Coop Italia Società Cooperativa – €90,000 Fine (Italy, 2024)

On 27 January 2022, a data subject contacted the Italian DPA (‘Garante’) regarding the processing activities by Coop Italia Società Cooperativa (‘Coop Italia’ or ‘controller’), one of the largest supermarket chains in Italy. The data subject purchased an e-sim from CoopVoce, Coop Italia’s phone operator service. He kept receiving promotional messages from the controller and, therefore, objected to the processing of his data for these purposes under Article 21(2) GDPR. Additionally, the data subject filed an access request under Article 15 GDPR. The data subject did not receive any response from the controller while he continued receiving additional promotional messages. Therefore, the data subject filed a complaint with the Garante. The controller replied to the Garante’s information request admitting to have sent two further promotional text messages after receiving the objection to processing. They explained that due to a mere and quite exceptional internal misunderstanding they failed to respond to the requests. Nevertheless, the data subject contested the Coop Italia’s reply on the merits. The Garante conducted an inspection at Coop Italia focused on monitoring marketing and profiling activities. The inspection addressed aspects that were not covered by the complaint and revealed that controller collected multitude of data as part of the CoopVoce telephone service. In particular, the controller collected telephone and traffic data, internet browsing data, position, and/or geolocation data related to the use of e-Sim card. The Garante noted a consent to such a significant and diverse array of personal data might not be specific and free to fulfil the requirements of legal basis under Article 6(1)(a) GDPR. The controller said that this data was necessary to perform contractual obligations undertaken by Coop Italia to provide their services. For the purpose of direct marketing, the controller stated that they processed only name and contact data provided by the data subject in compliance with the consent given. In their view, this encompassed several other purposes such as market research, economic and statistical analysis. Moreover, the controller collected images, videos and audio recordings to promote its events and fairs. In this regard, the controller claimed that such processing was based on documents signed by the individuals involved. The legal basis was free and specific consent of the interested parties. The photos and audio-video recordings are kept for a maximum period of 5 years in relation to which the DPA noted that such retention period is excessive for these purposes. Lastly, the investigation also revealed that the controller processed identification, contact details, images and other personal data from its social platforms. The processing of this data was based on consent for a purpose of promotional activities and for responding to their users' requests. The controller collected this data for a period of 5 years which the Garante also considered excessive. The DPA took a view that regardless of the non-systemic nature of the infringement, the failure to help data subjects to exercise their right to object to the processing is detrimental to the fundamental right of data protection. Article 15 GDPR concerning the data subject's right of access should be complied with together with Article 12(3) GDPR which requires a response to requests made 'without undue delay' and 'within a period of 30 days'. For the failure to do so, the DPA established an infringement of Article 12(3), 15 and 21(2) GDPR. In regard to the processing of telephone, traffic, browsing and position data, the DPA decided to set aside the objection concerning the infringement of Article 6(1)(a) GDPR. Since the collection and use of such data took place to perform the contractual obligations to provide services and the data used for direct marketing was limited to only name and contact data to which processing data subjects consented, the processing was in compliance with the GDPR. However, the DPA did not agree with Coop Italia's categorization of statistical and economic analysis as a form of processing for direct marketing purpose. They argued that these activities necessitate separate consent, distinct from marketing activities. Combining them under a single marketing consent was misleading since they were utilized for profiling. The DPA instructed the controller to revise the consent acquisition process accordingly. Moreover, the DPA acknowledged the controller’s defense argument regarding preservation of photos and video recordings on signed documents by individuals involved. The DPA clarified that, in general, contractual autonomy can affect data storage timelines, unless adequate information about data processing and clear contractual terms are provided. Therefore, the DPA dismissed the objection of the excessive storage limitation. Lastly, the DPA stated that data retention period for processing of data from social platforms lacked clear criteria for its determination and appeared to be excessive for promotional purposes and invasive of individual’s privacy especially of those users who are not customers. Therefore, the DPA deemed it necessary to uphold the relevant objection for breach of Article 5(1)(e) GDPR regarding storage limitation. As a result of the foregoing, Coop Italia was held liable for breach of Article 5(1)(e), Article 12(3), Article 15, Article 21(2) GDPR for which the DPA imposed a fine of €90,000.