Cybersecurity Policy Report, Telemarketing Violations Lead to Fine for Italian Energy Firm, (May 12, 2025)

By Tony Foley

Garante, the Italian data protection authority, has imposed fines and corrective measures against Acea Energia, as well as several other companies involved in a system of contract procurement for the activation of electric and gas supplies, based on aggressive telemarketing practices and illicit processing of personal data in violation of several provisions of the European Union’s General Data Protection Regulation (GDPR).

Garante’s investigation revealed significant evidence of activities carried out through the use of lists of users that had recently changed energy suppliers, Garante said in a news release.

The call center operators contacted these users, mentioning nonexistent technical problems in switching between suppliers and inducing them to choose a new supplier. In addition, executives from Acea Energia had direct and constant contact with those entities carrying out the aggressive telemarketing activities, although Garante noted that, once it learned what had emerged from the investigation, Acea Energia revoked its relationship with these actors and adopted corrective measures.

In its decision, dated April 10, Garante fined Acea Energia 3 million euros ($3.33 million) and ordered the company to communicate the results of the proceeding to all interested parties whose data was illegally entered into its systems and to verify the existence of sub-managers who were not regularly contracted. In a separate decision issued the same day, Garante fined five companies involved in the illicit scheme a total of 850,000 euros ($943,000). The decisions specify that all agencies and companies involved are prohibited from using contact lists whose lawfulness could not be proven.

News: InternationalLegislation LitigationEnforcement DataPrivacy GDPR