Rinascente – €300,000 Fine (Italy, 2023)

The data subject was a client of La Rinascente store, the controller, and had a loyalty card, the "Rinascentecard". In July 2021, she visited a store and had an argument with an employee. Later on that same day, she received an e-mail notifying her of the successful activation of a new loyalty card. The new card, that she never requested, had her personal details modified and her name was changed to "Donzella Svampita" (approximately, "Ditzy damsel"). Then, she contacted the Customer Service, which informed her that the Rinascentecard, activated years ago, had been canceled and replaced by the new one, with the new name indicated above. She felt offended and filed a complaint with the Italian DPA. The DPA first requested some information form the controller about the possible data breach. Later, it decided to further investigate the facts and carry out an on-site inspection. In this inspection, the DPA identified other issues, namely: a) the lack of information regarding the transfer of personal data of website visitors to Facebook-Meta for advertising and profiling purposes; b) the lack of a DPIA performed prior to profiling activities; c) the lack of information regarding the storage period of personal data from clients registered in the loyalty program. In its defense, the controller argued that as soon as it learned about the activation of the new card, it opened an investigation and find out that an employee acted in violation of the company's procedures and modified the name and surname of the data subject without authorization. According to the controller, there was no further processing of her personal data, nor any data loss. Moreover, the controller stated that the name of the data subject was corrected in its systems. On the other hand, when presenting its defense, the controller admitted that it had detected another personal data breach caused by a misalignment of its systems. In this second data breach, 5 customers erroneously received communications relating to the orders of 70 other users. However, the controller considered that this breach represented a low risk for the rights and freedoms of the data subjects and decided not to notify the DPA. With regard to the lack of information about its marketing activities, the controller argued that it has a contract with Facebook, according to which, the latter is a processor for “Custom Audience CRM campaigns”, while for “Standard Campaigns” they act as joint controllers. It further clarified that these targeting campaigns are carried out either through prospecting (search for new users potentially interested in Rinascente products) or retargeting (contact of users who have already visited the Rinascente site). However, it claimed that the lists of data subjects registered in Rinascente's CRM are not used, but only the lists of Meta users. The controller also provided a copy of the Rinascentecard privacy policy, as well as the consent acquisition formula for marketing and/or profiling activities. It also informed that currently it shares 1,398.563 encrypted e-mail addresses with Meta for marketing purposes. As for the lack of a DPIA, the controller stated that its a marketing activities were carried out on the basis of raw and unprocessed data, without any deductive or inferential analysis of behavior or identification of correlations with respect to general behavioral clusters. In its view, a DPIA was not required in this context. Finally, the controller stated that personal data for marketing activities are kept for a maximum term of 7 years. The DPA concluded that the data breach attributable to the employee should be archived as it was a result of their autonomous decision to violate the controller's instructions. However, it considered the controller was responsible for second data breach, which was admitted in its response. According to the DPA, the controller failed to implement sufficient organizational and technical measures to ensure an adequate level of confidentiality in this case. Therefore, it found a violation of Articles 5(1)(f) and 32(1)(b) and (d) GDPR. With regard to the marketing activities, the DPA considered that the updated version of the privacy policy provided by the controller clarified the role of the latter in the campaigns. In particular, the DPA found that there was sufficient information about profiling cookies used for retargeting (including that of Facebook) in the new cookie policy and that valid consent was collected through the new cookie banner present on the controller's website. In addition, the DPA noted that users can access more detailed information on the individual cookies via the links available therein. As for the prospecting of new customers, the DPA stressed that information related to "Custom Audience CRM Campaigns" should be provided only by La Rinascente, as the exclusive controller of its customers' data. In this case, the DPA highlighted that Meta was not able to process the customers' personal data as they are subjected to a hashing procedure. Therefore, the DPA decided to archive the dispute in this regard. On the other hand, the DPA stated that the controller carried out profiling activities because, as described in its memorandum, these activities consist of "assessing consumption habits and carrying out market analysis and research in order to improve its commercial offers and sending customers promotions and invitations suited to their preferences". The DPA recalled that if two or more of the criteria established by the EDPB Guidelines on DPIA are present, the controller must carry out the assessment. In the present case, the DPA noted the presence of two of these criteria, namely: the analysis of consumer behavior for profiling and the large-scale processing of personal data. Therefore, it held that the controller should have performed a DPIA, which did not occur. For this reason, the DPA found a violation of Article 35(1) GDPR. Finally, as for the retention of data, the DPA emphasized that, pursuant to the principle of storage limitation, the period that personal data can be stored must be limited to the minimum necessary. In the case at hand, it considered the indistinct 7-year data retention term as excessive and incongruent. The DPA reinforced that, especially with regard to an intrusive processing of personal data, such as profiling, the retention period should be clearly determined. However, the information provided by the controller refers to the fulfillment of generic "legal obligations" and to indistinct series of "provisions of the Garante", references that inevitably force the user/customer to try to find these sources, which is a difficult task. While acknowledging that the controller has taken steps to improve this information, making explicit the retention period of 7 years, the DPA held that it was still necessary to establish and apply differentiated storage periods for product categories, distinguishing marketing processing activities from those for profiling purposes, as well as clarifying if after the term the data is deleted or anonymized. Therefore, the DPA found a violation of Article 5(1)(a), (b), (c), and (e) and Article 12(1) GDPR. For the reasons above, the DPA imposed a fine of €300,000 on the controller.