Enel Energia kept calling people who never said yes — Italy's biggest privacy fine, €79M

Enel Energia, the retail arm of Italy's largest energy group, sold electricity and gas the old way: by phone, at scale, through call centres. For years users complained of a barrage of promotional calls — to numbers that had never agreed to be called, repeatedly, after opt-outs that did not stick.

In December 2021 the Italian data-protection authority, the Garante, fined the company over €26.5 million — 15 violations of the GDPR and Italy's privacy code, for aggressive telemarketing on data processed without consent. Enel appealed, and in February 2023 the Tribunal of Rome annulled the sanction — not on the facts but on procedure: the regulator had exceeded its statutory deadline in a case opened in 2018.

The reprieve lasted a year. In February 2024 the Garante fined Enel Energia over €79 million — the largest penalty the authority had ever imposed — finding serious deficiencies in how the company's customer data was processed for telemarketing, including more than 9,300 contracts activated without authorization. In March 2026 came another fine, of over €500,000, for the same category of conduct.