GF – Complaint Upheld (Italy, 2025)

The case involved a marketing consultancy company (GF, the controller) and a former customer (the data subject). The data subject undertook a marketing course organized by the controller. Before the course, the controller and the data subject entered into a contract. The contract included a provision by which the data subject consented to the processing of certain data for advertising the controller's business: specifically, she allowed the controller to publish her case as a “success story” for the controller’s business. The data subject later filmed a "success story" and provided it to the controller, who published it on its website. The data subject later withdrew her consent to this processing and requested the controller to stop using her image and footage for advertising purposes. The controller refused and claimed that the processing was authorized under the contract. The data subject then filed a complaint with the DPA, claiming that the controller failed to grant her right to revoke consent. In its defense the controller pointed out that the processing of the subject’s data for the purpose of advertising, was mutually agreed upon in a contract and that the clause in question had no time limit. On these grounds, the controller claimed that the data subject could not revoke her consent or, at least, that she could not do so without first offering compensation to the controller. At some point during the investigation, the controller complied with the data subject’s request. The DPA upheld the complaint and found that the controller unlawfully dismissed the data subject’s request. Contrary to the controller's arguments, the DPA held that the right to revoke consent could not be limited on grounds that its exercise would entail negative economic consequences for the controller. Furthermore, the DPA found that in the case at hand, the data subject provided her “success story” to the controller spontaneously and not to perform a contractual obligation on her side. Therefore, the DPA also dismissed the controller’s claim that it would suffer negative economic consequences from the revocation of the data subject’s consent. Finally, the DPA found that the "success story" on the controller's website included personal data to the processing of which, the data subject had not consented (such as the name of her business). The DPA held that these data were published unlawfully (although the rest were lawfully published). Overall, the DPA found that the controller violated Articles 5(1)(a), 6, 7, 12 and 17 GDPR and issued a warning.