Contracts without customers' knowledge, the Garante Privacy sanctions Acea

The Privacy Guarantor has fined Acea Energia €2 million for "serious violations in the processing of personal data of more than 1,200 customers for the supply of electricity and gas". The Authority says it intervened after petitions concerning the use of inaccurate and out-of-date data of the company's customers for the conclusion of unsolicited contracts. Inspections at the premises revealed that the processing was carried out by companies appointed by Acea to procure potential customers and that Acea had not adopted appropriate measures to prevent fraudulent use of documents acquired by door-to-door agents.

in particular," reads the Garante's note, "the complainants complained that they learned of the establishment of the supply relationship only after having received communications from Acea of the activation of the supply or payment reminders, claiming that they had never had any contact, either personal or remote, with the company. Some of the complaints also concerned Acea's late or lack of response to requests to exercise their rights under privacy legislation". "The inspections carried out at the company's premises revealed that the processing operations that were the subject of the complaints were carried out by companies commissioned by Acea Energia to procure potential customers, who were not adequately supervised. In fact, the preliminary investigation ascertained that Acea had not adopted technical and organisational measures suitable for preventing any fraudulent use of the documents acquired by the company's door-to-door agents or partners". 'The agents,' continued the note, 'could thus gain possession of the personal details of the persons concerned by means of mobile devices, taking, for example, photos of the documents, and then proceed, without their knowledge, to the activation of the supplies also by means of an apocryphal signature. Inadequate, finally, the monitoring system through recall, aimed at verifying the customer's actual willingness to sign a contract'. The Garante therefore ordered Acea "to adopt various corrective measures, including the use of alerts to monitor agents' compliance with contractual procedures; periodic checks on the accuracy of the information acquired; and the identification of specific retention periods for customer data".