to the processing of my data pursuant to the privacy policy." The information on the data processing carried out in connection with the contact requests was not even available in the "personal data policy" published on the website. Therefore, the data controller was asked to provide useful information regarding the management of the contact process for data subjects who had requested to be contacted using the form on the company website.
With note Prot. no. 52721 of April 30, 2024, the Company preliminarily declared that "Energia Verde Italia S.p.A. acquires its entire customer base from its subagency, Energia Pulita s.r.l., which, in turn, acquires customers from various commercial partners who work for it, selling Energia Verde Italia's product."
Referring to the circumstances described in the complaints and reports sent to the Authority, Energia Verde also highlighted that the telephone number of the subagency Energia Pulita S.r.l. had been duly registered with the ROC and that the words "Energia Verde" were among the most frequently clicked on search engines. Therefore, it could be assumed that "many telephone salespeople contact users on behalf of various operators and use the term "Energia Verde" as a telephone selling point to emphasize the purity of the energy (which is indeed green) produced from renewable sources, effectively confusing users."
Finally, regarding the contact form and the information on the website, the Company noted that "the anomaly reported to us was promptly remedied (...) the text "Click here," which was green on a green background, was changed to white on a green background, to make it more visible to the customer. The privacy policy text is understandable in the contact form, as specified in the privacy policy itself."

Following an examination of the circumstances described in the findings, and given that the Authority had received additional complaints in the meantime (see files nos. 361665 – 364680 – 370093), it was appropriate to conduct a further investigation, sending Energia Verde a request for additional information pursuant to Articles 58 of the Regulation and 157 of the Code (see Prot. no. 64376 of 27 May 2024).
To this end, the Office first reiterated its request to provide the list of purchase proposals from its sales network that had led to the conclusion of supply contracts during the period from January 15 to January 22, 2024 (the so-called "sample week"). The same notice then requested further information regarding the management of the sales process, the management of contact requests, including those made via the website, the contact list purchase contracts, as well as the information provided to data subjects and the methods for obtaining consent for the processing of personal data. At the same time, the Company was asked to clarify the nature of the relationships between Energia Pulita S.r.l. and Energia Verde Italia S.p.A.
At the same time, following initial feedback from Energia Verde, it was appropriate to also notify Energia Pulita of a request for information in order to obtain useful information to illustrate the process of promoting and concluding supply contracts attributable to Energia Verde Italia S.p.A. (see Prot. No. 64374/24 of May 27, 2024).
By the expiration of the deadline granted by the Office, which occurred on June 17, 2024, neither company had submitted the requested information.
Subsequently, on July 1, 2024 (see Prot. No. 80489), Energia Verde submitted a request for a 30-day extension of the deadline, stating that this was necessary due to the number and highly specific nature of the requests formulated by the Authority.
With note Prot. No. 81460 of July 3, 2024, the Office noted, "first of all, that at the time of submission of the extension request in question, the deadline granted for the purposes of responding was to be considered already expired. With the express reservation of deferring any assessment regarding the Company's failure to respond, within the established deadline, to the aforementioned requests for information formulated by the Office, in order to allow for the acquisition of useful information for the ongoing investigation and to fully implement the adversarial principle (Article 2 of Internal Regulation No. 1/2019, available at www.gpdp.it, web doc No. 9107633), in partial acceptance of the party's request, a deadline of 15 days from receipt of this letter is granted to provide a response. This deadline appears proportionate in relation to the assessment of the complexity of the issues under consideration and complies with the principles of cost-effectiveness and reasonable duration of the proceedings.

Similarly, Energia Pulita, following a reasoned request, also obtained the granting of a new deadline for the purpose of providing the requested feedback (see Prot. Nos. 82848/24 and 82591/24).
With a note received on July 17, 2024 (see Prot. No. 88693 of July 18, 2024), Energia Verde forwarded the list of purchase proposals from its sales network that had led to the conclusion of supply contracts in the period from January 15, 2024, to January 22, 2024, specifying that "the purchase proposals are collected by Energia Pulita S.r.l. (...) to date, the only entity entrusted with carrying out promotional activities directly by the Company (...) Energia Pulita has relied on a network of third parties to carry out the task entrusted to it by Energia Verde, but Energia Pulita is the only entity with the access privileges/credentials necessary to upload the purchase proposals to the Company's dedicated platform."
On the same occasion, regarding the complaints brought to the Authority's attention, the Company reiterated that telemarketers operating on the market had engaged in the unlawful practice of contacting interested parties using the term "Green" to induce them to purchase products and services, "creating the (false) perception of having received commercial communications regarding products and services attributable to Energia Verde Italia." In this regard, the Company also stated that it had filed a complaint with the Public Prosecutor's Office against a company that was posing as Energia Verde in order to induce customers to switch suppliers.
Energia Verde also stated that, with the exception of three complaints (files nos. 292690, 348610, and 344346), none of the reporting/complainants had entered into a supply contract with the Company and that, in most cases, the interested parties had not previously contacted Energia Verde directly, with the exception of two instances. More specifically, with regard to file no. 344346—concerning the telephone contact made on behalf of Energia Verde by an operator who already had knowledge of the complainant's data and the subsequent request for deletion—the Company noted that the interested party, following the exercise of his right of withdrawal, had received notification of acceptance of his request to withdraw from the contract. With respect to file no. 338898—in which the applicant complained about receiving promotional emails to users registered with the RPO and the inadequate response to requests to exercise their rights—Energia Verde stated that the data subject had exercised his or her right of access and subsequently received a response from the DPO via certified email on March 1, 2024.
Regarding the contact request form on the company website, the Company stated that it had first "modified the contact request page to make the information on the processing of personal data more easily identifiable" and "integrated the existing privacy policy to better clarify for data subjects the terms of the data processing related to this request." Energia Verde subsequently decided to deactivate this section of the website due to its limited use by customers. On this point, Energia Verde specified that "the procedure for (re)contacting individuals who provided their data on the site was as follows: the user, having entered their data (name and telephone/mobile number) in the dedicated form, was subsequently contacted at the telephone number provided; after two contact attempts, if there was no response, the user was not contacted further and their personal data was permanently deleted."

Energia Verde then clarified that the promotion of the services was entirely entrusted to Energia Pulita, which until March 15, 2024, had carried out this task through telemarketing campaigns conducted with the support of XX and XX (so-called Affiliates). The Affiliates, in turn, relied on independently acquired contact lists "which were never provided to Energia Pulita nor to Energia Verde, which had no contractual relationship with these individuals."
The contract signed by Energia Pulita with XX and XX had the same purpose and contained the same clauses as the one signed with Energia Verde.
Regarding the role of the Affiliates (which the Company used until March 2024), Energia Verde stated that "the information provided by Energia Pulita shows that these parties have undertaken to process the personal data of individuals who have been provided with adequate information pursuant to Article 13 of the Regulation and who have provided the necessary consent to the processing of data for the purposes of the assignment."
Energia Verde also stated that, as of March 15, 2024, Energia Pulita had terminated the contract with both Affiliates and had begun carrying out telemarketing activities without using third parties.
The Company therefore stated that Energia Pulita currently carries out this activity through telephone numbers registered with the ROC and using contact lists previously verified with the RPO. Following telephone contact, if the potential customer expresses interest in Energia Verde's services, Energia Pulita collects the purchase proposal via voice order or signature using an OTP code. Energia Pulita then uploads the contract proposal to Energia Verde's CRM, which verifies the accuracy of the registration and contractual documentation. Finally, after fifteen days—corresponding to the period required by law for exercising the right of withdrawal—the activation of the supply services is finalized.
Regarding the contact list purchase contracts signed in the 2023-2024 two-year period, Energia Verde clarified that under the previous contractual framework, Energia Pulita "had complete autonomy in choosing the contacts to use for promotional activities for Energia Verde-branded services and products. Therefore, both the choice of the types of lists to purchase and the operational methods used to carry out the promotional activity for the products and services were managed, organized, and regulated by the Partner itself, in compliance, among other things, with the commitments and obligations assumed by the latter contractually with the Company.

Following the numerous reports brought to the Company's attention with the request for information notified by the Authority, Energia Verde decided to change its privacy organizational structure, appointing Energia Pulita as data controller and "requiring the Partner to comply with its instructions regarding the persons to contact and the methods of managing contacts in the context of promotional activities and the collection of purchase proposals." In this changed organizational structure, Energia Pulita uses contact lists provided by XX and compiled by third parties (hereinafter "Publishers"), containing personal data of data subjects who have given their consent for the transfer to third parties.
Regarding the telemarketing activities carried out when the Company used Affiliates (before March 2024), Energia Verde reiterated that these operations were carried out using contact lists independently obtained by these parties and that, given the termination of the contract, "to date it is not possible to acquire information regarding the information provided to the recipients of the reported contacts."
Currently, however, the contact lists used are acquired by Energia Pulita through the list provider XX, and the database license agreement stipulates that the lists contain "personal data of data subjects who have received adequate information and have given the Publishers their consent to the transfer of their data to third-party data controllers for the latter's marketing purposes."
Finally, Energia Verde clarified that it originally "commissioned the promotional activities for its products and services to Energia Pulita as part of a contractual relationship in which the latter was responsible for increasing sales of Energia Verde-branded services and products by referring interested parties to the offers (...) the two companies were classified as independent data controllers, and the names and data of potential customers were collected by the Partner; the latter, therefore, was required to comply with the applicable telemarketing legislation and, therefore, to contact only those not registered in the Public Register of Opposition (RPO) and only via telephone numbers registered in the Register of Communications Operators (ROC)". Furthermore, "Energia Pulita had entrusted the promotion and collection of purchase proposals for Energia Verde's services to various commercial partners, also operating as independent data controllers, upon whom it had imposed the same obligations as Energia Pulita regarding data collection and obtaining consent".
In the current organizational structure, however, Energia Pulita has assumed the role of data processor pursuant to Article 28 of the Regulation and may "avail itself of third parties to carry out the task, provided that such parties are appointed as additional processors pursuant to Article 28 (4) of the Regulation and are contractually bound to comply with the same obligations assumed by Energia Pulita towards the data controller. Furthermore, Energia Pulita has the right to entrust the performance of the task to additional third parties only with the prior authorization of the Company, which therefore may oppose the designation of entities that do not possess adequate requirements of reliability and professionalism in terms of personal data protection."
Regarding the use of contact lists, Energia Verde emphasized that Energia Pulita is currently required to comply with the instructions given by the Company regarding the selection of purchasable lists: "i) verifying the accuracy of the information on data processing and any consents obtained, in the case of consent lists (in addition to verifying, if necessary, with the Register of Oppositions); ii) carrying out checks with the Register of Oppositions, in the case of contact lists extracted from general lists."
Regarding the monitoring of partners' activities, Energia Verde stated its intention to implement controls through the use of decoy numbers or random checks of contacts on the list, as well as comparing the signatories of purchase proposals with the contact details on the contact lists.
Finally, Energia Verde stated that it has adopted specific procedures for carrying out telemarketing/teleselling activities and for managing requests from data subjects to exercise their rights.
In a note dated July 18, 2024 (see Prot. No. 89319 of July 19, 2024), in response to the Office's request, Energia Pulita declared that on January 2, 2023, it had received the mandate to increase sales of the Energia Verde brand by referring individuals interested in taking advantage of the offers promoted by the company of the same name.
Thus, until March 15, 2024, Energia Pulita had carried out this mandate through XX and XX (so-called Affiliates), who in turn acted as independent data controllers, using independently acquired contact lists. The affiliates, by virtue of their contractual commitments, were required to "process the personal data of individuals who had been provided with adequate privacy information pursuant to Article 13 of the Regulation and who had provided the necessary consent to the processing of their data for the purposes of the mandate."
Subsequently, having negatively assessed the performance and results achieved, Energia Pulita decided to terminate the contracts with the aforementioned companies and, starting in March 2024, independently carried out telemarketing activities on behalf of Energia Verde.
Consequently, starting in March 2024, these activities were carried out using telephone numbers duly registered with the ROC and contact lists verified with the RPO. If, following the telephone contact, the potential customer expressed interest in Energia Verde's services, Energia Pulita collected the purchase proposal via voice order or signature using an OTP code. The purchase proposals thus formulated were then uploaded by Energia Pulita to a dedicated platform made available by Energia Verde, which then verified and formalized the contracts with customers.
In the same note, Energia Pulita emphasized that, under the previous organizational structure, it had broad autonomy in selecting contact lists and that it relied on Affiliates who "acted independently both in choosing the types of lists to use and in the operational methods used to carry out promotional activities."

Under the new organizational structure, Energia Pulita acts as data controller and on the basis of instructions received from Energia Verde regarding "i) the types of personal data to be used for carrying out telemarketing campaigns; ii) the procedures the Company must follow in processing operations carried out on its behalf; iii) the checks to be carried out to ensure that the recipients of telephone calls can be legitimately contacted."

Furthermore, as part of this reorganization, Energia Pulita had entered into a contract with XX "for the license to use databases created by third parties (hereinafter "Publishers") and containing personal data of data subjects who have given their consent to the transfer of their data to third-party data controllers. The lists in question, which can be used for a period of three months, must be reviewed by the RPO at least every two weeks.

With specific reference to the telephone contacts made up to March 15, 2024, on behalf of Energia Verde, Energia Pulita reported that it was "materially unable to acquire and therefore provide this Authority with the information relating to the notices provided to the recipients of the reported contacts."

With reference to the lists currently purchased directly by Energia Pulita, the latter specified that "pursuant to the contract currently in place with the list provider, these lists contain personal data collected by the Publishers relating to data subjects who have received a notice pursuant to Article 13 of the Regulation and who have given consent for the Publishers to communicate their personal data to third parties for the latter's marketing purposes."

Finally, Energia Pulita clarified that it carries out promotional activities only in the interest of Energia Verde.

1.3. Verification of the Public Register of Objections
In order to carry out the necessary checks regarding the accuracy of the aforementioned telemarketing activities, on August 12, 2024 (see Prot. No. 98805/24), the Office sent the aforementioned list of telephone numbers that Energia Verde had contacted to the Ugo Bordoni Foundation, which manages the Public Register of Objections. Accordingly, information was requested, pursuant to Article 157 of the Code, for each number, regarding whether it had been registered in the Public Register of Objections (RPO) no later than November 31, 2023.
On August 28, 2024, the aforementioned Foundation sent its own response (see Prot. No. 101582/24), an analysis of which revealed that, at the time of the promotional calls made by the Company, no. 5 telephone numbers, equal to just over 6% (6.17 percent) of the total number of telephone calls made in the reference period (81).
1.4. Notification of Violations
Following the investigation, the Office issued the aforementioned Notice of Violation No. 144777/24. This Notice first noted that Energia Verde had failed to adequately and timely respond to the request for information notified by the Authority pursuant to Articles 157 of the Code and 58 of the Regulation, and that this conduct constituted a violation subject to independent sanctions pursuant to the express provisions of Article 166, paragraph 2, of the Code.
In this regard, it was also noted that this conduct was in direct violation of the provisions of Article 31 of the Regulation, which establish a general obligation for the data controller to cooperate with the Supervisory Authority.
With regard to the performance of telemarketing and teleselling activities, however, the documentation and observations provided by the Company as a whole seemed to highlight significant critical issues both with respect to the processing of personal data carried out before March 2024 and with respect to the current organizational structure regarding personal data protection.
Regardless of the legal name used by the contracting companies, a systematic reading of the clauses within the contract, and the conduct of the parties in relation to the aforementioned activities, Energia Verde appeared to assume the role of data controller pursuant to Article 4, point 7) of the Regulation, while Energia Pulita appeared to perform the tasks typically attributable to a data processor as defined pursuant to Articles 4, point 8) and 28 of the Regulation.
In this context, therefore, XX and XX had processed personal data in the role of sub-processors. Likewise, in relation to the activities actually carried out, XX also appeared to act as a sub-processor.
Consequently, it emerged that until March 2024, Energia Verde had engaged in telemarketing and teleselling activities, using external parties, without prior and proper assignment of the relevant roles regarding personal data protection and the resulting responsibilities, as well as violating the basic accountability duties notoriously incumbent on the data controller.
It also emerged that until March 2024, Energia Verde had used external parties to process personal data, without prior appointment as data processor and the required authorization for the appointment of any sub-processors, violating both the duties of diligence in selecting parties with adequate privacy expertise (so-called culpa in eligendo) and failing to adequately supervise their work (so-called culpa in vigilando).
The Office also noted that, although the data controller had appointed Energia Pulita as data processor during the proceedings, some critical issues still appeared to persist, since, in violation of the provisions of Article 28, paragraph 2, of the Regulation and the provisions of the aforementioned appointment, the authorization issued by Energia Verde to Energia Pulita regarding the processing of personal data entrusted to the sub-processor XX had not been included in the proceedings.
With respect to the telemarketing and teleselling activities carried out up to March 2024, the findings of the numerous complaints brought to the attention of the Authority, the results of the checks conducted at the FUB regarding the contacts made during the so-called sample week, and the information provided by the Company, led to Energia Verde also being accused of carrying out promotional activities without an appropriate legal basis and using numbers not registered with the ROC, thereby violating Articles 28 et seq. 130 of the Code and 5, 6 and 7 of the Regulation.
Furthermore, these activities did not appear to have been preceded by the provision of adequate information pursuant to Articles 12, 13, and 14 of the Regulation.
Regarding the current organizational structure regarding the protection of personal data, while the effort made to promptly adapt corporate governance to current legislation was commendable, some critical issues appeared to persist.
The procedure for conducting telemarketing activities did not, in fact, contemplate the implementation of promotional activities aimed at former customers (so-called win-backs). Furthermore, the reference to legitimate interest as the legal basis for processing personal data for marketing purposes belonging to "Prospects whose numbers are present in the general lists and are not registered with the RPO" (see section 2, Telemarketing Procedure) did not appear to be fully compliant with current legislation.
Furthermore, the recently approved procedure did not provide for the blocking of supply activation in the event of anomalies regarding the lawfulness of the original contact and the dialogue with the interested party to assess their continued willingness to enter into the contract.
The Office also noted that in several of the complaints brought to the Authority's attention, the interested parties, under their own criminal responsibility, had stated that they had previously contacted the data controller to exercise their rights, but had nevertheless received generic and unsatisfactory responses to their claims, in clear violation of Articles 12 and 15 to 22 et seq. of the Regulation.
Furthermore, it was observed that the recontact of users using the form published on the company website continued to be carried out without the prior provision of adequate information on the processing of personal data and without the prior acquisition of valid consent.
Furthermore, the data controller appeared to have failed to implement measures designed to verify the identity of the data subject, as well as those aimed at limiting telephone calls and attempts to contact them within reasonable time limits.
Consequently, the telemarketing and teleselling activities carried out on behalf of Energia Verde also appeared to violate the provisions of Articles 5, 6, and 7 of the Regulation and Article 130 of the Code.
The Office therefore charged Energia Verde with the following violations:
a) Article 157 of the Code, in relation to Articles 31 and 58 of the Regulation, for the inadequate and late response to requests for information made by the Authority;
b) Articles 4, 5, 24, and 28 of the Regulation, for the processing of personal data without prior and correct identification of the individual roles, as well as for the consequent failure to fulfill the obligations arising therefrom;
c) Articles 5, 6, 7, and 24 of the Regulation, as well as Article 130 of the Code, for having carried out—and continuing to carry out—the above-described processing of personal data of users and contractors in the energy sector in violation of the principles of lawfulness and accountability, in the absence of an appropriate legal basis and by implementing inadequate technical and organizational measures to ensure, from the design stage, and to be able to demonstrate, that the processing is carried out in accordance with the Regulation, with reference to the appropriateness of the legal basis and the granting of proper consent;
d) Articles 12 and 15-22 of the Regulation for the failure and/or inadequate response to requests from data subjects to exercise their rights and the failure to adopt appropriate measures to properly manage such requests.
2. THE DATA CONTROLLER'S DEFENSE
The Company filed a preliminary request for an extension of the deadline allowed by law for the submission of defense briefs and the request to be heard by the Authority. The Office granted the request, granting an additional 15-day deadline for this purpose (see Prot. 151821 of December 31, 2024).
Subsequently, on January 23, 2025 (see Prot. no. 9120 of January 24, 2025), Energia Verde submitted its defense briefs, pursuant to Article 166, paragraph 6, of the Code and Article 13 of the Guarantor's Regulation No. 1/2019, but did not request a hearing before the Authority.
Regarding the late response to the Authority's request for information, Energia Verde stated that "even if the initial response provided by the Company was not complete and exhaustive (...) the Company, albeit late, i) communicated to the Authority everything requested, ii) provided the Authority, in addition to the requested information, also with numerous unsolicited documents. The delay in providing a complete response (...) was due exclusively to the difficulty in obtaining all the necessary information and documentation", as well as the coincidence between the opening of the investigation and the corporate reorganization.
In Energia Verde's opinion, "if the deadline for response granted with the request for information is to be understood as a peremptory deadline, and therefore granted under penalty of forfeiture, the Authority could not have taken into consideration the documents received subsequently; otherwise, if this deadline is not to be understood as peremptory, a late response cannot under any circumstances constitute a violation of Article 157 of the Privacy Code, in relation to Articles 31 and 58 of the Regulation".
The Company then reiterated that following the complaints received by the Authority and the contractual breaches committed by Energia Pulita Affiliates, Energia Verde had decided to change its organizational structure, bringing "the promotion and sale of its services back under its own control, entrusting Energia Pulita exclusively with the material performance of these activities," and appointing the latter as data controller pursuant to Article 28 of the Regulation.
With reference to the subjective roles assumed by Energia Verde and Energia Pulita before March 2024, Energia Verde objected that the objections raised by the Office were based on factual elements that did not correspond to what emerged during the investigation and observed that «The assignment was entrusted through a mediation contract with which Energia Pulita committed to increasing the sale of Energia Verde branded services by indicating subjects interested in benefiting from the latter's offers (...) the mediation contract states that "the Ambassador [i.e., Energia Pulita] will carry out its activity with full autonomy of action, time, organization, and expenses for carrying out the assignment (...)" (...). Furthermore, the brokerage agreement states that "should it become necessary, [Energia Pulita] will comply with any directives or guidelines issued by Energia Verde Italia Srl, both to meet its marketing needs and to protect the overall reputation of Energia Verde Italia Srl and its brand, which must always be protected."

Accordingly, according to the Company's defense, "the contract between the two companies did not provide for Energia Verde to provide instructions or guidelines to Energia Pulita in general terms regarding the manner of carrying out the assignment and processing personal data, but rather limited to two specific aspects: the protection of Energia Verde's reputation and any marketing needs (for example, defining the content of campaigns with reference to the commercial aspects of the offering). 33. On the other hand, during the investigation, no evidence emerged regarding any instructions or indications provided by Energia Verde regarding the methods of carrying out the assignment, much less regarding the specific nature of the processing of personal data. 34. It is true that the contract refers to Energia Pulita's obligation to process customer data in compliance with applicable regulations, but this is clearly a generic guarantee regarding the correctness of the commercial partner's actions, also and above all to protect Energia Verde's image in the context of promotional activities, without however translating into instructions regarding the methods with which personal data must be processed in the context of the assignment.
In the Company's opinion, "if Energia Verde had provided its partner with databases containing the personal data of the individuals to be contacted, or specific information regarding the type of data to be processed or the methods for carrying out the campaigns (for example, channel to be used, number of contacts to be made, timing, and contact times), it could have been concluded that Energia Pulita had acted on instructions from Energia Verde as the data controller."

Energia Verde also argued that "entrusting a promotional and sales campaign to a third party is an activity that, in itself, is not intrinsically connected to the processing of personal data," that "the data processing carried out by Energia Pulita in the context of promotional activities was aimed at pursuing a purpose specific to the latter, since the company, which was remunerated based on the expressions of interest from potential customers collected (and not on the marketing contacts made) through such activities, was pursuing its own commercial interest," and that, furthermore, "Energia Pulita organized its resources independently and completely autonomously to manage the promotional campaigns." Likewise, the decision to avail of other Affiliates and then terminate the contractual relationship, in the Company's opinion, fell within Energia Pulita's managerial and operational autonomy.
With specific reference to XX, the Company first clarified that "XX owns a database created and maintained by third parties ("Publishers"), which is licensed for use by commercial operators interested in acquiring contact lists for their marketing campaigns. With respect to this database, XX acts as a data processor or sub-processor on behalf of the licensee, depending on the latter's role."
As for the disputed lack of authorization for the appointment of a sub-manager by Energia Pulita, the Company stated that "the appointment document in question does not contain the authorization to appoint specific sub-managers (as is standard practice in appointment documents which, having a general and abstract content and generally intended to dictate a discipline also for future cases, do not and cannot go into the details of the individual potential sub-managers whose names in many cases are not even known) but is limited to generically providing for such an option for Energia Pulita (...) In light of this provision, which authorizes Energia Pulita to appoint further managers, it is not clear why the Authority concluded that there was no specific authorization with reference to XX, having not acquired any information or evidence in this regard."
With respect to the objections raised in relation to the performance of telemarketing activities before March 15, 2024, the Company, citing the reasons explained above, argued that "Energia Verde cannot be considered the data controller of the personal data relating to the teleselling activities subject to the proceedings, with the consequence that the conduct in question cannot be attributed to the Company. Energia Verde, in fact, limited itself to entering into supply contracts after the conclusion of the promotional activities managed by the Partner, without ever intervening in the management of the campaigns or in the strategic and operational decisions relating to the processing of personal data, nor was it in any way involved in defining the methods by which the campaigns were conducted."

Energia Verde further argued that the sample week examined is "such a short observation period (one week) that it does not represent a statistically significant sample for making projections over longer periods and does not take into account a whole series of variables, such as the performance and frequency of promotional campaigns." Furthermore, in relation to the telephone contacts made during the so-called "weekly period of observation," the Company asserted that the sample week considered was "such a short observation period (one week) that it does not represent a statistically significant sample for making projections over longer periods and does not take into account a whole series of variables, such as the performance and frequency of promotional campaigns." Sample Week: "Registration in the register maintained by the Ugo Bordoni Foundation (...) in itself excludes the possibility of contacting numbers present in general telephone directories, while it does not exclude the possibility of contacting numbers for which consent has been given by the data subjects, possibly following the number's registration in the RPO."
Regarding the current organizational structure, Energia Verde clarified that it carries out promotional campaigns aimed exclusively at so-called "prospects" (i.e., potential customers) and does not carry out "win-back" campaigns (i.e., promotional initiatives aimed at former customers).
The Company then reiterated that legitimate interest was the legal basis for the processing of personal data belonging to so-called "prospects" for telemarketing purposes, noting that "Article 130, paragraph 3, of the Privacy Code provides that communications aimed at sending commercial communications through the use of non-automated calling systems are permitted pursuant to Articles 6 and 7 of the GDPR; Paragraph 3-bis then adds that the processing of data for the aforementioned purposes, through the use of the telephone, is generally permitted for those who have not exercised the right to object by registering their registered number in the RDO.

On this point, the Company called for a "substantial assessment of Energia Verde's conduct" and noted that "In light of the provisions of Articles 129 and 130 of the Privacy Code as well as Presidential Decree No. 26 of January 27, 2022 (...), pursuant to Article 1, paragraph 15, of Law No. 5 of January 11, 2018, there is no doubt that the personal data of users in general telephone directories who have not exercised their right to object by registering in the RDO may be used for marketing purposes through telephone contacts with an operator. This conclusion is confirmed by the fact that the Authority's challenge does not concern the Company's assessment of the usability of the data, but exclusively the identification of the legal basis. In this context, the fact that, in an internal Company document (such as Energia Verde's Telemarketing Procedure), such data processing—lawfully outlined and regulated—is based on one legal basis rather than another does not appear to be relevant and does not appear to constitute a violation of personal data protection legislation that would warrant the imposition of a sanction.

With regard to the failure to include a mechanism for blocking contracts resulting from illicit contacts in the recently approved procedure, the Company argued that this omission was due to the fact that the procedure in question aims to regulate telemarketing activities and not subsequent activities concerning the conclusion of the supply contract. Therefore, "it does not, in itself, exclude the possibility that such measures are adopted by the Company and, therefore, cannot constitute a violation."

Regarding the contact form, Energia Verde stated that "it was accessible again due to a simple misunderstanding and was subsequently disabled again (...) any contact requests received through the website were not taken into consideration, and therefore no personal data acquired through this channel were processed."
The Company also argued that the provisions on data subject rights were not applicable to the case at hand, as it could not be considered a data controller with respect to the implementation of the promotional campaigns that were the subject of the reports and complaints received by the Authority. Only two requests had been received directly by Energia Verde, and the Company had promptly responded to them.
Regarding the procedure for managing requests to exercise data subject rights adopted by the Company pending the proceedings, Energia Verde stated that it had "chosen to entrust the activities related to the management of data subject requests to functions other than the Data Protection Officer, who had handled them up to that point; Consequently, it was necessary to adopt a document describing the new process to guide the activities of the entities now responsible for managing data subjects' requests. 77. This circumstance does not imply, in itself, that prior to the adoption of this procedure, the Company was not adequately organized to manage the activities in question and that they were not conducted in compliance with the applicable regulations.

Finally, the Company represented the circumstances to be taken into consideration in the unlikely event that the Authority deemed it appropriate to adopt a corrective and sanctioning measure.

3. AUTHORITY'S ASSESSMENTS
The observations submitted by Energia Verde during the proceedings do not appear to be sufficient to exclude the Company's liability for the alleged violations, since, as will be discussed in detail below, they appear irrelevant and unfounded.

First, it is noted that, despite the regularity of the notifications, Energia Verde did not adequately and timely respond to the requests for information sent by the Authority pursuant to Articles 157 of the Code and 58 of the Regulation, and that this conduct constitutes a violation subject to the application of the administrative pecuniary sanction provided for the most serious violations pursuant to Article 83, paragraph 5 of the Regulation.
Regarding the initial response provided to the Authority's request for information, the Company had completely failed to submit the purchase proposals relating to the so-called sample week, limiting itself to making generic and incomplete observations regarding the questions posed.
Following the request for additional information, however, Energia Verde initially remained completely silent. Subsequently, once the deadline for the response had expired, the Company amended its behavior, first requesting a new deadline and then providing the requested information.
This conduct, which effectively led to an undue delay in administrative activity, also clearly violates the provisions of Article 157 of the Code. 31 of the Regulation, which establishes a general obligation to cooperate with the Supervisory Authority, incumbent on the data controller, the data processor, the data processor, and, where applicable, the data representative.
In this regard, the Company argued that the delay occurred solely due to the difficulty in obtaining all the necessary information and documentation. This argument is not at all persuasive, since Energia Verde could, for example, have promptly requested an extension of the granted deadline and thus avoided the infringement.
On this point, the Company's objections regarding the mandatory nature of the deadline for the response and the unusability of the documentation provided late cannot be upheld.
Article 58, paragraph 1, letter a) of the Regulation expressly includes among the Authority's investigative powers the right to order the data controller and the data processor to provide any information necessary for the performance of its tasks. Likewise, Article 157 of the Code provides that the Garante may require the data controller and the data processor to provide information and to produce documents, including those relating to the contents of databases.
Violation of the aforementioned provisions is also in itself punishable by an administrative fine, to be determined within the same legal limit as for the most serious violations (cf. €20,000,000, or for undertakings, up to 4% of the total worldwide annual turnover of the preceding financial year, whichever is higher) pursuant to the combined provisions of Articles 166, paragraph 2 of the Code and 83, paragraph 5 of the Regulation.
It follows that addressing the issue of failure to comply with requests for information made by the Authority pursuant to Articles 157 of the Code and 58, paragraph 1, letter a) of the Regulation from the perspective of the peremptory or mandatory nature of the deadline is manifestly misleading.
In the Italian legal system, the dichotomy between peremptory and mandatory deadlines is borrowed from the Code of Civil Procedure, which in Article 152 regulates the so-called legal deadlines, i.e., those expressly provided for by law, and the so-called judicial deadlines, i.e., those established by the judge. More specifically, legal deadlines are divided into dilatory deadlines, which establish the time before which an act cannot be performed, and acceleratory deadlines, which indicate the time within which an act can be or must be performed. Accelerating time limits, in turn, are classified as mandatory, when they are intended to regulate procedural activity in view of the normal course of the process, while they are considered peremptory, when they require an action to be completed within a specific time limit, under penalty of forfeiture. Precisely because the expiration of a peremptory time limit is associated with the loss of the possibility of completing the action for which the time limit was established, Article 152 of the Italian Code of Civil Procedure provides that only those time limits expressly defined as peremptory by law are considered peremptory.
It is clearly evident that the rationale just illustrated, underlying the peremptory or mandatory nature of time limits established by procedural law, proves poorly suited to the issue of failure to comply with an Authority's request, which, under the law, does not result in procedural forfeiture, but rather the application of an administrative sanction.
In the context of current legislation on the protection of personal data, in fact, the investigative powers granted to the Authority are free and unbound by any timeframe, since responding to the Authority's requests is not considered a right of defense recognized for the purposes of guaranteeing adversarial proceedings and the right to defense, but is rather an obligation, the failure to comply with which constitutes an administrative offense of omission.
It follows that the offence is committed when the subject fails to carry out the prescribed action and is therefore punished, regardless of whether or not his conduct results in a naturalistic event (in this sense see Cass. Ord. no. 8942 of 29 March 2023 «(…) art. 157 Privacy Code contains a formula (…) in which the request from the Guarantor for information or the exhibition of documents is not integrated with temporal perimeters. Conversely, art. 164 Privacy Code - which contains the corresponding sanctioning provision ("Whoever fails to provide the information or to exhibit the documents requested by the Guarantor pursuant to art. 150, paragraph 2, and art. 157 is punished with the administrative sanction of the payment of a sum ranging from ten thousand euros to sixty thousand euros") - is aimed at conferring on the Guarantor Authority the necessary investigative powers, for preventive purposes, again without time constraints. Moreover, interpreting the provisions In their historical-teleological meaning, the regulation on the processing of personal data was conceived (…) as a tool to prevent and contain the risk to the rights and freedoms of individuals: it is a regulatory regime of European origin aimed at ensuring the correct circulation of information relating to the natural person; information understood not only as an economic asset, but above all as the object of a fundamental right (recognized by art. 8 of the European Charter of Fundamental Rights and by art. 8 of the Charter of Fundamental Rights of the European Union). In this regulatory context, the establishment of the national supervisory authority (…), which is granted the power to perform its tasks recognized by law in complete independence in each Member State, is an essential element of the protection of natural persons with regard to the processing of their personal data. The powers, therefore, assigned to the Guarantor (…) are essentially of direction, preliminary control, investigation and intervention (…). The original regulatory design is, moreover, confirmed and strengthened by the currently applicable system, EU Regulation 2016/679 known as GDPR, which grants the national supervisory authority powers of investigation, control, and intervention: here too, an administrative pecuniary sanction of up to €20 million (or 4% of the total annual worldwide turnover of the preceding financial year, if higher) is applicable for non-compliance with an order from the Supervisory Authority (Article 83, paragraph 6, GDPR), which is not time-limited. 1.2. The reconstruction of the rationale and purpose of the regulation in question does not allow for a delay in satisfying the requests or measures imposed by the Guarantor: instead, the ongoing nature of the unlawful act of omission emerges, "continuing" until subsequent investigations.

The approach outlined above is, moreover, the one consistently followed by the Authority, which, on multiple occasions, has imposed pecuniary sanctions for failure to respond to requests for information pursuant to Article 83, paragraph 6, GDPR. 157 of the Code (ex multiple Provisions of September 15, 2022, No. 301, web doc. No. 9815931; Provisions of January 24, 2024, No. 34, web doc. No. 9986304; Provisions of October 17, 2024, No. 619, web doc. No. 10072669).
Regarding the performance of telemarketing and teleselling activities, the documentation and declarations provided by the Company as a whole confirmed the existence of significant critical issues both with respect to the processing of personal data carried out before March 2024 and with respect to the current organizational structure regarding personal data protection.
With regard to corporate compliance in place until March 2024, a systematic reading of the clauses within the contract and the conduct of the parties reveals that Energia Verde had originally outsourced the promotion of products and services, including the operations related to the conclusion of contracts with end customers and their subsequent uploading to company systems, entrusting these activities exclusively to Energia Pulita.
For its part, Energia Pulita carried out promotional and sales activities exclusively for Energia Verde, adhering to the directives and guidelines issued by the latter and availing itself of the assistance of additional third parties.
In this context, therefore, Energia Verde assumed the role of data controller, pursuant to art. 4, point 7) of the Regulation (see "the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data"), while Energia Pulita performed the tasks typically attributed to the data processor pursuant to Articles 4, point 8) and 28 of the Regulation (see "the natural or legal person, public authority, agency or other body which processes personal data on behalf of the data controller").

The above reconstruction of the subjective roles assumed by the two companies in relation to the processing of personal data related to telemarketing and teleselling activities is confirmed both in light of the current regulatory framework on the subject and the factual elements that emerged during the proceedings.
On this topic, it is worth recalling the EDPB Guidelines 07/2020 on the concepts of data controller and data processor under the GDPR, which state that ownership must be determined based on a functional criterion, based on a factual rather than formal analysis, and that "analysis of the contractual clauses governing the relationships between the various parties involved can facilitate the identification of the entity (or entities) acting as data controller. Even if the contract does not establish who the data controller is, it may contain sufficient information to deduce who decides on the purposes and means of processing. The contract may also explicitly state the identity of the data controller. If there is no reason to doubt that this accurately reflects reality, there is nothing to prevent you from adhering to the contractual provisions. However, these are not absolutely binding, since otherwise the parties could assign responsibilities as they see fit. It is not possible to assume the role of data controller or to exempt oneself from the controller's obligations simply by drafting the contract in a certain way, where this does not correspond to the factual circumstances.

Similarly, according to the aforementioned Guidelines, "The two fundamental conditions for the qualification of data processor are: a) being a separate entity from the data controller; b) processing personal data on behalf of the data controller (...) Processing personal data on behalf of the data controller first of all requires the separate entity to process the personal data for the benefit of the data controller (...) the processing must be carried out on behalf of a data controller, but not under its direct authority or control. Acting "on behalf of" means serving the interests of a third party and recalls the legal concept of "delegation." In the case of data protection legislation, the processor is required to follow the instructions given by the controller at least as regards the purposes of the processing and the essential elements constituting the means of processing (...) However, as mentioned above, the instructions of the controller may leave some discretion as to how to best serve the controller's interests; this allows the processor to choose the most appropriate technical and organizational means».
In this case, for the purposes of correctly characterizing the subjective role played by Energia Verde, the provisions of the contract concluded between the parties are primarily relevant. The contract concerns the assignment of the Ambassador role, i.e., "increasing sales of Energia Verde Italia branded services and products, typically by referring interested parties to the offers" (see Article 2 of the contract).
In the aforementioned agreement, the parties stipulated that "the Ambassador (...) will comply with any directives or guidelines issued by ENERGIA VERDE ITALIA SRL, both to meet marketing needs and to protect the overall reputation of ENERGIA VERDE ITALIA SRL and the brand" (see Article 3 of the contract). that "The prices and conditions of sale are those established by the Principal, ENERGIA VERDE ITALIA SRL, and the Ambassador may only provide information on the conditions of sale of Products and Services, without any power of intervention and assuming responsibility for any information provided inappropriately or in any way incorrectly" (see Article 4 of the contract) and that "Upon termination of the relationship, the Ambassador must return all material in his or her possession provided by the Principal and must immediately cease this role in dealings with the public" (see Article 6 of the contract).
Secondly, the conduct of the Companies in executing the aforementioned agreement is also crucial. Indeed, by the latter's own admission, Energia Pulita operated under the Energia Verde brand, carrying out telemarketing and teleselling activities in the latter's interest, from telephone promotions to the eventual uploading of contracts to company systems.
Contrary to the Company's claims, the assignment of promotional activities in the interest of Energia Verde, a party that also directly benefits financially, constituted the typical characteristics of a controller-processor relationship, since, regardless of the scope of autonomy granted for the performance of the assignment, Energia Pulita acted in Energia Verde's best interests, applied externally determined rates, and was required to comply with the directives issued.

Furthermore, Article 13 of the Italian Civil Code also provides for the performance of promotional activities in the interest of Energia Verde, which also constitutes a direct and indirect contract between Energia Pulita and Energia Verde. 4 of the Code of Conduct on telemarketing (see Provision no. 70 of 9 March 2023, web doc. no. 9868813 and Provision no. 148 of 7 March 2024, web doc. no. 9993808), which regardless of actual compliance assumes, in any case, the value of best practices, provides that "Regardless of the source of the data and regardless of the material accessed to them, it acts as data controller, in accordance with the provisions of art. 4, point 7), of the Regulation, the entity that directly carries out or commissions the implementation of telemarketing and teleselling campaigns via the telephone channel (…) The service providers entrusted with carrying out one or more processing operations related to the execution of telemarketing and teleselling campaigns, or even with obtaining data from list providers, act as data controllers, pursuant to a contract, or other legally binding act pursuant to the law, which includes all the elements and governs all the profiles referred to in Article 28 of the Regulation. This category includes, among others, call centers/telesellers and agencies appointed by the clients to carry out telephone contacts.

On this point, the argument advanced by Energia Verde regarding the circumstance that the subjective roles assumed by the Companies depend on the origin of the contact lists cannot be accepted either.
On the one hand, the fact that Energia Pulita carried out telemarketing and teleselling activities based on independently acquired lists and/or contacts does not invalidate Energia Verde's ownership of the data relating to promotional operations.
At most, in the case of lists acquired independently and on the basis of a process prior and independent of the subsequent transfer for marketing purposes, the entity that created the list (the so-called Publisher) may assume the role of data controller only for the activities preparatory to the creation of the list. However, this does not invalidate the assumption that the person commissioning the promotional campaign using the lists thus acquired, and in whose interest the commercial activity is carried out, assumes the role of data controller in relation to the performance of telemarketing and teleselling activities (see Article 2 of the Telemarketing Code of Conduct: "(...) 'list provider' or 'publisher' means the entity that, even if not primarily related to its own business, acting as data controller, proceeds, by virtue of the consent of the data subjects, to the communication of personal data, independently collected, to third parties for teleselling and telemarketing purposes").
On the other hand, even the emphasis on the margins of autonomy left to Energia Pulita does not rule out Energia Verde's ownership, since the definition of data controller hinges on the entity's decision-making power regarding the purposes and means of processing. It may well be that the data processor is given extensive scope for self-determination, or that the controller never even comes into possession of the personal data processed on its behalf (see Guidelines no. 7/2020, paragraph 45, "It is not necessary for the controller to have actual access to the data being processed. A party that outsources a processing activity and thereby exercises a decisive influence over the purposes and (essential) means of the processing itself (for example, by configuring the parameters of a service in such a way as to define which personal data are to be processed) is to be considered the data controller even if it never has actual access to the data"). On this issue, the Company argued that the data processing carried out by Energia Pulita in the context of promotional activities was aimed at pursuing a specific purpose, since the latter was remunerated based on the expressions of interest from potential customers collected (and not on marketing contacts made) through these activities.
This observation cannot be accepted, as it fails to take into account the distinction between the purpose of personal data processing and the purely economic purpose related to the exercise of business activity.
For the same reasons stated above, it is observed that XX and XX, the two companies used by Energia Pulita to carry out the task entrusted to it by Energia Verde, effectively processed personal data without the required appointment and authorization to act as sub-processors.
The configuration of the subjective roles just described, moreover, appears to be consistent with the current organizational structure and shared by the Company, given that the methods and purposes of the processing carried out by Energia Pulita on behalf of Energia Verde have essentially remained the same, the original contract has not undergone any changes, and the appointment of data processor granted pending the proceedings verbatim recalls the purpose of the original agreement.
Likewise, XX also appears to currently assume the role and responsibilities associated with the role of sub-processor.
Consequently, until March 2024, Energia Verde carried out telemarketing and teleselling activities, using external parties, without the prior and correct assignment of the subjective roles regarding personal data protection and the resulting responsibilities, in the absence of the required appointments pursuant to Article 28 of the Regulation, as well as in violation of the basic accountability duties notoriously incumbent on the data controller.
In other words, until March 2024, Energia Verde relied on external parties to process personal data without first appointing a data processor and obtaining the required authorization to appoint any sub-processors. This violated both the duty of diligence in selecting individuals with adequate privacy expertise (so-called culpa in eligendo) and the failure to adequately supervise their work (so-called culpa in vigilando).
These violations are also confirmed by the statements provided by the Company regarding the lack of controls and guidelines over the work of the data processor and sub-processors, the inability to provide information regarding the origin of the lists used, the information provided, and the consents obtained.
The documentation in the proceedings revealed the existence of certain critical issues, including with respect to the current organizational structure.
Indeed, Energia Pulita, in carrying out personal data processing on behalf of Energia Verde, used XX without the required authorizations and in violation of the data processor's information obligations. From this perspective, too, Energia Verde's persistent lack of control over the operations of its business partners, the lack of effective governance of the data processing chain, and a tendency toward merely formal compliance with the obligations imposed by current data protection legislation, are evident.

Pursuant to Article 28, paragraph 2 of the Regulation, "The processor shall not engage another processor without the prior specific or general written authorization of the controller. In the case of general written authorization, the processor shall inform the controller of any intended changes concerning the addition or replacement of other processors, thereby giving the controller the opportunity to object to such changes."
Energia Verde implemented the aforementioned requirement, first and foremost including in the appointment granted to Energia Pulita a general prohibition on entrusting the processing of personal data to any subcontractors, unless the data controller has issued a specific authorization. At the same time, the same appointment also stipulated that in the event of a general authorization, the processor would have to inform the controller of the intention to modify the group of subprocessors, thus giving Energia Verde the opportunity to object.

Although today's proceedings from the outset focused on identifying the individual roles and the multiple requests for information made by the Authority, Energia Verde has never produced any documentation regarding the issuance of the aforementioned authorization, not even following the challenge and despite the burden of proof regarding compliance with the applicable legislation falling on the data controller pursuant to Articles 5, paragraph 2, and 24 of the Regulation. The proceedings only contain one appointment pursuant to Article 13 of the Regulation. 28 of the Regulation, which, on the contrary, imposes a general prohibition on outsourcing processing operations (Sic!).
The original incorrect classification of the individual roles also resulted in a failure to fulfill the obligations strictly related to such classifications, with particular reference to the implementation of telemarketing and teleselling activities carried out on behalf of Energia Verde.
In this regard, the findings emerging from the examination of the reports and complaints brought to the Authority's attention are particularly significant. The complaints in question are numerous (almost a hundred) and all consistent with one another in outlining the placement of promotional calls using numbers not registered with the ROC and made to data subjects who had expressed their objection by registering in the Public Register of Objections.
The existence of the alleged violations is also confirmed by the outcome of the audit conducted on the contracts signed during the so-called sample week. The investigation in question revealed that in 6% of cases (i.e., 5 out of a total of 81), the numbers receiving promotional contacts, which subsequently led to the signing of a supply contract, were registered with the RPO at the time the promotional call was made. This figure, which at first glance might appear insignificant, appears particularly significant when contextualized within the current owner's turnover. Indeed, on the one hand, projecting the results of the so-called sample week over an entire calendar year, it emerges that Energia Verde likely collected the proceeds of approximately 250 supply contracts per year resulting from originally illicit contacts. Moreover, those just mentioned are only the successful telephone contacts, as they resulted in the activation of a supply; however, the promotional contacts actually made without the required legality were likely much more numerous. On the other hand, the percentage in question reflects—in proportion to the Company's turnover—the same trend recorded in completely similar proceedings against owners operating in the energy sector (see 7% - Order of April 11, 2024, No. 204, Web Doc. No. 10008019; 6% - Order of April 11, 2024, No. 205, Web Doc. No. 1000807; 6%; 7% - Order of June 6, 2024, No. 342, Web Doc. No. 10029424).
On this point, the Company disputed the accuracy of the methodology used for the aforementioned random audit, arguing that the time frame considered was too short and that it did not take into account the progress or frequency of promotional campaigns.
Indeed, the Authority has long been using the so-called "sample week" criterion, which in numerous similar proceedings has yielded decisive evidentiary findings, confirming the circumstances brought to the Authority's attention through the reports and complaints filed by the Authority. Furthermore, the time frame considered appears entirely appropriate, as it encompasses the entire span of a week and, as a result, also takes into account the specific circumstances of Saturdays and Sundays. Conversely, considering a longer time frame could make the owner's defense excessively difficult and burdensome, as he would be forced to locate and produce a burdensome amount of documentation, with the obvious difficulties that such an obligation would entail.
With respect to the findings of the random check, Energia Verde limited itself to a general objection that the fact that the numbers contacted were registered with the RPO does not rule out the possibility that the contacts were made based on consent obtained after registration.
However, simply relying on the legal basis of consent cannot be considered sufficient to establish the lawfulness of the processing performed.
Pursuant to Articles 4, point 11), 6, and 7 of the Regulation, consent is valid when the data subject has been given the opportunity to express their wishes in an informed, free, specific, and unambiguous manner. However, Energia Verde has generically stated that it does not have physical access to the documentation regarding the lists used until March 2024 and, therefore, has not provided any evidence to demonstrate the acquisition of valid consent from the data subjects, the provision of appropriate information, or the checks conducted at FUB before the start of each campaign.
It should also be noted that the processing of personal data for telemarketing and teleselling purposes, carried out on the basis of data collected through the form published on the company website, also violated the required lawfulness requirements.
At the time of notification of the Authority's first request for information, the link to access the information was not properly configured and functioning, with obvious implications for the validity of any consent given and the fairness and transparency of the personal data processing carried out in the Company's interest.
Subsequently, the configuration adopted upon notification of the initiation of the proceeding also did not appear to be in line with the current regulatory framework, for two reasons.
On the one hand, the information was completely lacking in clarity and transparency, as it did not allow for an easy distinction between the legal bases underlying the various purposes of the processing. On the other hand, the consent forms at the bottom of the contact form (see "I consent to the processing of my personal data by Energia Verde Italia SPA for the purposes set out in point 5 of the privacy policy" and "I consent to the processing of my personal data by Energia Verde Italia SPA for the purposes set out in point 6 of the privacy policy") did not comply with the principle of specificity and granularity of consent, given that sections 5 and 6 of the privacy policy listed numerous and different purposes of data processing (e.g., data processing related to website navigation, marketing, profiling, purchase order management, etc.).
Therefore, the personal data collected through these forms were processed without an appropriate legal basis and in violation of the principles of fairness and transparency.
Furthermore, the data controller had not even implemented measures to verify the identity of the individual providing the data and/or submitting the contact requests. Therefore, from this perspective too, the telemarketing and teleselling activities carried out on behalf of Energia Verde appear to be in violation of the provisions of Articles 5, 6, and 7 of the Regulation and Article 130 of the Code.
Regarding the current organizational structure regarding the protection of personal data, while the effort made to promptly adapt corporate governance to current legislation is commendable, it is believed that some critical issues still exist.
First, the reference to legitimate interest as the legal basis for the processing of personal data belonging to "Prospects whose numbers are present in the general lists and are not registered with the RPO" for marketing purposes does not appear to be in line with current legislation (see section 2, Telemarketing Procedure).
The processing of personal data for marketing purposes is governed by Article 130 of the Code, which transposed and implemented into Italian law Article 13 of Directive 2002/58/EC regarding unsolicited communications via electronic communication tools. Among these tools, the telephone can certainly be included, which, depending on the method of conveying the message (with or without an operator), may fall within the categories governed by Article 130 of the Code. More specifically, if the telephone call is made without the intervention of an operator (with automated calling systems), the provisions of Article 130, paragraph 1, of the Code apply; if the contact is made with the intervention of an operator, paragraphs 3 and 3-bis of the same Article apply. This interpretation is consistent with the framework of the aforementioned Article. Article 13 of Directive 2002/58/EC provides that contact made through automated calling systems without operator intervention is permitted only with the consent of the data subject or user. Only in the specific case where contact is made using the telephone channel with an operator, Member States have the option of choosing whether to maintain the legal basis of consent (opt-in) or to deem such calls freely available without an express refusal (opt-out), which, in Italy, can be exercised by registering the user in the Public Register of Objections. It is therefore clear that the processing of personal data for the sending of advertising or direct selling materials or for market research or commercial communications can only be carried out with the prior valid consent of the data subject, and that the case governed by Article 130, paragraph 3-bis of the Code constitutes an exception to the general rule of consent.
Furthermore, contrary to Energia Verde's claims, correctly identifying the legal basis for processing is not a merely theoretical issue, but is extremely important, since it constitutes the condition for the lawfulness of processing and must be indicated in the information provided to the data subject. Furthermore, the legal basis used determines, on the one hand, the different nature of the obligations incumbent on the data controller and, on the other, the rights of the data subject.
In this case, despite invoking legitimate interest, the Company has neither deduced nor documented the existence of the conditions required for the use of the legal basis in question, such as the identification of the legitimate interest pursued, the assessment of the necessity of processing for the purposes of achieving the legitimate interest pursued, and the balancing exercise performed with the fundamental rights and freedoms of the data subjects (see Guidelines 1/2024 on processing of personal data based on Article 6(1)(f)).
It is also noted that among the recently implemented measures regarding the controls on the work of the Data Processors, also indicated within the procedure in question, the blocking of the activation of the supply in the event of anomalies regarding the lawfulness of the original contact and dialogue with the interested party to test the persistence of the will to enter into the contract has not been contemplated (see art. 16, paragraph 6 of the Code of Conduct on Telemarketing "The client develops its processes so that the contracts stipulated following teleselling activities take place in the presence of an unequivocal consent to the original contact, except in cases falling within the scope of application of art. 130, paragraph 3-bis of the Code. In the first application of this Code of Conduct and for the exclusive protection of the interested party, if following the controls contracts emerge for which the first contact is found to be flawed, such contracts may continue to be executed provided that the client informs the interested party of the flawed origin of the contract and that the interested party confirms its intention to maintain it, except in residual cases in which the customer does not follow up on proven attempts to contact the client.)
In relation to this aspect, Energia Verde, even after the dispute, did not provide any suitable information to illustrate the controls implemented to verify the legality of the entire process from contact to contract. It limited itself to raising the very general objection that the failure to provide for telemarketing activities in the procedure does not preclude the implementation of such obligations and that this failure was due to the intention to regulate only the phase relating to promotional contact and not the phase strictly related to contract activation. This objection is not persuasive, since the procedure in question also repeatedly refers to teleselling and the phase following the uploading of proposals to the company systems.
Finally, from another and different perspective, it is noted that in more than one of the complaints brought to the Authority's attention, the interested parties, under their own criminal responsibility, declared that they had previously contacted the data controller to exercise their rights, but that they nevertheless received generic and unsatisfactory responses to their claims (see file no. 338898 "We are sorry. Energia Verde Italia uses external sales agencies, therefore we are unable to verify their operations directly. We will send them a certified email instructing them to remove your name from the database" and file no. 326006 "Dear User, Energia Verde Italia uses external sales agencies, therefore we are unable to provide you with this information directly. However, we have sent a certified email to all our sales agencies, instructing them to remove your name from their database if it was present"). The observations provided by the interested parties, supported by relevant documentation, when considered in conjunction with the adoption of a company procedure for managing requests to exercise data subjects' rights, which occurred significantly later than the entry into force of the Regulation, make it necessary to also attribute to the Company the violation of Articles 12 and 15 to 22 et seq. of the Regulation.
Energia Verde's liability for all the alleged violations must therefore be confirmed.
4. CONCLUSIONS
Based on the above, Energia Verde's liability for the following violations is deemed established:
a) Articles 157 of the Code, in relation to Articles 31 and 58 of the Regulation, for the inadequate and late response to requests for information made by the Authority;
b) Articles 5, 24, and 28 of the Regulation, also in relation to Article 157 of the Regulation. 4 of the same Regulation, for processing personal data without prior and correct identification of the individual roles, as well as for the consequent failure to fulfill the obligations arising therefrom;
c) Articles 5, 6, 7, and 24 of the Regulation, as well as Article 130 of the Code, for having processed the personal data of energy sector users and contractors described above in violation of the principles of lawfulness and accountability, in the absence of an appropriate legal basis and by implementing inadequate technical and organizational measures to ensure, from the design stage, and to be able to demonstrate, that the processing is carried out in accordance with the Regulation, with reference to the suitability of the legal basis and the granting of proper consent;
d) Articles 12 and 15-22 of the Regulation for the failure and/or inadequate response to requests from data subjects to exercise their rights and the failure to adopt appropriate measures to properly manage such requests.
Having also established the unlawfulness of the Company's conduct with regard to the processing operations under consideration, it is necessary to:
- prohibit Energia Verde, pursuant to Article 58, paragraph 2, letter f) of the Regulation, from any further processing of the data belonging to the whistleblowers and complainants identified above;
- order Energia Verde, pursuant to Article 58, paragraph 2, letters d) and e) of the Regulation, to communicate the results of today's proceedings to the five data subjects whose personal data were entered into the Company's systems following unlawful contact, based on a text to be agreed with the Authority during the implementation of this provision;
- order Energia Verde, pursuant to Article 58, paragraph 2, letter f) of the Regulation, to: d) of the Regulation, to implement adequate controls within its sales network and adequately implement systems to prevent contracts generated by illicit contacts from entering the company's assets;
- order Energia Verde, pursuant to Art. 58, paragraph 2, letter d) of the Regulation, to implement adequate measures to ascertain the identity and role of all individuals belonging to its sales network, including by granting the appointments and authorizations required by the legislation on the protection of personal data;
- order Energia Verde, pursuant to Art. 58, paragraph 2, letter d) of the Regulation, if it intends to carry out future promotional activities using personal data collected through online forms, to implement adequate forms for obtaining consent and appropriate information, as well as measures to guarantee the identity of the individuals providing such personal data;
- issue an injunction, pursuant to Articles 166, paragraph 7, of the Code and 18 of Law No. 689/1981, for the application of the administrative pecuniary sanction against Energia Verde pursuant to Article 83, paragraphs 3 and 5, of the Regulation.
5. INJUNCTION ORDER FOR THE APPLICATION OF THE ADMINISTRATIVE PECUNIARY SANCTION
The above violations require the adoption of an injunction order, pursuant to Articles 166, paragraph 7, of the Code and 18 of Law No. 689/1981, for the application of the administrative pecuniary sanction against Energia Verde pursuant to Article 83, paragraphs 3 and 5, of the Regulation (payment of a sum of up to €20,000,000.00 or, for companies, up to 4% of the annual worldwide turnover of the previous financial year, whichever is higher).
To determine the maximum fine, it is therefore necessary to refer to Energia Verde's turnover, as derived from the latest available financial statements (2023), in accordance with previous provisions adopted by the Authority. Therefore, in this case, the maximum fine is set at €20,000,000.
To determine the amount of the fine, it is necessary to take into account the elements indicated in Article 83, paragraph 2, of the Regulation;
In this case, the following are relevant:
1) the seriousness of the violations, taking into account the subject matter and purposes of the data processed, which are attributable to the overall phenomenon of telemarketing. In addition to the aforementioned Telemarketing Code of Conduct, the Authority has adopted numerous measures, particularly over the past five years, which have fully addressed the many critical issues, providing data controllers with numerous guidelines for adapting processing to current legislation and mitigating the impact of nuisance calls on data subjects (Article 83, paragraph 2, letter a) of the Regulation);

2) as a mitigating factor, the implementation, already pending the proceedings, of corrective measures to improve the Company's compliance with personal data protection (Article 83, paragraph 2, letter k) of the Regulation).
Based on all of the above factors, and on the principles of effectiveness, proportionality, and dissuasiveness set forth in Article 83, paragraph 1, of the Regulation, and taking into account the necessary balance between data subject rights and freedom of enterprise, also to limit the financial impact of the fine on the Company's organizational and functional needs, Energia Verde is deemed to be subject to the administrative sanction of €100,000.00 (one hundred thousand), equal to 0.5% of the maximum statutory fine.
In the case in question, it is deemed that the additional sanction of publication of this provision on the Garante's website, provided for by Article 166, paragraph 7 of the Code and Article 16 of the Garante's Regulation No. 1/2019, should apply, taking into account the nature of the Company's processing and conduct, as well as the risks to the rights and freedoms of data subjects.
In implementation of the principles set forth in Article 83, paragraph 1, of the Regulation, the Company is deemed to be subject to the administrative sanction of €100,000.00 (one hundred thousand). 83 of the Regulation, the imposition of this additional sanction appears reasonable and proportionate in relation to the duration and severity of the violations, also taking into account in particular the failure to comply with those requirements that must be considered indispensable and fundamental for the maintenance of any privacy system, such as cooperation with the Supervisory Authority, as well as the correct identification of the individual roles and the legal basis of the processing.
Finally, the conditions set out in Article 17 of Regulation No. 1/2019 concerning internal procedures with external relevance, aimed at carrying out the tasks and exercising the powers delegated to the Garante, are met.
NOW CONSIDERING ALL THE ABOVE, THE GUARANTOR
a) pursuant to Article 57, paragraph 1, letter b) of the GDPR, 58, paragraph 2, letter f) of the Regulation, declares the processing carried out by Energia Verde S.p.A., with registered office in Salerno (SA), Corso Garibaldi, 150, VAT number 05959600650, to be unlawful, in accordance with the grounds set out in the decision;
b) imposes on Energia Verde, pursuant to Article 58, paragraph 2, letter f) of the Regulation, a ban on any further processing of the data belonging to the whistleblowers and complainants;
c) orders Energia Verde, pursuant to Article 58, paragraph 2, letters d) and e) of the Regulation, to communicate the results of today's proceedings to the five data subjects whose personal data were entered into the Company's systems following unlawful contact, based on a text to be agreed with the Authority during the application of this provision;
d) orders Energia Verde, pursuant to Article 58, paragraph 2, letter f) of the Regulation. 2, letter d) to implement adequate controls within its sales network and adequately implement systems to prevent contracts generated by illicit contacts from entering the company's assets;
e) orders Energia Verde, pursuant to Art. 58, paragraph 2, letter d), to implement adequate measures to ascertain the identity and role of all individuals belonging to its sales network, including granting the appointments and authorizations required by personal data protection legislation;
f) orders Energia Verde, pursuant to Art. 58, paragraph 2, letter d) of the Regulation, if it intends to carry out promotional activities using personal data collected through online forms in the future, to implement adequate forms for obtaining consent and appropriate information, as well as measures to guarantee the identity of the individuals providing such personal data;
g) orders Energia Verde, pursuant to Art. 157 of the Code, to notify the Authority, within thirty days of notification of this provision, of the steps taken to implement the measure imposed; any failure to comply with the provisions of this point may result in the application of the administrative pecuniary sanction provided for in Article 83, paragraph 5, of the Regulation;
ORDERS
Energia Verde S.p.A., represented by its legal representative pro tempore, with registered office in Salerno (SA), Corso Garibaldi, 150, VAT number 05959600650, to pay the sum of €100,000.00 (one hundred thousand/00) as an administrative pecuniary sanction for the violations indicated in the justification, representing that the offender, pursuant to Article 166, paragraph 8, of the Code, has the right to settle the dispute by complying with the provisions set forth and paying, within thirty days, an amount equal to half the fine imposed.
ORDERS
the aforementioned Company, in the event of failure to settle the dispute pursuant to Article 166, paragraph 8, of the Code, to pay the sum of €100,000.00 (one hundred thousand/00), according to the methods indicated in the attachment, within 30 days of notification of this provision, under penalty of the adoption of the consequent enforcement actions pursuant to Article 27 of Law No. 689/1981.
ORDERS
a) the publication of this provision, pursuant to Articles 154-bis of the Code and 37 of Regulation No. 1/2019;
b) the application of the additional sanction of publication of this injunction on the Authority's website, as provided for by Articles 166, paragraph 7, of the Code and 16 of the Authority's Regulation No. 1/2019;
c) the recording of this provision in the Authority's internal register—provided for by Article 57, paragraph 1, letter u), of the Regulation, as well as Article 17 of Regulation No. 1/2019 concerning internal procedures of external relevance, aimed at carrying out the tasks and exercising the powers delegated to the Authority—relating to violations and measures adopted in accordance with Article 58, paragraph 2, of the Regulation itself.
Pursuant to Article 78 of the Regulation, as well as Articles 152 of the Code and 10 of Legislative Decree No. 1 of September 1, 2011. 150, an appeal against this provision may be lodged with the ordinary judicial authority, with an appeal filed with the ordinary court of the place where the data controller resides, or, alternatively, with the court of the place of residence of the interested party, within thirty days from the date of notification of the provision itself, or sixty days if the appellant resides abroad.
Rome, April 29, 2025
THE PRESIDENT
Stanzione
THE REPORTER
Scorza
THE ACTING SECRETARY GENERAL
Filippi