What happened
According to the Garante, EstEnergy used a series of checks when people applied for gas or electricity. It ran its own checks first. If those came back positive, it then queried Cerved and Experian. Their two scores were combined into the “Score CGS-X”. Above a certain threshold, the system automatically returned a “KO”.
The Garante says the investigation began after people complained that EstEnergy had refused to supply them because of a negative score, and that they were not clearly told how that score had been reached. The decision records that the complainants “hanno lamentato il diniego della fornitura di energia, da parte di EstEnergy S.p.A., in ragione della rilevazione di un profilo di rischio” (complained of the refusal of energy supply by EstEnergy because a risk profile was detected).
According to the Garante, 1,003,657 people went through the external checks between 2022 and 18 March 2024. That is the number checked, not the number refused. The decision does not say how many were refused.
What an auditable version would have shown
The decision records that when complainants asked EstEnergy about their score, the company said it did not know the details and directed them to Cerved and Experian. The Garante found the information was “invero nella piena disponibilità di EstEnergy S.p.A.” (in fact fully available to EstEnergy). In none of the complainants’ cases did EstEnergy’s replies include the score.
The decision records that in one case EstEnergy, sending a credit report from April 2022, “ha deliberatamente oscurato la parte dello stesso riportante i sotto-score” (deliberately obscured the part showing the sub-scores). EstEnergy later changed the replies it sent to people asking for information. The Garante found those newer replies still did not contain everything required under Article 15 of the GDPR.
An auditable record would make it possible to give each person refused their score, the factors behind it and the version of the model that produced it.
Where the gap was
The Garante found another problem with the data EstEnergy kept from the checks. The company retained it to consider possible changes to its rating service, and the Garante found that some of this information could become out of date. It did not find that the score itself was wrong.
The decision also notes that people subject to certain automated decisions have the right, under Article 22(3) of the GDPR, to ask for human intervention, give their point of view and challenge the decision.
Experian was examined separately. The Garante held that its scoring fell within the kind of automated decision-making described by the Court of Justice of the European Union in the SCHUFA case. It found breaches of Articles 5(1)(a) and (c), 12, 15 and 25 of the GDPR and fined Experian 120,000 euros.
A MetricRecord is designed to keep signed counts of automated outcomes, such as how many applicants were scored and how many refused.
A ConductRecord keeps each score, the inputs behind it and the model version that produced it.
MetricRecord and ConductRecord are Headlights designs.
What governance should have looked like
The Garante ordered EstEnergy, within six months, to change how it answers these requests. People asking about a decision must be given their CGS-X score and information about how it was calculated. EstEnergy must also send corrected replies to the complainants and put procedures in place for correcting information and requesting human intervention.
The Garante fined EstEnergy 1,400,000 euros. According to the Garante, related decisions fined Hera Comm 5,800,000 euros and Cerved 400,000 euros, and the four fines, including Experian’s, totalled 7,720,000 euros.
The decision allows thirty days from its communication to oppose it before the ordinary courts. On 21 July 2026, Hera Comm and EstEnergy said they had already made corrective changes and were considering their options, including a possible opposition. The sources reviewed do not establish whether one was filed as of 3 October 2026.
Where an organisation refuses an essential service on an automated score, best practice would be to tell each person their score and its main factors when they ask, and to offer a quick route to a human review.
Failure Pattern: according to Italy’s data protection authority, an energy supplier used an automated credit score in refusing contracts, and did not tell the complainants what their score was or how it was calculated, although the information was in its systems.
Governance Principle: an organisation that refuses a service on an automated score should be able to give each person their score, the main factors behind it and a route to a human review.
The reference implementation of MetricRecord and ConductRecord is open source. It lives at github.com/saffronandindia/headlights-oss, Apache 2.0 licensed and free to install. The repository is public now.
Sources
- Provvedimento del 3 luglio 2026, EstEnergy S.p.A., doc. web 10273954 (Garante per la protezione dei dati personali)
- Provvedimento del 3 luglio 2026, Experian Italia S.p.A., doc. web 10273659 (Garante per la protezione dei dati personali)
- Comunicato stampa: Energia, Garante: Sì alla conoscenza dello score alla base del contratto negato (Garante per la protezione dei dati personali, 21 July 2026)
- Hera Comm ed EstEnergy: provvedimenti Garante privacy (statement reported by Agenzia Giornalistica Opinione, 21 July 2026)