Aggressive Telemarketing: Controller Liability for Supply Chain Violations

1. The facts

   According to reports from outlets such as Rai News, Wired Italia, and Il Sole 24 Ore, the Data Protection Authority imposed a fine of over 79 million euros on a well-known energy company following an investigation triggered by the Italian Financial Police's findings on illegal databases. The case concerns the so-called black chain of telemarketing, a network of agencies that, without a direct mandate, acquired contracts using illicitly obtained data and entered them into the company's systems through partner channels. Currently, the company's opposition against the measure has been rejected by the Court of Rome (judgment no. 12783/2025), confirming the fine. The company's defense argued it was a victim of fraudulent conduct by unfaithful agencies that bypassed existing controls.

2. 

   The rules at play

   The legal framework centers on the accountability principle introduced by EU Regulation 2016/679 (GDPR).

   1. Article 24 of the GDPR requires the data controller to implement appropriate technical and organizational measures to ensure and demonstrate that processing is performed in compliance with the regulation.
   2. Article 28 governs the relationship with data processors, requiring the controller to use only those providing sufficient guarantees and to supervise their work and that of the commercial chain.
   3. Article 25 provides for privacy by design, mandating that IT systems (such as partner portals) be configured to natively prevent the entry of unverified data.
   4. Article 32 imposes security of processing, which in telemarketing translates into the ability to intercept anomalous contract flows from untracked sources.

3. What case law says

   The orientation of higher courts has clarified that the data controller holds a position of guarantee that does not vanish with the outsourcing of promotional activities. According to the courts, a service or agency contract does not sever the liability link if the controller derives an economic benefit from the unlawful processing and fails to prove having taken every possible precaution to prevent it. European case law has also specified that the notion of controller must be interpreted broadly: anyone determining the purposes and means of processing (even indirectly, by accepting contracts from an uncontrolled chain) is liable for systemic violations. Therefore, a contractual indemnity clause is not enough to exclude so-called culpa in vigilando if the data entry systems are vulnerable to massive uploads by unauthorized parties.

5. Analysis drafted and verified with edit.legal

   To verify the provisions cited in this article, we used edit.legal. Test our legal AI on official sources and apply it to your own matters.

   Try edit.legal AI

8. What it teaches professionals

   1. Implement inspection and audit clauses in marketing agency contracts, including the right to physically or digitally verify the origin of consent.
   2. Adopt data entry systems requiring mandatory metadata on source traceability for every single record submitted.
   3. Monitor sales KPIs to identify anomalous spikes in contracts that could signal the entry of unauthorized databases.
   4. Manage commercial chain liability not as a paper indemnity, but as an extension of one's own organizational accountability.

9. Update and rectification note (17 September 2026)

   The previous version of this article incorrectly reported the involvement of 15 million data subjects and qualified the agencies as sub-processors under Art. 28, details not corresponding to the measure. Furthermore, it defined the measure as a final act, omitting the updated procedural stage. The text has been corrected and anonymized in the absence of retrievable public primary sources, specifying that the disputed contracts are about 9,300 (of which 978 from unauthorized agents) and updating the outcome with the rejection of the opposition (Court of Rome 12783/2025).

References: Regolamento UE 2016/679 (GDPR) Art. 24Regolamento UE 2016/679 (GDPR) Art. 28D.Lgs. 196/2003 (Codice Privacy) Art. 130Tribunale di Roma, sentenza n. 12783/2025

Editorial oversight: Avv. Federico Papa·ICAMUpdated 17 September 2026Content drafted with AI support and subject to editorial source checks. Despite these controls, inaccuracies may remain: reports and rectification requests are welcome. Report a correction