Trasporto Passeggeri Emilia-Romagna S.p.A. (TPER) – €50,000 Fine (Italy, 2024)

According to a report submitted to the Italian DPA pursuant to Article 144 of the Italian Privacy Code (‘Code’) a public transport company called Trasporto Passeggeri Emilia-Romagna S.p.A. (‘TPER’ or ‘controller’) collected invalid consent in its printed form for the subscription of seasonal tickets. The form has been in force since 1 July 2016 and is still in use. In particular, the consent in question concerned the following purposes under letters b) and c) of the form: *b) personal data collected and processed by third parties appointed by TPER, used for market research, satisfaction surveys, promotional initiatives, and information dissemination via telephone calls; * c) personal data also processed by appointed third parties for activating the SMS forwarding service, concerning information on strikes and planned changes to the service. The form included information that a failure to give consent would make it impossible for the controller to carry out the processing and, therefore, impossible for the data subject to access the services indicated. The data subjects were not able to express specific consent for each processing purpose envisaged as the form only required a signature from the users at the bottom of the form. Additionally, the printed form stated that providing this data was obligatory for the issuance of TPER's personal identification card. It further asserted that individuals declared that they received and read the information provided according to Article 13 GDPR by purchasing the card. TPER admitted that the expression used in the printed form may be unclear and misleading. The form was not intended to issue a compulsory consent in order to obtain the purchase of the seasonal ticket. In relation to this, TPER added that the printed form bears the wording ‘I consent’ or ‘I do not consent’. Customer’s wish should be expressed orally and entered in the TPER’s system by an operator. The controller also clarified that the duration of the data retention period acquired on the basis of consent in points b) and c) is 10 years after the expiry of the last season ticket. The determination of this period was influenced by the fact that the card is valid for 5 years which allows users to apply for more season tickets during this period. In addition to that, TPER is subjected to various inspections and checks by regional authorities which require a possession of documentary evidence within the 10 years’ time frame. Likewise, TPER needs to preserve the user’s personal data in case of payment recovery activities or possible litigation with users. Therefore, the controller maintained that such period is legally sounds and justified. Following the DPA’s request for information, TPER updated the printed form for subscription and its privacy policy which now includes a reminder to data subjects that they can always revoke any consent given. The updated version also distinguishes in detail all the different types of communication that TPER might send over time. Principle of accountability The assessment of the DPA revealed that several infringements of data processing principles in this case are a result of the fact that TPER – a company serving a large area – failed to review and update its conformity with the GDPR by the time the Regulation came into force on 25 May 2018. TPER. Therefore, breached principle of accountability pursuant to Article 5(2) GDPR. Information on the processing of personal data It emerged from the preliminary investigation that the information notice on the processing of personal data did not mention several elements required by Article 13(1) GDPR. This includes contact details of the DPO, legal basis of the processing, possible recipients of personal data, data retention period, rights of interested parties, existence of the right to withdraw consent at any time and right to lodge a complaint with a DPA. The DPA also found that the information provided is also very generic since it does not clarify the actual circumstances in which the data subjects could have received SMS. The DPA thus found the controller in breach of Article 5(1)(a), 7(3), 12(1), 13 and 21(4) GDPR. Direct marketing purposes and SMS relating to transport service The controller collected and processed personal data of the data subject for purposes of direct marketing and sending SMS messages concerning the status of the service. The DPA assessed that this consent was neither free, specific nor adequately informed. Firstly, pursuant to Article 7(4) GDPR, consent is not considered freely given if a performance of a contract, including provision of a service, is made conditional on the giving of that consent that is not necessary for the performance of the contract. In the present case, the form for subscription to seasonal tickets stated that a failure to consent will hinder TPER from carrying out their services. Secondly, from the perspective of a data subject, it is unclear whether the term ‘services’ refers to the transport services or the promotional activities referred in points b) and c). The data subject is, therefore, led to provide a single consent for different purposes conditioned by the fear that failure to do so will prevent him from using the services. Thirdly, the consent does not provide adequate information since TPER did not clearly inform the data subjects that the processing of their personal data for marketing purposes was based on their optional consent. TPER did not state that not consenting to the processing will not prevent the data subject from obtaining the card. With regard to the abovementioned, the DPA found a violation of Article 5(1)(a), 6(1)(a) and 7 GDPR. Data retention period The DPA took account of the controller’s obligation to comply with the principle of accountability under Article 5(2) GDPR justifying the retention period. However, the principle of accountability does not allow the controller to disregard other fundamental processing principles such as the principle of accuracy under Article 5(1)(d) GDPR. For example, the data processed for marketing purposes cannot be considered adequate for a period of 10 years as the controller violated Article 5(1)(e) GDPR. Consequently, the DPA ordered the controller to comply with its [https://www.garanteprivacy.it/home/docweb/-/docweb-display/docweb/1103045 guidelines] setting data retention period of 24 months for marketing purposes and 12 months for data relating to profiling. For the breach of abovementioned provisions, the DPA ordered the controller to bring processing operations into conformity with the GDPR. Additionally, TPER shall pay a fine in the amount of €50,000.