A.C. Group S.r.l.s. – €10,000 Fine (Italy, 2023)

On 2 February 2023, a complaint was submitted to the Italian DPA regarding the receipt on 30 December 2022 of an unsolicited telephone call from A.C. Group S.r.l.s. (the controller). The complainant stated that the controller had contacted him, although his user account was registered in the Italian Public Opt-out Registry (RPO). The RPO is an Italian registry extended to all national phone numbers, which allows citizens to opt-out of unwanted telemarketing calls. The complainant also considered unsatisfactory the controller's response to his request to exercise his rights under Articles 15, 17 and 21 GDPR brought on 4 January 2023. On 8 February 2023, the DPA requested further clarification, which the controller provided on 23 February 2023. The controller explained that it had obtained the telephone contact of the data subject from a third party, an American company, which had transmitted through WhatsApp the list of names that could be contacted, including the complainant. The controller stated that this had been an exception since business contacts would normally be provided by Italian companies that guaranteed that the contact lists were checked and ensured that the numbers were not in the RPO. It further added that it did not know that the third party was an American company since it only had its telephone number. The DPA noted that the controller carried out its promotional activity without verifying the conditions of lawfulness of the processing, especially without checking whether the complainant had given its consent. From the information gathered, it had been ascertained that the controller did not consult the RPO to check the lists provided by the third parties, even though it guaranteed to do so. It emerged that the controller had also not verified that the third parties had issued to the persons concerned an appropriate information notice under Article 14 GDPR nor that the third parties had acquired specific consent from the data subjects for the da