A.C. Group S.r.l.s. – €10,000 Fine (Italy, 2023)

On 2 February 2023, a complaint was submitted to the Italian DPA regarding the receipt on 30 December 2022 of an unsolicited telephone call from A.C. Group S.r.l.s. (the controller). The complainant stated that the controller had contacted him, although his user account was registered in the Italian Public Opt-out Registry (RPO). The RPO is an Italian registry extended to all national phone numbers, which allows citizens to opt-out of unwanted telemarketing calls. The complainant also considered unsatisfactory the controller's response to his request to exercise his rights under Articles 15, 17 and 21 GDPR brought on 4 January 2023. On 8 February 2023, the DPA requested further clarification, which the controller provided on 23 February 2023. The controller explained that it had obtained the telephone contact of the data subject from a third party, an American company, which had transmitted through WhatsApp the list of names that could be contacted, including the complainant. The controller stated that this had been an exception since business contacts would normally be provided by Italian companies that guaranteed that the contact lists were checked and ensured that the numbers were not in the RPO. It further added that it did not know that the third party was an American company since it only had its telephone number. The DPA noted that the controller carried out its promotional activity without verifying the conditions of lawfulness of the processing, especially without checking whether the complainant had given its consent. From the information gathered, it had been ascertained that the controller did not consult the RPO to check the lists provided by the third parties, even though it guaranteed to do so. It emerged that the controller had also not verified that the third parties had issued to the persons concerned an appropriate information notice under Article 14 GDPR nor that the third parties had acquired specific consent from the data subjects for the data to be shared with third parties (including the controller) for marketing purposes, with consequent effects on the legitimacy of the promotional activities carried out. Therefore, the DPA confirmed a breach of Article 5(1)(a) GDPR, Article 6(1)(a) GDPR, Article 7 GDPR and of [https://www.garanteprivacy.it/codice Article 130 of the Italian Privacy Code] for having carried out telemarketing activities without the prior informed consent of the complainant. Secondly, the DPA noted that the call script used in the promotional contacts contained only an indication of the processing carried out by the controller and a generic reference to the privacy policy to be consulted by accessing its website. However, the text lacked the necessary information on the origin of the personal data and was not enough to make the data subject fully aware of the processing operations carried out by the controller. Moreover, the DPA noted that it was practice for the controller to only accept requests under Article 12 GDPR and provide information under Article 13 GDPR and Article 14 GDPR when the data subjects declared themselves interested in its services. In light of this, the DPA stressed that such practice contravened the requirement of easy accessibility of the information underlying Article 12 GDPR in the broader context of the basic principle of transparency. Thus, the DPA confirmed a violation of Articles 12, 13, and 14 GDPR. Thirdly, the DPA found a violation of Article 5(2) GDPR and Article 24 GDPR since the controller’s processing of personal data for marketing purposes did not meet the requirements of accountability, as well as a violation of Article 5(1) GDPR given that the data processing was not compliant with the lawfulness, correctness and transparency principles. Due to the breaches found, the DPA issued a fine of €10,000 on the controller pursuant to Article 83(1) GDPR.