Verizon Connect Italy S.p.A. – €30,000 Fine (Italy, 2022)

A data subject filed a complaint against Verizon Connect Italy S.p.A., a company providing geolocation services. The data subject claimed to have found a device in the vehicle that they used to deliver goods on behalf of a second company, Giessegi Industria Mobili. The data subject was employed by Giessegi and had no direct relationship with Verizon. Verizon provided geolocation services to Giessegi, which wanted to keep track of its vehicles. The data subject was not informed by the employer about the existence of geolocation devices installed on the vehicle. Therefore, the data subject addressed Verizon, whose name is visible on the device, with an access request. This request did not receive any reply. After examining the defense notes provided by the company, the Italian DPA opened an administrative procedure in order to ascertain potential violations of Articles 5(1)(a), 6 and 28(3) GDPR. During the investigation, Verizon claimed it has no controllership on the processing at issue. In the terms of services signed by Giessegi, Verizon qualified itself as a mere processor of personal data on behalf of Giessegi, which was the true controller. This is also the reason why usually Verizon does not reply to access requests from data subjects but only facilitates access indirectly by providing all relevant data to its clients. In addition, as the agreement with Giessegi expired in 2020, Verizon deactivated its devices and has no longer access to geolocation information. However, the Italian DPA ascertained that a written agreement between Verizon and Giessegi setting up the specific obligations of the processor did not exist. This could lead to a violation of Article 28(3) GDPR. Verizon replied that the obligation to conclude a written agreement between controller and processor is not clearly stated in the GDPR. Such an obligation stems from the [https://edpb.europa.eu/system/files/2021-07/eppb_guidelines_202007_controllerprocessor_final_en.pdf EDPB guidelines 07/2020] on the concepts of controller and processor in the GDPR, which were not in place at the time of the facts. Verizon also stressed that it complied with all the processor´s substantial obligations. On the other hand, no violation of Articles 5(1)(a) and 6 GDPR could be found, as these provisions apply only to controllers. The Italian DPA rejected Verizon´s defense. In the first place, the obligation to conclude a written agreement regulating the rights and duties of the processor clearly stems from Article 28(3) GDPR itself. Besides, as far as the Italian jurisdiction is concerned, the obligation also derives from the case law of the Court of Cassation. According to the Italian DPA, there was no need of further clarifications by the EDPB guidelines. The mere fact that the terms of services between Verizon and Giessegi qualified the former as ´processor´ is not sufficient to meet the conditions established by Article 28(3) GDPR. Since such an agreement between controller and processor did not exist, Verizon was subject to the same obligations applicable to the controller, including Articles 5(1)(a) and 6 GDPR. As a matter of fact, Articles 5(1)(a) and 6 GDPR set general principles and conditions of processing which apply regardless of the qualification of the subject processing data. In this case, processing was manifestly unlawful, as it was not possible to find a legal basis applicable to the facts at issues. Therefore, the Italian DPA found a violation of Articles 5(1)(a), 6 and 28(3) GDPR and adopted an administrative fine on the basis of Articles 58(2)(i) and 83 GDPR. The total amount of the fine took into account the long period of time in which the violation occurred (4 years) and the fact that not only the applicant, but also other Giessegi´s employees were involved. On the other hand, the Italian DPA considered that Verizon cooperated with the authority during the investigation and reduces the sanction accordingly. The final amount of the fine was set at 30.000 EUR.