What happened
Italy's data protection authority, the Garante, fined energy supplier EstEnergy €1.4 million on July 3, 2026 for running an automated credit-scoring system that refused gas and electricity contracts — and then kept applicants in the dark about it. Related decisions the same month fined group company Hera Comm €5.8M, bureau Cerved Group €400k and Experian Italia €120k, for a total of €7.72 million.
The system worked in stages: EstEnergy ran its own checks first, then queried Cerved and Experian, whose two scores were combined into the 'Score CGS-X'. Above a certain threshold the system automatically returned a 'KO' — no contract. According to the Garante, 1,003,657 people went through the external checks between 2022 and March 18, 2024; the decision does not say how many were refused.
When complainants asked EstEnergy about their scores, the company said it did not know the details and directed them to Cerved and Experian. The Garante found the information was 'in fact fully available to EstEnergy' — and in one case, EstEnergy sent a customer a credit report from which it 'deliberately obscured' the section showing the sub-scores. The regulator found breaches of GDPR Articles 5, 12, 13, 14, 15 and 28, and ordered EstEnergy within six months to answer access requests with the score and the logic of its calculation, correct its replies, and provide for human intervention.
Experian was examined separately: the Garante held that its scoring fell within the automated decision-making described by the EU Court of Justice in the SCHUFA case, and fined it €120,000. On July 21, 2026, Hera Comm and EstEnergy said they had already adopted corrective measures and reserved the right to oppose the decision.
What it cost
€1.4M for EstEnergy, €5.8M for group-mate Hera Comm, €400k for Cerved, €120k for Experian — €7.72M total — plus a six-month order to disclose scores and logic.
Why it happened
Automating a 'KO' on an essential service is the highest-stakes use of a credit score — and the company couldn't explain the one number that decided it.
The stonewalling was deliberate: the Garante documented a redacted credit report sent to a customer who asked why.
Blaming the bureaus didn't work — the regulator found the score and its factors sat in EstEnergy's own systems.
The SCHUFA framing pulls ordinary credit scoring into GDPR's strictest rules: an automated decision with legal effects needs explainability and human review.
The lesson
If an algorithm decides who gets an essential service, you must be able to tell each person their score, the reasons behind it, and offer a human review.
Aftermath
The decision of July 3, 2026 allows opposition before the ordinary courts within thirty days; Hera Comm and EstEnergy said on July 21, 2026 that corrective measures were already adopted and they were weighing their options, and no filed opposition was established as of October 3, 2026. EstEnergy must, within six months, give every requester their CGS-X score and how it was calculated, send corrected replies to the complainants, and set up rectification and human-intervention procedures.
FOLLOW THE EVIDENCE