Ditta individuale Francesco Gagliardi – €1,500 Fine (Italy, 2026)

An individual company (the controller) engaged in a B2B marketing campaign. To this end, it bought a data set from a third-party: a sales platform called Apollo.io. The set consisted of about 2,500 professional contacts, including email addresses, phone numbers, and personal details of the contacts as well as their role within organizations. It is not known how Apollo acquired the information. The controller then used the data for sending unsolicited marketing communications. The controller relied on its legitimate interest as its legal basis, pursuant to Article 6(1)(f) GDPR. Every email contained a short footer that explained the legal basis of the processing, identified Apollo.io as the source for the email address, and included an opt-out link. An individual (the data subject) filed a complaint after receiving one of said emails. The data subject had not consented to marketing communications from the controller, and yet still received them. Overall, the DPA found violations of Articles 5(1)(a) and 14 GDPR as well as Art. 130 c.1. d. lgs. 196/2003 (i.e.: the Italian implementation of [https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A02002L0058-20091219 Article 13 of the ePrivacy Directive]). The DPA issued a €1,500 fine. In quantifying the fine, the DPA took into account that the controller had taken steps to fix its violations before the decision. Additionally, the DPA ordered the controller to bring its processing of personal data into compliance – which included, among others, erasing the data and providing the addressees of its marketing campaign with all the information required by Article 14. = First, the DPA clarified that the case fell within the scope of both the GDPR and Article 13 of the ePrivacy Directive (as well as its implementation in Italian lawArt. 130 d. lgs. 196/2003.). The DPA pointed out that the data set, which the controller bought and processed, contained at least some personal data. On these grounds, the DPA held that the case fell within the scope of the GDPR even though the controller’s campaign was B2B in nature. With regards to the ePrivacy Directive, the DPA observed that Article 13 covers marketing carried out towards subscribers or usersThe Italian implementation closely follows the wording of the Directive ("contraente o utente"). of an electronic communications network, and clarified that the notions of “subscriber” or “users” may also cover legal persons. On these grounds, the DPA held that the Article applied to the case at hand regardless of the personal or non-personal nature of the data processed. = Article 13 of the ePrivacy Directive requires consent for sending unsolicited marketing emails. In the DPA’s view, this made it unlawful for the controller to rely on legitimate interest as its legal basis. On these grounds, the DPA held that the controller unlawfully processed personal data for marketing purposes. = The DPA acknowledged that the controller’s marketing emails contained a privacy notice but found it to be severely lacking. On these grounds, the DPA held that the controller violated Article 14 GDPR as well as the transparency principle. = In its defence, the controller pointed out that Apollo had put forward claims that its processing complied with applicable laws and that the data set it sold, could lawfully be used for marketing. The DPA, however, applied the principle of accountability (Article 5(2) GDPR) and concluded that the documental or contractual guarantees provided a third-party, did not exempt the controller from assessing the lawfulness of its processing and did not shield the controller from liability.