Cybersecurity Policy Report, Italian Energy Supplier Faces $5.6M Fine Over GDPR Lapses, (Sep 17, 2024)
Italian data protection authority Garante imposed a fine of 5 million euros ($5.6 million) on electricity and gas supplier Hera Comm S.p.A., finding serious violations of the European Union’s General Data Protection Regulation (GDPR) in the processing of personal data. Garante intervened after numerous reports and complaints regarding unsolicited contracts created with inaccurate and outdated customer data.
Complaints showed that the consumers learned of the new contracts only after receiving—without having any contact with Hera—documentation signed with forged signatures or communications regarding the activation of services. Consumers also complained of Hera’s inaccurate or late responses to consumers’ requests to exercise their rights under the GDPR.
Garante found though its inspections that Hera failed to adopt adequate technical and organizational measures to prevent the illicit use of customer data by door-to-door agents. Garante found that these agents obtained the personal details of interested parties through the use of personal devices by, for example, taking photos of the relevant identification document.
The agents then proceeded to activate service without the consumers’ knowledge, Garante said. In some instances, the agents also activated insurance policies, submitting them with the falsified contracts. Garante found that Hera’s verification system, through which it would confirm the new contracts over the phone with consumers, was inadequate, with activation occurring when the calls were unable to reach the consumers.
In addition to imposing a fine, Garante ordered Hera to take corrective measures, such as adopting a system to stop contracts from being adopted without a successful verifying phone call and carrying out preventive checks and periodic audits to evaluate agents’ work. Hera will also establish data retention policies.
News: LitigationEnforcement DataPrivacy GDPR