Realmaps – €100,000 Fine (Italy, 2025)

Between May 2022 and April 2024, the DPA received numerous complaints stating that multiple data subjects received calls from real estate agencies for marketing purposes. These real estate agencies, upon request, shared that they had acquired personal data from Realmaps, the controller. The DPA decided to investigate how the data processing by the controller took place. The investigation revealed that the controller provides multiple real estate’s lists of property owners, containing telephone numbers and cadastral data on their properties. Upon request of the real estate agencies, the controller buys these cadastral data, and places them on the controllers’ database, together with name, surname, contact data, social security number, email and home address. Through a specific software, these information are matched and then a list with all the information of each property owner is sent to the real estate agency that requested it so that they can use for marketing purposes. The DPA considered that both the real estate agency and Realmaps are to be considered controllers in the case at hand. The DPA found a long list of violations. Violation of Articles 5(2), 6(1)(a), 7, 24, 13, 14 GDPR The DPA held that the controller did not make any random check on the lawfulness of the data acquired, stating that lawfulness was ensured by the list provider on the basis of their contractual relationship. However, the DPA considered that the controller did not verify, nor proofread, the informed consent given by data subjects. It cannot be held that a consent initially expressed consciously with regard to certain processing operations may be used for successive transfers of personal data from one controller to another in a manner totally unforeseeable for the data subject. In compliance with the principle of accountability, the controller should have verified at least by means of a congruous sample, the lawfulness of the consent given. Moreover, the DPA held that two distinct purposes of processing (marketing and communication to third parties for their promotional activities) are merged in a single formulation. However, both of them require specific informed consent from the data subjects. The communication or transfer to third parties of personal data for marketing purposes cannot be based on the acquisition of a single, generic consent from the data subjects for other purposes. Therefore, the transfer of data from one controller to the other is not supported by an appropriate consent, since it is not specific to the distinct marketing purposes of the controller; consequently, the subsequent transfer of data is unlawful. The DPA thus found a violation of Articles 5(2), 6(1)(a), 7, 24, 13, 14 GDPR. Violation of Article 30, 35, 37 GDPR The DPA held that the controller did not establish the Register of Processing Activities, did not conduct a data protection impact assessment and also failed to designate a Data Protection Officer. The DPA thus found a violation of Articles 30, 35, 37 GDPR. Violation of Article 12(2) and (3), 21(2) GDPR The DPA could not find any email inbox dedicated to receive data subject’s objections to the processing of their data. The DPA thus found a violation of Articles 12(2) and (3), 21(2) GDPR. Violation of Article 5(1)(e) GDPR The DPA found that the data was stored indefinitely, thus violating Article 5(1)(e) GDPR. Violation of Article 5(1)(a), 6(1))a), 7 and 12(1) GDPR The DPA considered that the lack of a privacy policy did not permit to understand which legal basis is applicable and thus does not permit to assess the lawfulness of the processing. The DPA thus found a violation of Articles 5(1)(a), 6(1)(a), 7 and 12(1) GDPR. Fine Due to the aforementioned violations, the DPA deemed it appropriate to impose a fine of €100,000.