Coop Italia Società Cooperativa – €90,000 Fine (Italy, 2024)

On 27 January 2022, a data subject contacted the Italian DPA (‘Garante’) regarding the processing activities by Coop Italia Società Cooperativa (‘Coop Italia’ or ‘controller’), one of the largest supermarket chains in Italy. The data subject purchased an e-sim from CoopVoce, Coop Italia’s phone operator service. He kept receiving promotional messages from the controller and, therefore, objected to the processing of his data for these purposes under Article 21(2) GDPR. Additionally, the data subject filed an access request under Article 15 GDPR. The data subject did not receive any response from the controller while he continued receiving additional promotional messages. Therefore, the data subject filed a complaint with the Garante. The controller replied to the Garante’s information request admitting to have sent two further promotional text messages after receiving the objection to processing. They explained that due to a mere and quite exceptional internal misunderstanding they failed to respond to the requests. Nevertheless, the data subject contested the Coop Italia’s reply on the merits. The Garante conducted an inspection at Coop Italia focused on monitoring marketing and profiling activities. The inspection addressed aspects that were not covered by the complaint and revealed that controller collected multitude of data as part of the CoopVoce telephone service. In particular, the controller collected telephone and traffic data, internet browsing data, position, and/or geolocation data related to the use of e-Sim card. The Garante noted a consent to such a significant and diverse array of personal data might not be specific and free to fulfil the requirements of legal basis under Article 6(1)(a) GDPR. The controller said that this data was necessary to perform contractual obligations undertaken by Coop Italia to provide their services. For the purpose of direct marketing, the controller stated that they processed only name and contact data provided by the d