Telemarketing and controller liability: the case of the record fine against Enel Energia

1. The fact

   According to reports from outlets such as Il Sole 24 Ore, Corriere della Sera, and Agenda Digitale, the case stems from a massive operation by the Finance Guard (Guardia di Finanza) that revealed a hidden chain of sales agencies. Enel Energia was the recipient of an administrative fine of 79,107,101 euros, the highest ever imposed by the Italian DPA. The investigation established that the company's IT systems were unable to block the acquisition of contracts generated by entities outside the official sales network, who used contact lists lacking consent or resulting from data breaches. Currently, the case is at the appeal stage: the company has announced an appeal before the Civil Court to contest the amount of the fine and the applicability of strict liability for the actions of sub-agents. Other aspects of the case, related to unfair competition, are covered in dedicated articles in this column.

2. 

   The legal framework

   The core of the dispute lies in EU Regulation 2016/679 (GDPR).

   1. Art. 5 GDPR mandates the principles of lawfulness and fairness, but above all the principle of accountability, which obliges the controller to demonstrate compliance.
   2. Art. 24 GDPR defines controller liability, who must adopt appropriate technical and organizational measures to ensure processing is compliant.
   3. Art. 25 GDPR introduces privacy by design, requiring data protection to be integrated into systems from their design to prevent illicit inputs.
   4. Art. 28 GDPR regulates the relationship with data processors, stating that the controller must choose only partners that guarantee compliance. Violation of these rules carries fines of up to 4% of the total annual worldwide turnover.

3. What case law says

   Case law from the Court of Cassation has clarified that the data controller is liable for violations committed by commercial partners under the principle of culpa in vigilando. This is not purely strict liability, but rather a failure of active supervision: the controller cannot simply include indemnity clauses in contracts, but must conduct periodic audits and technical checks. Established case law indicates that whoever profits from a complex economic activity must bear the risk associated with the chosen sales channels. Administrative case law has also confirmed that accepting contracts from an unverified supply chain constitutes a form of risk acceptance of the illegality, making the controller fully liable even if the material conduct was carried out by third parties.

5. Analysis drafted and verified with edit.legal

   To verify the provisions cited in this article, we used edit.legal. Test our legal AI on official sources and apply it to your own matters.

   Try edit.legal AI

8. What it teaches professionals

   1. Mandatory Audits: Do not rely on standard contracts; schedule and document periodic inspections of external processors.
   2. Technical Input Verification: Implement traceability systems that prevent data entry if the source of consent cannot be certain.
   3. Sub-processor Management: Prohibit the subcontracting of processing activities without prior specific written authorization from the controller.
   4. Proactive Documentation: Keep proof of every control action taken to invoke the principle of accountability during inspections.

References: Regolamento UE 2016/679 (GDPR)D.Lgs. 196/2003 (Codice Privacy)

Editorial oversight: Avv. Federico Papa·ICAMUpdated 3 November 2026Content drafted with AI support and subject to editorial source checks. Despite these controls, inaccuracies may remain: reports and rectification requests are welcome. Report a correction