Who was sanctioned, and for what?

Due to errors by a processor of the energy supplier, incorrect details of a direct debit mandate were recorded, so that three bills instead of one were debited from the customer's account; call recordings and the mandate form had not been retained. ZENITH responded inadequately to the access request and did not correct the data (100,000 EUR), while Piraeus Bank infringed the right of access (10,000 EUR and a reprimand); Decision No. 8/2026 of the Hellenic Data Protection Authority.

Authority / court

Αρχή Προστασίας Δεδομένων Προσωπικού Χαρακτήρα (Hellenic DPA)

Area of law

Data protection · Data subject rights and transparency

Legal basis

Art. 5 Abs. 1 lit. d, Art. 12 Abs. 3, Art. 15, Art. 28 DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Energy and utilities

Checked against the official source on 25 Sep 2026 · Direct link

The Walloon water utility recorded and listened in on customer calls for quality control and training purposes; the Litigation Chamber of the Autorité de protection des données (Belgian Data Protection Authority, APD/GBA) found infringements of transparency and fairness as well as in the engagement of a sub-processor. It imposed two fines totalling 86,000 EUR (85,000 + 1,000) after reducing the amounts in view of the situation of the public utility; an appeal against the decision has been lodged with the Market Court.

Authority / court

Autorité de protection des données (APD/GBA) – Chambre Contentieuse

Area of law

Data protection · Data subject rights and transparency

Legal basis

DSGVO Art. 5 Abs. 1 lit. a, Art. 6 Abs. 1, Art. 12 Abs. 1, Art. 13, Art. 28 Abs. 3

Action

Fine

Status of proceedings

under appeal

Sector

Energy and utilities

Checked against the official source on 25 Sep 2026 · Direct link

In 2020, malware entered the water supplier's network via a phishing e-mail and remained undetected for around 20 months; in 2022, attackers obtained administrator rights and stole data on 633,887 people, which ended up on the dark web. The UK Information Commissioner's Office (ICO) criticised, among other things, monitoring of only 5% of the IT environment, outdated software such as Windows Server 2003 and a lack of vulnerability and patch management.

Authority / court

Information Commissioner's Office (ICO)

Area of law

Data protection · Data breaches and data security

Legal basis

UK GDPR Art. 5 Abs. 1 lit. f, Art. 32 Abs. 1

Action

Fine

Status of proceedings

final

Sector

Energy and utilities

Culpability

negligent

Mitigating circumstances

40% reduction for early admission of liability; payment agreed without appeal.

Published

11 May 2026

Original amount 963,900 GBP, converted at the ECB reference rate of 7 May 2026.

Checked against the official source on 25 Sep 2026 · Direct link

A provider of public utility services used GPS transmitters in company vehicles to record employees’ location data permanently and without cause, without defining a purpose, carrying out a balancing of interests or providing sufficient information. The Informacijski pooblaščenec (Information Commissioner of the Republic of Slovenia, IP) imposed 6,000 EUR on the company.

Authority / court

Informacijski pooblaščenec Republike Slovenije (IP)

Area of law

Data protection · Employee data

Legal basis

Art. 5 und Art. 6 DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Energy and utilities

Liability of senior managers

Measures against individuals are not reported here.

Published

15 Apr 2026

Checked against the official source on 28 Sep 2026 · Version 2 · Direct link

The ICO fined Energy Prices Direct Limited, an energy switching broker, £160,000. The ICO found that the company had obtained contact details from public sources and list providers and did not screen them against the TPS/CTPS registers before making marketing calls. The legal basis is regulations 21 and 24 of PECR. Under the notice, timely payment reduces the amount by 20% to £128,000.

Authority / court

Information Commissioner's Office (ICO)

Area of law

Data protection · Marketing and consent

Legal basis

Regulations 21 und 24 PECR; section 55A DPA 1998

Action

Fine

Status of proceedings

unknown

Sector

Energy and utilities

Original amount 160,000 GBP, converted at the ECB reference rate of 30 Mar 2026.

Checked against the official source on 28 Sep 2026 · Version 2 · Direct link

Following a cyber attack in spring 2025 in which data of about 375,000 current and 540,000 former customers was exfiltrated, including bank account, driver's licence and social insurance numbers, Nova Scotia Power signed a compliance letter to the Privacy Commissioner of Canada. The company commits to delete customers' social insurance numbers and, by 31 October 2026, to submit an independent security assessment – including employee training and notification processes – and to report on implementing its recommendations; only then will the investigation be discontinued. According to the letter, the starting point was an employee clicking a link in a pop-up on a compromised website, which installed malware.

Authority / court

Office of the Privacy Commissioner of Canada (OPC)

Area of law

Data protection · Data breaches and data security

Legal basis

Personal Information Protection and Electronic Documents Act (PIPEDA); Einstellung nach Paragraph 12.2(1)(c) bei Erfüllung der Zusagen

Action

Other

Status of proceedings

unknown

Sector

Energy and utilities

Published

25 Mar 2026

Checked against the official source on 3 Oct 2026 · Direct link

Following numerous complaints about marketing calls for Heron, the Archi Prostasias Dedomenon (Hellenic Data Protection Authority) found in Decision 43/2025 shortcomings in the controls over the call centres engaged and in security measures, with the result that subscribers on the opt-out register under Art. 11 of Law 3471/2006 were also called; in addition, some data had been collected unlawfully. It imposed a total of EUR 165,000: EUR 115,000 on Heron (Art. 32 GDPR) together with a warning and an order to introduce, within six months, an audit procedure for call-centre partners with checks at least once a year, EUR 35,000 on ICOMM (5,000 Art. 32, 10,000 Art. 29, 20,000 Art. 5(1)(a) GDPR) with an erasure order, and EUR 15,000 on a further call centre (Art. 32 GDPR).

Authority / court

Αρχή Προστασίας Δεδομένων Προσωπικού Χαρακτήρα (Hellenic Data Protection Authority)

Area of law

Data protection · Marketing and consent

Legal basis

Art. 5 Abs. 1 lit. a, Art. 29, Art. 32, Art. 58 Abs. 2 lit. d, f und i DSGVO; Art. 11 ν. 3471/2006; Art. 21 ν. 2472/1997 i. V. m. Art. 84 ν. 4624/2019

Action

Fine

Status of proceedings

unknown

Sector

Energy and utilities

Checked against the official source on 28 Sep 2026 · Direct link

An employee of the customer service provider was serving two customers in chat at the same time and assigned one customer's e-mail address to the other; as a result, the complainant received the name, debts and billing data of a stranger. The Spanish data protection authority (Agencia Española de Protección de Datos, AEPD) saw the cause in the process design, which allowed parallel chats, and imposed 500,000 EUR for lack of data protection by design; the request for reconsideration was rejected.

Authority / court

Agencia Española de Protección de Datos (AEPD)

Area of law

Data protection · Data processors

Legal basis

Art. 25 DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Energy and utilities

Checked against the official source on 25 Sep 2026 · Direct link

The Bundesnetzagentur (Federal Network Agency) fined an energy company 210,000 EUR for unlawful telephone advertising. Callers often posed as the consumer's energy supplier, and in many cases contracts were foisted on the people called; the company has appealed.

Authority / court

Bundesnetzagentur (BNetzA)

Area of law

Data protection · Marketing and consent

Legal basis

UWG – Verbot unerlaubter Telefonwerbung gegenüber Verbraucherinnen und Verbrauchern

Action

Fine

Status of proceedings

under appeal

Sector

Energy and utilities

Checked against the official source on 2 Oct 2026 · Direct link

The Bundesnetzagentur (Federal Network Agency) imposed fines totalling 100,500 EUR on a solar photovoltaic company: 66,000 EUR for unlawful telephone advertising and 34,500 EUR for withholding caller numbers on sales calls. Callers concealed who the calls were really for and in some cases falsely presented sales calls as mere advisory calls.

Authority / court

Bundesnetzagentur (BNetzA)

Area of law

Data protection · Marketing and consent

Legal basis

UWG – Verbot unerlaubter Telefonwerbung gegenüber Verbraucherinnen und Verbrauchern; Verbot der Rufnummernunterdrückung bei Werbeanrufen

Action

Fine

Status of proceedings

unknown

Sector

Energy and utilities

Checked against the official source on 2 Oct 2026 · Direct link

The Bundesnetzagentur (Federal Network Agency) imposed fines totalling 130,000 EUR on an energy company for its sales calls: 105,000 EUR for unlawful telephone advertising to consumers and 25,000 EUR for withholding caller numbers on sales calls. Callers frequently concealed their identity, so that people called were often signed up to contracts they had not wanted; the company has appealed.

Authority / court

Bundesnetzagentur (BNetzA)

Area of law

Data protection · Marketing and consent

Legal basis

UWG – Verbot unerlaubter Telefonwerbung gegenüber Verbraucherinnen und Verbrauchern; Verbot der Rufnummernunterdrückung bei Werbeanrufen

Action

Fine

Status of proceedings

under appeal

Sector

Energy and utilities

Checked against the official source on 2 Oct 2026 · Direct link

The district heating company stored the passwords of almost 16,000 users of its customer portal ‘Moj račun’ in readable form and, when ‘forgot password’ was used, sent the old password by e-mail. The Agencija za zaštitu osobnih podataka (Croatian Personal Data Protection Agency, AZOP) imposed 320,000 EUR for lack of security measures and insufficient cooperation, as the company neither provided evidence of remediation nor disclosed all information (date = publication).

Authority / court

Agencija za zaštitu osobnih podataka (AZOP)

Area of law

Data protection · Data breaches and data security

Legal basis

Art. 31, Art. 32 DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Energy and utilities

Published

22 Jul 2025

Checked against the official source on 25 Sep 2026 · Direct link

Because another customer's switching request with an almost identical name was recorded in the complainant's customer account, gas and electricity contracts for a supply point unknown to her ran under her data, and a third party, as contract holder, gained access to that data. The AEPD imposed 130,000 EUR for breaching the accuracy principle (Art. 5(1)(d)) and 1,250,000 EUR for inadequate security measures (Art. 32), 1,380,000 EUR in total.

Authority / court

Agencia Española de Protección de Datos (AEPD)

Area of law

Data protection · Data breaches and data security

Legal basis

Art. 5 Abs. 1 lit. d, Art. 32 DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Energy and utilities

Checked against the official source on 28 Sep 2026 · Direct link

Joint investigations with the Guardia di Finanza showed that a network of agencies called people on behalf of Acea Energia who had recently switched energy supplier, pretending there were non-existent technical problems with the switch, and used data lists that had been passed on without consent and without prior information. The Garante (Italian data protection authority) fined Acea Energia 3,000,000 EUR because its control over processors and the sales chain was inadequate; the company must inform the data subjects and review the agencies' contracts with sub-agents. In a separate decision, fines totalling 850,000 EUR were imposed on the agencies and companies involved.

Authority / court

Garante per la protezione dei dati personali

Area of law

Data protection · Marketing and consent

Legal basis

Art. 5 Abs. 1 lit. a und f, 6, 7, 13, 24, 25, 28 und 32 DSGVO; Art. 130 Codice privacy (D.Lgs. 196/2003)

Action

Fine

Status of proceedings

unknown

Sector

Energy and utilities

Culpability

negligent

Mitigating circumstances

Once the investigation findings became known, Acea withdrew the mandate from the agency concerned and took measures to improve security; cooperation during the proceedings.

Published

7 May 2025

Checked against the official source on 28 Sep 2026 · Direct link

A customer denied having registered in the EAC Mobile App and having changed his billing address there; the supplier could not prove that the mobile number used for identification originated from the customer himself. The Επίτροπος Προστασίας Δεδομένων Προσωπικού Χαρακτήρα (Commissioner for Personal Data Protection) found breaches of accountability and data security, issued a reprimand and ordered the delivery address to be clarified with the customer in writing.

Authority / court

Επίτροπος Προστασίας Δεδομένων Προσωπικού Χαρακτήρα (Commissioner for Personal Data Protection)

Area of law

Data protection · Data breaches and data security

Legal basis

Art. 24, Art. 32 DSGVO

Action

Reprimand or warning

Status of proceedings

unknown

Sector

Energy and utilities

Checked against the official source on 25 Sep 2026 · Direct link

Following complaints from three employees, the President of the CNIL (French data protection authority) issued a French energy group with a reprimand (rappel à ses obligations légales under Art. 20 III of the Loi Informatique et Libertés, the French Data Protection Act). The employees were affected by an internal investigation following reports; the company had rejected their objection to the processing without sound reasons, informed them incompletely, refused access requests and answered one request late. On 1 December 2025 the Conseil d'État (French supreme administrative court) confirmed that the processing was based on legitimate interest rather than a legal obligation, so the right to object applied, and that access had to be given, with redactions where needed to protect third parties.

Authority / court

Commission nationale de l'informatique et des libertés (CNIL), présidente

Area of law

Data protection · Employee data

Legal basis

Art. 20 III Loi n° 78-17 du 6 janvier 1978 (Loi Informatique et Libertés); Art. 6 Abs. 1 lit. c und f, 12, 15 und 21 DSGVO

Action

Reprimand or warning

Status of proceedings

final

Sector

Energy and utilities

Employees

10,000 or more

Checked against the official source on 2 Oct 2026 · Company name anonymised since 19 Jul 2026 · Direct link

After 108 reports and 7 complaints about unwanted promotional calls, the Garante (Italian data protection authority) found that calls were made for the energy supplier without consent or to numbers entered in the do-not-call register and that the company did not adequately control agencies and sub-agencies: in a sample week, 657 of 747 contracts stemmed from unlawful contacts. In addition to a fine of 6,419,631 EUR, the authority prohibited further processing of the complainants' data and ordered that the 657 data subjects be informed and that controls be introduced to keep contracts from unlawful contacts out of the systems.

Authority / court

Garante per la protezione dei dati personali

Area of law

Data protection · Marketing and consent

Legal basis

Art. 5 Abs. 1 lit. a, d und f, Abs. 2, Art. 6 Abs. 1 lit. a, 24 Abs. 1, 25 und 28 DSGVO; Art. 130 Abs. 3 und 3-bis Codice privacy (D.Lgs. 196/2003)

Action

Fine

Status of proceedings

unknown

Sector

Energy and utilities

Repeat case

yes

Mitigating circumstances

Mitigating: prompt compliance with earlier orders of the Garante (Art. 83(2)(i) GDPR).

Published

26 Jun 2024

Checked against the official source on 28 Sep 2026 · Company name anonymised since 6 Jun 2026 · Direct link

Unauthorised intermediaries exploited security gaps in the supplier's customer and activation systems for illegal telemarketing; over several years, at least 9,300 contracts were activated, 978 of which were purchased from companies outside the sales network. The Italian data protection authority (Garante per la protezione dei dati personali) imposed 79,107,101 EUR; the Rome court (Tribunale di Roma) upheld the decision on 18 September 2025, and an appeal is pending.

Authority / court

Garante per la protezione dei dati personali

Area of law

Data protection · Marketing and consent

Legal basis

DSGVO; Codice privacy (Telemarketing)

Action

Fine

Status of proceedings

under appeal

Sector

Energy and utilities

Employees

10,000 or more

Published

29 Feb 2024

Checked against the official source on 28 Sep 2026 · Version 4 · Company name anonymised since 8 Feb 2026 · Direct link

The group's parent company, acting as processor, operates a shared database for several group companies; in the attack on the group's grid subsidiary, the attacker also reached customer data of other group companies because the logical separation was inadequate. As the group had not analysed the risks of joint storage or taken appropriate measures, the AEPD imposed 2,000,000 EUR (Art. 5(1)(f)) and 1,000,000 EUR (Art. 32), 3,000,000 EUR in total.

Authority / court

Agencia Española de Protección de Datos (AEPD)

Area of law

Data protection · Data processors

Legal basis

Art. 5 Abs. 1 lit. f, Art. 32 DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Energy and utilities

Published

18 Apr 2024

Checked against the official source on 28 Sep 2026 · Company name anonymised since 7 Feb 2026 · Direct link

A processor working for the energy supplier used data from another supplier's customer database to sign up customers by telephone while giving the impression that it was calling on behalf of their existing provider; the energy supplier only terminated the contract months later. The AEPD imposed 2,500,000 EUR each for breaching fairness and transparency (Art. 5(1)(a)) and accountability (Art. 5(2)), 5,000,000 EUR in total, and ordered a risk analysis and controls over its sales service providers; the request for reconsideration was dismissed.

Authority / court

Agencia Española de Protección de Datos (AEPD)

Area of law

Data protection · Data processors

Legal basis

Art. 5 Abs. 1 lit. a, Art. 5 Abs. 2 DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Energy and utilities

Published

18 Sep 2024

Checked against the official source on 28 Sep 2026 · Company name anonymised since 6 Feb 2026 · Direct link