The Italian data protection authority (GPDP) sanctions an energy provider for unlawful telemarketing practices, emphasizing the responsibility of the controller for the entire processing chain, including the careful selection and monitoring of its business partners acting as processors.

Facts and context

The Italian data protection authority (GPDP) today published a sanction decision against the company Energia Sostenibile S.r.l., including the imposition of a fine of €100,000, for breaches related to unlawful telemarketing campaigns and poor management of its relationship with its processors.

The case originated from a complaint and more than thirty reports concerning unsolicited calls, including to numbers registered in the Public Opposition Register (RPO), and inadequate responses to data subject rights requests.

Grounds for the decision

• Obligation of lawfulness, fairness and transparency of processing (Articles 5, 6, 7 and 13 of the GDPR): The authority found that the telemarketing campaigns, conducted with deceptive methods and contacting numbers registered in the Public Opposition Register, lacked a valid legal basis. It rejected the company's defense denying responsibility for the calls, considering it the final beneficiary and thus the true controller. Moreover, the website contact form did not allow for freely given, specific and informed consent for marketing and profiling, and the information provided was incomplete.
• Obligation of accountability and management of processors (Articles 5, 24 and 28 of the GDPR): The authority concluded that the company failed to meet its accountability obligations, notably by not formally regulating the relationship with one of its partners through a processor contract compliant with Article 28. Referring to the European Data Protection Board (EDPB) Guidelines 07/2020 on the concepts of controller and processor, it considered the nature of the services entrusted qualified the partner as a processor. The authority also found failures in the selection (culpa in eligendo) and monitoring (culpa in vigilando) of its partners, with audits presented deemed late and insufficient to prove effective and continuous control.
• Obligation to facilitate the exercise of data subject rights (Articles 12 and 15 of the GDPR): The response to an access request was deemed inadequate, lacking transparency and completeness, as the company initially attributed responsibility for the contact to its sales network without providing clear details. This behavior, contrary to the principle of facilitating the exercise of rights recalled by recital 58 of the GDPR, was considered a violation.

Authority's decision

Consequently, the authority imposed a fine of €100,000 on Energia Sostenibile S.r.l..

Furthermore, the authority ordered the company to adopt measures to ensure the lawfulness of its entire processing chain, to ensure its processors provide sufficient guarantees, and to implement effective monitoring of their activities.

Lessons learned

This decision confirms that:

• The final beneficiary of a telemarketing campaign is considered the controller, even in cases of full outsourcing and denial of contacts, and must ensure the lawfulness of the entire processing chain.
• The selection of a processor (culpa in eligendo) cannot rely on informal criteria; it requires a prior and documented assessment of the technical and organizational guarantees it offers, especially regarding data protection.
• The monitoring of processors (culpa in vigilando) must be a continuous and proactive process, demonstrated by regular and substantial audits, not by occasional or reactive checks conducted only in response to an authority's investigation.
• When faced with a data subject rights request concerning processing carried out by a partner, the controller cannot simply refer to the partner but must provide a transparent, complete response and actively facilitate the exercise of rights.