Sigma s.r.l. – €150,000 Fine (Italy, 2024)

The Italian Financial Police (Guardia di Finanza) sent a notice to the DPA regarding possible existence of administrative violations related to Sigma s.r.l., a company which operates two Vodafone Italia S.p.A. sale points in northern Italy (‘Sigma or ‘controller’). The Financial Police carried out an investigation following a complaint by a customer of Vodafone who claimed that Sigma charged them on their credit card relating to an activation of a new contract for telephone services. The contract was concluded in the name of her deceased husband. The investigation revealed that Sigma activated approximately 1,300 SIM cards, numerous telephone services under Vodafone brand and linked telephones to active users without their knowledge while they were made available for sale at the shop. Specifically, the company activated unsolicited services by inducing customers to sign, via a tablet, without clarifying the consequences of such consents. The company sold mobile phones without any request made by the customers that learned of the purchase by finding additional charges on their invoice. These services or devices were never delivered to the customers. Additionally, it emerged that Sigma used data of hundreds of users extracted from the Vodafone information systems. Vodafone clarified that its relationship with Sigma is governed by a franchising contract according to which Sigma is a dealer acting as an autonomous controller of personal data related to SIM card and telephone service activations. Employees of Sigma were authorized to identify all customers and make a copy of their IDs in case of activation of a new product. Additionally, the data entry and activation of services was carried out by the employees through a computer connected to the Vodafone systems. Consequently, circumventing the telephone operator’s controls and relevant processing provision amounted to a turnover of more than €80,000. It emerged that Sigma planned its activities precisely with the intention to acquire unsolicited telephone contracts which could be used for further illegal activities. The DPA confirmed that Sigma engaged in several activities which circumvented the relevant provisions on the processing of customer’s data and the agreement it concluded with Vodafone. Because of this circumvention, Sigma became a controller of the processing. According to Article 28(10) GDPR, in case a processor infringes the GDPR by determining the purposes and means of processing, the processor shall be considered a controller in respect of that processing.In particular, Sigma processed personal data of customers without their consent and charged them for the cost of purchase of services which were never requested nor delivered. For failing to provide the data subject with appropriate information and in a fair and transparent manner, Sigma was found in breach of Article 5(1)(a), (2) and Article 13 GDPR. The DPA closely analysed the franchising contract which laid down specific rules for the identification of the person requesting a new SIM or telephone service activation. According to the DPA’s general measures of 16 February 2006, the operators (e.g. Vodafone) designate agents or dealers as data processors. However, for the purpose of activating the services they exercise real and autonomous decision-making power and therefore must fulfil the relevant obligations provided for by the GDPR. Sigma was a controller for the mentioned processing purposes and planned its activities precisely with the intention of using the personal database at its disposal to acquire unsolicited telephone contracts. For this reasons they were found in breach of the principle of lawfulness and accountability pursuant to Article 5(1)(a) and (2) GDPR and its responsibility as a controller under Article 24(1) and 25(1) GDPR. In addition to that, the data for the SIM and telephone service activation was collected without the customers’ knowledge and therefore Sigma lacked legal basis for this processing under Article 6 GDPR. The DPA imposed a fine of €150,000 to Sigma and ordered the prohibition of further processing of customers’ data.