Mas s.r.l. – €1,800,000 Fine (Italy, 2023)

In February 2021, the Italian Financial Police (Guardia di Finanza) informed the Italian DPA that two related companies, MAS S.R.L. and MAS S.R.L.S., were engaging in door-to-door marketing and ilegally using personal data to promote and offer contracts with electric companies. Initially, the DPA opened an investigation only against the two companies. However, the investigations revealed a complex system of direct and indirect contractual relationships, with two companies in the energy sector as final recipients of said marketing services: HERA COMM and ENEL ENERGIA. Operating as part of that system, MAS S.R.L.S. first bought personal data bases from an Italian and a Spanish company and also from an unidentified vendor on Facebook. Then, together with MAS S.R.L., it processed these data for door-to-door marketing on behalf of the electric companies, without telling consumers that they were mere intermediaries. Additionally, the companies did not tell them how they collected their personal data. Moreover, MAS S.R.L. and MAS S.R.L.S. shared the collected personal data with telemarketing companies SESTA IMPRESA and ARNIA, that further processed the data for telephone advertising. During the investigation, no proof of consumer consent was provided. The DPA also found that SESTA IMPRESA got the credentials to access ENEL's infromation systems and shared them with ARNIA. In turn, ARNIA used these credentials to upload the signed contracts into the system without authorization from ENEL. None of the telemarketing companies had a written contract with ENEL appointing them as processors. Although ARNIA had been appointed as a processor by SESTA in 2019, none of the other companies had signed data processing or joint controllership agreements. They were also not appointed as processors or sub-processors by other intermediaries nor by the final customers HERA COMM and ENEL. The DPA also verified that the marketing activities involved a large number of consumers as ARNIA uploaded 260.000 contracts between 2018 and 2022. While ARNIA presented a purely procedural defense, the other investigated companies decided to not defend themselves at all. In its decision, the DPA highlighted the absolute lack of collaboration of the companies with the investigations. It then emphasized that the investigations revealed the functioning of a marketing industry based on a series of illegal practices. According to the DPA, these companies were passing personal data from hand to hand without consumers being aware of it without contractually defining their responsibilities in this data sharing network. With regard to company MAS S.R.L., the DPA found that, in addition to processing personal data for advertising purposes without providing consumers with prior information and obtaining their specific consent, it got them to sign contracts on behalf of ENEL, without having signed a processor agreement. Besides, it shared the data contained in the contracts with SESTA, with whom it also had no written agreement. Therefore, it considered MAS S.R.L. as independent controller since Article 6(1)(b) GDPR only allows the parties to the contract to process personal data necessary for the performance of that contract. The same reasoning was applied in relation to company MAS S.R.L.S., that shared the data with the latter, operating in the exact same environment and having the exact same personnel working indifferently for both companies. As for the company SESTA, the DPA pointed out that, although there was a contract signed with ENEL, such contract did not qualify it as a processor. Therefore, it carried out personal data processing to promote electricity services in the absence of a mandate that would legitimize it to do so, acting as a de facto processor. Likewise, the numerous collaborators, both natural and legal persons, with which SESTA has shared the data were neither legitimized to process it. Finally, regarding ARNIA, the DPA deemed its appointment as a processor by SESTA as ineffective. According to the DPA, this appointment did not correspond to the reality of the facts since SESTA carried out promotional activities as a de facto processor. It held that the only activity that ARNIA carried out under the controllership of SESTA and the other companies were the phone calls with potential customers. However, to make promotional calls, it used the same ilegally obtained database. The DPA then further emphasized that ARNIA ilegally accessed ENEL's IT platforms to perfom data entry operations without being entitled to use its authentication credentials. The DPA also held that ARNIA failed to adequately provide the resquested documents during the investigations. The DPA concluded that there was a violation of Articles 5(1)(a), 6, 7 and 13, of the GDPR as well as Art. 130 of the Italian Privacy Code. Moreover, it considered that the lack of a written agreement violated Articles 28 and 29 GDPR and that the lack of records of the processing activities violated Article 30 GDPR. For theses reasons, it deemed the processing as 'radically ilegal' and orther the companies to stop it. Moreover, it ordered the confiscation of IT and paper files containing the the personal data illegally acquired by them in order to protect the large number of affected data subjects. As a sanction for the violations, it imposed the following fines: * MAS S.R.L. was fined €200,000 for violating Articles 5, 6, 7, 28, 29, and 30 GDPR as well as Art. 130(3) of the Italian Privacy Code; * MAS S.R.L.S. was fined €500,000 for violating Articles 5(1), Article 5(2), 6, 7, 13, 28, 29, and 30 GDPR; * SESTA IMPRESA was fined €300,000 for violating Articles 5(1)(a), 6, 7, 28, 29, and 32 GDPR as well as Art. 2-quaterdecies of the Italian Privacy Code; * ARNIA was fined €800,000 for violating Articles 5(1)(a), Article 6, 7, 13, 28, 29, and 32 GDPR as well as Art. 130(3) of the Italian Privacy Code.