Tiscali Italia S.p.A. – €100,000 Fine (Italy, 2023)

On 3-5 May 2022, as part of the control of marketing and profiling activities conducted by telephone companies, an inspection was directed at Tiscali Italia S.p.A. (the “Controller”). During the investigation, the Italian Data Protection Authority (DPA) found several issues concerning, among the others, the controller’s disclosure and consent for data processing, the call back service by pop-up, the use of so-called "soft spam", the management of denials and objections to processing and the data retention for marketing and profiling purposes. Following the investigation, on 23 June 2022, the controller sent a note to the DPA explaining the work carried out to address the criticisms raised. Thus, on 14 October 2022, the DPA requested further information and proof of the changes carried out. Following the documents provided by the controller, the DPA concluded the following on each point of contention: On the disclosure and consent for data processing: Violation of the principles of fairness and transparency, as stipulated by Article 5(1)(a) GDPR, Article 12(1) GDPR, as well as Article 13(2) GDPR due to the lack of information on the period of data retention for marketing purposes and of the underlying profiling. Secondly, on the call back service by pop-up: No violation of Article 5(1)(a) GDPR and Article 12(1) GDPR , given that the controller addressed the inconsistencies between the consent acquired through the call-back pop-up and that explained in the information notice. Thirdly, on the use of so-called "soft spam": Violation of [https://www.garanteprivacy.it/documents/10160/0/Codice+in+materia+di+protezione+dei+dati+personali+%28Testo+coordinato%29.pdf/b1787d6b-6bce-07da-a38f-3742e3888c1d?version=6.0 Article 130(4) of the Italian Privacy Code] since the controller was sending promotional text messages rather than e-mails to customers who had not given consent for marketing purposes. Fourthly, on the management of denials and objections to processing: Violation of Article 5(2) GDPR and Article 24 GDPR as although the controller acknowledged the objections, it did not make alterations to appropriately handle a system listing the changes in the customers´ consent given. And lastly, on data retention for marketing and profiling purposes: Violation of Article 5(1)(b) GDPR since data retention related to marketing until the withdrawal of consent to processing is also not compliant with Article 7 GDPR, and the controller´s terms of data retention were considered excessively long. The DPA fined the controller €100,000 under Article 58(2)(i) GDPR.