Fabio Giovanni Petta (data controller of the website www.inelenco.com) – €50,000 Fine (Italy, 2022)

Several data subjects randomly searched for their names on the Google Search engine and found out their contact details and names on the website www.inelenco.com. They never knew about the existence of their data on the website and never gave any consent for their publication. Thus, the Italian DPA received many requests, reports and complaints relating to the unauthorized publication of personal data on this website. Moreover, the data subjects tried several times and for several months to request the erasure of their data without any success. Additionally, it contained incorrect data relating to one of the data subjects concerned. Finally, there was no information on the website that enabled the identification of the controller or its owner. Firstly, the DPA conducted a preliminary investigation through the hosting provider – to find out who the controller and owner were – which reported that the service was in use by Mr. Fabio Giovanni Petta who was the sole proprietor and data controller of the website. Secondly, on 14 May 2020, the DPA asked the controller to provide clarifications to which the controller replied with a laconic answer, on 26 May 2020, by merely stating that there was a “delete data” link on each page from which one could access a form to be used to enter the number to be deleted, obtaining automatic removal within 72 hours. The controller requested to receive copies of the applications received to verify the date and IP address of the (alleged) registrations. On 1 September 2020, the DPA forwarded by email, copies of six instances requesting appropriate feedback within 20 days of receipt to the controller. The controller did not respond. On 2 April 2021, the DPA initiated the proceedings for the adoption of corrective measures and sanctions due to the presence of various profiles of unlawfulness found in the processing. The controller did not respond either. Therefore, the DPA had to request the Special Privacy Unit of the Italian Finance Police to provide for the notification of the outstanding acts which was served on 20 December 2021. On 12 January 2022, the controller gave some information about the functioning of his website. Moreover, he stated that all data was automatically deleted from the system after the data subjects had requested it, but the controller did not provide any documents proving this statement. After the objection and even after the company's defensive observations, complaints continued to reach the DPA complaining about the presence of personal data on the www.inelenco.com website without the knowledge of the persons concerned. Moreover, despite repeated requests for deletion made through the link on the website, the data continued to be published. Finally, on 4 May 2022, the website still did not contain any information about the data controller and how to exercise rights. First, the website consisted in a telephone directory. However, its data processing had no legal basis since the current regulatory framework did not allow the creation of generic telephone directories that are not extracted from the DBU (Data Base Unico), the single electronic archive that collects the telephone numbers and customer data of all the national telephony Operators disseminated through public directories. Moreover, it was recalled that for the inclusion of personal data in such lists, the express, free, specific, informed and documented written consent of the contractors is required. As the website did not conform to these criteria, the DPA held that there was a breach of Article 5(1)(a), Article 5(1)(d), Article 5(2), Article 6 GDPR and 129 of the Code. The data controller also breached Article 12(2), Article 15 GDPR, Article 16 GDPR and Article 17 GDPR since it proved impossible for the data subject to know the origin of the data and the methods and purposes of the processing, as well as to request the rectification of inaccurate data or their erasure. A breach of Article 24 GDPR was also found because there was a total lack of adequate technical and organisational measures to ensure that the processing was carried out in accordance with the rules on personal data protection. Moreover, the provision of a contact form that proved ineffective in receiving requests for cancellation also constituted a breach of Article 25 GDPR, since the technical measure adopted was not capable of protecting the rights of the data subjects. Article 12(1) and Article 13 GDPR were also breached due to the lack of an adequate privacy policy on the website. Finally, the data controller breached Article 31 GDPR and 157 of the Code for not having adequately cooperated with the supervisory authority. It is also worth noting that anyone could enter a person’s personal details (names, address, social networks) on the website with no ways to trace the origin of the person who entered the data into the website, this therefore created a high risk of confidentiality. Moreover, the conduct had a generalized scope and extended to a large number of data subjects (357,046). Thus, in light of these different infringement and pursuant to Article 58(2)(f), the Italian DPA imposed a prohibition on the data controller to collect, further store and publish personal data and imposed a fine of 50, 000€ to the data controller pursuant to Article 58(2)(i) and Article 83(5). As set forth in Article 166(8) of the Code, the controller had the right to settle the dispute, with the fulfillment of the prescriptions issued and the payment, within the term of thirty days, of an amount equal to half of the fine imposed.