TL;DR for the DPO
Decision no. 170/2026: EUR 563,052 to Enel Energia. Breaches of Arts. 5, 6, 7, 24 and 28 GDPR and Art. 130 of the Italian Privacy Code: (1) a service call used to sell = change of purpose without a legal basis; (2) an SMS opt-out with 90 seconds to refuse is not consent; (3) partner controls activated only after the proceeding started, and an agency already sanctioned for marketing re-contracted two months later. Beyond the fine, an order to fix the entire chain.
The three points that matter
- Purpose does not stretch by itself: if you call to complete paperwork (contract performance), that legal basis does NOT cover a commercial offer in the same call. Marketing needs its own, verifiable, prior consent.
- Opt-out is not consent: an SMS with a link to click within 90 seconds NOT to be re-contacted reverses the GDPR logic. The DPA points the other way: double opt-in, with a positive action by the person.
- The chain is the controller's responsibility (Arts. 24 and 28): contractual penalties on paper are worthless if controls start only when the authority knocks. Contracting a partner just sanctioned for marketing is an own goal in an investigation.
What to do now, in practice
For every client making phone contacts: 1) separate service calls from commercial ones with scripts and training - operators must not 'seize the opportunity'; 2) check how marketing consent is collected: if the mechanism is an opt-out, rebuild it; 3) audit partners/call centres: upstream consents, opt-out register checks, and DOCUMENTED controls (not just clauses). The Art. 30 record must distinguish the two purposes with their legal bases.
Why it matters for your clients
You do not need to be Enel: any SME whose customer desk 'while we are at it' pitches an offer is doing exactly the same thing. This decision is the concrete example to bring to front-office training: the difference between a lawful call and a breach is one sentence spoken on the phone.
Official source:Italian Data Protection Authority - decision no. 170 of 12 March 2026 (Enel Energia S.p.A.)Looking for a workspace for your DPO work?
DPO Workspace is built by a certified DPO. 30-day free trial.
Start free
