Movimento Diritti Europei s.r.l.s. – €15,000 Fine (Italy, 2025)

Movimento Diritti Europei s.r.l.s. (the controller) is a law firm specialized in class actions. The controller acquired a list of the shareholders of a defaulting bank (the data subjects) from one of the shareholders. The list included the names and addresses of other shareholders. The controller then used the addresses to reach out to 15,000 shareholders by regular mail without their consent, in order to enlist them for a class action against the bank. Some of the shareholders reported the unsolicited communications to three associations involved in litigation against the bank. In turn, the associations filed a complaint against the controller. The associations claimed that the personal data of the data subjects were acquired and processed unlawfully. Additionally, the associations claimed that the controller failed to provide the data subjects with information on the processing of their data, and failed to respond to eight requests from data subjects. The DPA fined the controller €15,000 and ordered it to stop processing the personal data it unlawfully acquired. Lawfulness During the DPA’s investigation, the controller claimed that the processing of personal data was based on the controller’s legitimate interest in enlisting individuals for its class action. The controller also pointed out that many data subjects later joined the class action, and that only eight of them exercised their data rights with a request. In the controller’s view, this proved that the processing of personal data was appropriate, and that the controller had a tangible and non-hypothetical interest in the processing of the data. The DPA held that the controller’s activities constituted a form of unsolicited communication. Therefore, as a general rule, such activities required consent under Article 130(3) d. lgs. 196/2003This law is Italy’s so-called “Privacy Code”. Article 130 is a national implementation of the ePrivacy Directive’s rules on unsolicited marketing communications. See Article 13 Directive 2002/58/EC (available [https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32002L0058 here]).. The DPA found other issues with the legal basis of legitimate interest. In the DPA’s view: * the controller’s interest was not current and concrete; * the controller failed to explained how it balanced its interest with the rights and freedoms of the data subjects; * the data subjects had no relationship with the controller. Therefore, the use of their data did not meet the expectations of the data subjects; * the controller did not prove that it facilitated the exercise of the data subject’s rights (especially the right to object). For these reasons, the DPA held that the controller violated Articles 5(1)(a), 5(2), 6, and 24 GDPR. On transparency In its investigation, the DPA found that the controller provided data subjects with a notice when they complied the form or showed up to the controller’s informative meetings about its class action. So, information was not provided at the time of the collection of the data. For this reason, the controller held that the DPA failed to inform the data subjects about the processing of their data upon collection. The DPA held that the controller violated Articles 5(1)(a), 5(2), and 14 GDPR. On the data subject’s requests Eight data subjects sent the controller a request to exercise their rights via mail. During the investigation, the controller proved that it answered one of them by mail. The controller claimed that it responded to the other seven by phone but could not provide proof. The DPA held that the controller failed to respond to the access requests. In this regard, the DPA pointed out that when a data subject sends a request by regular mail, the controller should also respond by regular mail, in order to prove that it did respond. For this reason, the DPA held that the controller violated Articles 12(2), (3), and (4) GDPR.