Scionti Selezioni Superiori S.r.l. – €70,000 Fine (Italy, 2023)

Scionti Selezioni Superiori S.r.l. (the data controller) faced scrutiny following numerous complaints received by the Italian DPA in 2022. The complaints highlighted unauthorised phone calls promoting the "Caffè Scionti" brand, particularly targeting individuals registered in the Italian Public Opt-out Registry (RPO). The [https://registrodelleopposizioni.it/en/home/ RPO] is an Italian registry extended to all national phone numbers, which allows citizens to opt-out of unwanted telemarketing calls. Following the DPA's request of 22 November 2022 for information, the controller explained that the unauthorised phone calls happened due to random typing errors. In this regard, it explained that its development and turnover are based on word-of-mouth marketing of customers, as well as by carrying out telephone promotional activities 'in manual mode', which it admitted to have an average of 8 to 12 errors of typing monthly. In early 2023, the DPA received more complaints related to unsolicited phone calls by the controller. Thus, on 24 February 2023, the DPA requested the controller to provide more information for a complete evaluation of its processing activities. The controller confirmed that the database at its disposal for marketing purposes contained data obtained from third parties who, in turn, had been advertising the Scionti brand. But it also complained that its brand had been used by third parties without any authorisation and that it was unable to register to the RPO as an operator and therefore keep track of the existing objections to telemarketing. On the basis of the information provided, the DPA found a systematic lack of compliance with GDPR provisions by the controller. The DPA began by explaining that pursuant to Article 4 GDPR a phone number randomly dialled and called for telemarketing purposes can be considered personal data. Hence, the GDPR and the Italian Privacy Code apply. In light of this, the controller's acquisition of the personal data by word-of-mouth could not be considered valid since the person who provided the data was not entitled to give any valid consent on behalf of the data subject to whom the promotional communication was addressed. Thus, DPA assessed that the controller violated Article 5(1)(a) GDPR, Article 6 GDPR, Article 7 GDPR, Article 13 GDPR and [https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9042678 Article 130 of the Italian Privacy Code] also for not providing any information concerning the data processing to the data subjects. In relation to this, the DPA stated that the controller violated Article 5(1) GDPR, Article 5(2) GDPR, Article 6(1)(a) GDPR and Article 7 GDPR for having utilised personal data acquired from third parties without having verified the existence of the requirements for lawful processing, so the acquisition of the free, specific, documented and informed consent of the persons concerned. The DPA also found a breach of Article 5(1)(a) GDPR, Article 6(1)(a) GDPR, as well as Article 7 GDPR and Article 12(1) GDPR for not having published on its website a transparent information notice regarding the data processing operations conducted, as telemarketing activities were not clearly indicated. It further established a violation of Article 12 GDPR, Article 15 GDPR and Article 21 GDPR as the controller failed to comply with the access requests made by certain data subjects. In some cases, the controller did not provide a full reply to the requests since it limited its answer to explain that the numbers were dialled randomly and that it would remedy the mistake by creating a 'no-go list' of numbers, although such list was never provided to the DPA. In addition, the controller failed to consider the objection requests made by some data subjects. Moreover, the DPA also stated that the controller breached [https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9042678 Article 130(3) of the Italian Privacy Code] for having conducted telemarketing activities without having consulted the RPO. Lastly, the DPA found a violation of Article 5(2) GDPR, Article 24(1) GDPR, Article 24(2) GDPR and Article 25 GDPR for failing to take adequate measures against any third parties that would unlawfully use the Scionti name, although the DPA also alleged that the promotional activity of third parties, allegedly external to the controller, could have been advantageous for the latter. Consequently, the controller was ordered to stop processing personal data for marketing activities without proper consent, was instructed to promptly delete unlawfully obtained personal data, and was mandated to adopt stringent procedures and measures to ensure GDPR compliance in future promotional activities. Additionally, an administrative fine of €70,000 was imposed on the controller, taking into account the seriousness of the violations, inadequate cooperation, and the need for an effective deterrent.