Autostrade per l’Italia S.p.A – €1,000,000 Fine (Italy, 2023)

In October 2021, Autostrade per l’Italia S.p.A. (a public concession for the management of motorway services) signed a settlement agreement with the Ministry of Infrastructure and Transport providing for the implementation of compensation measures for motorway users, including discounts/refunds on toll rates, in view of the delays caused by construction sites on highways managed by the company. Following this agreement, Free to X, a company owned by Autostrade, was entrusted by the latter with the development and management of a cashback app that would allow users to request a total or partial refund of their toll costs. Both companies agreed that Free to X would be the considered as the controller since it would have "full and autonomous decision-making powers" regarding the purposes and the means of the data processing activities. Free to X launched the homonymous app still in 2021 and the total number of users registered that year was 308,058. Subsequently, Assoutenti, a consumer association, raised some concerns with the Italian DPA regarding personal data processing activities carried out through the app. The DPA opened an investigation and requested information from Autostrade, as the controller. In response, the controller argued that it did not act as a controller, as it limited itself "only to determining the purpose" of the app, without intervening in any way on related purposes and means. However, it committed "to change its role, attributing to itself the controlership of the processing of data relating to the cashback service" and to "amend the app's privacy policy and terms and conditions". Finally, Austostrade stated that it could inform all the app users about the changes by email. First, DPA highlighted that the reimbursement mechanism (cashback app) was chosen by Austostrade as a way to implement the compensatory measures provided for by the agreement signed with the Ministry and that the company was also defining the methods for the fulfillment of such agreement. In particular, the DPA noted that Austostrade appointed Free to X to develop "an IT tool" aimed at offering "a free, smart and user-friendly solution for managing reimbursements on significant delays caused by the presence of construction sites on the motorway sections". Likewise, the company itself identified the conditions and requirements for the user's request for reimbursement and was the one responsible for periodically providing updates to the Ministry on the performance of the cashback system. On the other hand, Free to X, differently from what was represented by Autostrade during the investigations, was acting under its instructions. In this sense, the DPA considered that the roles designated by the companies were irrelevant and that the relative margin of autonomy of Free to X was only in relation to the conception and management of the app. According to the DPA, the choices made by Free to X were "non-essential means" of the processing, as they related to practical aspects for the execution of the service, while the scope and purposes were determined by Autostrade. For these reasons, the DPA held that Austostrade was the controller and Free to X the processor. Second, the DPA recalled that the relation between the two companies should have been regulated on the basis of a contract, pursuant to Article 28 GDPR and that this contract should have bound Free to X as a processor to Autostrade, the controller, and not vice versa. Thus, the DPA found a violation of Article 28 GDPR. Third, the DPA stated that the requalification of the companies’ roles also had immediate repercussions on the respective responsibilities such as the provision of information, pursuant to Article 13 GDPR. It emphasized that Autostrade erroneously identified Free to X as the controller, providing an incorrect information to its customers. According to the DPA, the company also did not provide further information such as the specific purposes of the processing, failing to comply with the principle of lawfulness and transparency provided in Article 5 GDPR, a lawful and transparent processing of personal data. Therefore, the DPA found a violation of Article 5(1)(a) and 13 GDPR. In view of the above, and taking in consideration the significant number of users affected, the DPA imposed a fine of €1,000,000 on the controller.