Verizon Connect Italy S.p.A. – €30,000 Fine (Italy, 2022)

A data subject filed a complaint against Verizon Connect Italy S.p.A., a company providing geolocation services. The data subject claimed to have found a device in the vehicle that they used to deliver goods on behalf of a second company, Giessegi Industria Mobili. The data subject was employed by Giessegi and had no direct relationship with Verizon. Verizon provided geolocation services to Giessegi, which wanted to keep track of its vehicles. The data subject was not informed by the employer about the existence of geolocation devices installed on the vehicle. Therefore, the data subject addressed Verizon, whose name is visible on the device, with an access request. This request did not receive any reply. After examining the defense notes provided by the company, the Italian DPA opened an administrative procedure in order to ascertain potential violations of Articles 5(1)(a), 6 and 28(3) GDPR. During the investigation, Verizon claimed it has no controllership on the processing at issue. In the terms of services signed by Giessegi, Verizon qualified itself as a mere processor of personal data on behalf of Giessegi, which was the true controller. This is also the reason why usually Verizon does not reply to access requests from data subjects but only facilitates access indirectly by providing all relevant data to its clients. In addition, as the agreement with Giessegi expired in 2020, Verizon deactivated its devices and has no longer access to geolocation information. However, the Italian DPA ascertained that a written agreement between Verizon and Giessegi setting up the specific obligations of the processor did not exist. This could lead to a violation of Article 28(3) GDPR. Verizon replied that the obligation to conclude a written agreement between controller and processor is not clearly stated in the GDPR. Such an obligation stems from the [https://edpb.europa.eu/system/files/2021-07/eppb_guidelines_202007_controllerprocessor_final_en.pdf EDPB guidelines 07/202