Fastweb S.p.A. – €1,000,000 Fine (Italy, 2024)

The DPA received several complaints and informal reports about unsolicited phone calls made by Fastweb, a telecommunication provider, to data subjects. Moreover, an investigation carried out by the DPA showed that 7,75% of the phone calls were made to data subjects who had signed up for the Italian opt-out registry (Registro Pubblico delle Opposizioni – RPO). The RPO is an Italian registry extended to all national phone numbers, which allows citizens to opt-out of unwanted telemarketing calls. According to [https://www.normattiva.it/uri-res/N2Ls?urn:nir:stato:legge:2018-01-11;5~art1 Article 1(5) of Law 5/2018], when a data subject signs up for the RPO, this has the effect of revoking their previous consent given for marketing purposes. However, pursuant to the same article, consent is deemed valid if it was given in the context of a contract which is still in place. The controller classified its phone calls in 3 categories: * “inbound” calls, made by the data subject to the controller’s customer service; * “websales” calls, made by the controller to the data subject after acquiring their specific consent through a comparison website or after the data subject entered their phone number because they wanted to be called back. In the case the data subject had signed up to the RPO, this consent would however be valid since it was given after the registration pursuant to to [https://www.normattiva.it/uri-res/N2Ls?urn:nir:stato:legge:2018-01-11;5~art1 Article 1(6) of Law 5/2018]; * “outbound” calls, made by the controller (or its processor) to the data subject. As for this type, the controller pointed out that if the call is directed to a non-client, it always relies on consent acquired in a legitimate way. On the other hand, if it is directed to a client, the legal basis is the legitimate interest to propose better offers to the data subject. Finally, data subjects complained about the fact that they were provided with a form that had pre-ticked consent boxes as for the retention of data up to 24 months after the termination of the contract. The controller argued that it did not need to implement an “opt-in” mechanism since the legal basis for this retention was the legitimate interest to send commercial communication even after the termination of the contract. The controller stressed the fact that [https://www.normattiva.it/uri-res/N2Ls?urn:nir:::2003;196~art130 Article 130(4) of the Italian Data Protection Code] states that consent is not necessary to send marketing emails to clients. First, the DPA noted that it had already issued several decisions against the controller in the previous years. Secondly, the DPA analysed the lawfulness of the marketing calls. As for the so-called “inbound calls”, the DPA found no violation. It held that, by making themselves a phone call to the controller, these data subjects expressed their consent. The DPA recalled that [https://www.normattiva.it/uri-res/N2Ls?urn:nir:stato:legge:2018-01-11;5~art1 Article 1(6) of Law 5/2018] foresees that consent given after the registration to the RPO is not impacted by that registration. On the other hand, as for the “websales” calls, the DPA noted that there is a period of time (lasting from some hours to some days) between the moment in which the data subject inserts their number in the website and the moment in which they are called back. Therefore, the controller needs to check whether, in the meantime, the data subject has signed up in the RPO. If this is the case, the consent is deemed to be revoked. The DPA held that the controller has not proved to have implemented measures to verify this. Therefore, the DPA found a violation of [https://www.normattiva.it/uri-res/N2Ls?urn:nir:::2003;196~art130 Article 130 of the Italian Data Protection Code]. As for the “outbound” calls, the DPA noted that the controller made marketing calls also to 9 data subjects who did not give their consent for marketing purposes. The DPA did not uphold the controller’s argument about the fact that, in this case, consent would not be necessary. On the contrary, it recalled that, for marketing calls, consent is always necessary. Also, the DPA noted that the privacy policy was not clearly differentiating between the legal basis regarding clients and the one regarding non-clients, even if the controller relied on such a differentiation. Therefore, the DPA found a violation of Article 12(1) GDPR in combination with Article 13 GDPR. The DPA also noted that the controller failed to promptly act on rectification requests under Article 17 GDPR and on objections under Article 21 GDPR. Therefore, the DPA found a violation of Article 12(3) GDPR. On these grounds, the DPA fined the controller €1,000,000 and imposed a ban on the processing of phone numbers acquired with the “websales” mechanism.