Movimento Diritti Europei s.r.l.s. – €15,000 Fine (Italy, 2025)

Movimento Diritti Europei s.r.l.s. (the controller) is a law firm specialized in class actions. The controller acquired a list of the shareholders of a defaulting bank (the data subjects) from one of the shareholders. The list included the names and addresses of other shareholders. The controller then used the addresses to reach out to 15,000 shareholders by regular mail without their consent, in order to enlist them for a class action against the bank. Some of the shareholders reported the unsolicited communications to three associations involved in litigation against the bank. In turn, the associations filed a complaint against the controller. The associations claimed that the personal data of the data subjects were acquired and processed unlawfully. Additionally, the associations claimed that the controller failed to provide the data subjects with information on the processing of their data, and failed to respond to eight requests from data subjects. The DPA fined the controller €15,000 and ordered it to stop processing the personal data it unlawfully acquired. Lawfulness During the DPA’s investigation, the controller claimed that the processing of personal data was based on the controller’s legitimate interest in enlisting individuals for its class action. The controller also pointed out that many data subjects later joined the class action, and that only eight of them exercised their data rights with a request. In the controller’s view, this proved that the processing of personal data was appropriate, and that the controller had a tangible and non-hypothetical interest in the processing of the data. The DPA held that the controller’s activities constituted a form of unsolicited communication. Therefore, as a general rule, such activities required consent under Article 130(3) d. lgs. 196/2003This law is Italy’s so-called “Privacy Code”. Article 130 is a national implementation of the ePrivacy Directive’s rules on unsolicited marketing communications. See Artic