Assiteca S.p.A. – €120,000 Fine (Italy, 2022)

The Italian DPA launched an investigation into the insurance broker Assiteca Spa (Assiteca), the controller, as part of the authorities planned inspection activities for 2022, and following a number of complaints. The investigation consisted of carrying out a simulated request for car insurance quotations on two websites operated by the company. As a preliminary point, the company explained that the services on these two websites were previously implemented by 6Sicuro SpA, a company which merged into Assiteca in July 2021. At the time of the investigation, the two websites had separate IT systems and were undergoing re-engineering. During the investigation process, the DPA raised several issues regarding the following: first, absence of consent to processing for promotional purposes; second, lack of transparency regarding data processing; third, the retention time of personal data; and fourth, the lack of technical and organisational measures to prevent prejudice to data subjects. In its defence, the company emphasised that, as a result of the merger, the anomalies detected during the inspection by the Garante were to be considered as “circumscribed effects attributable to the misalignment of the systems and not to a systematic lack of security measures”. In addition, they have, started the process for the acquisition of a new system, and made changes to rectify any technical anomalies at issue here. Issuing its decision, Italian DPA addressed the four issues identified above. Firstly, regarding consent, following the merger the company had retained the data of nearly 9,700 customers of the previous company without their knowledge by exposing their personal data to potential processing for promotional purposes even in the absence of consent. The DPA found that, due to a system bug, the will of some users was not correctly implemented since some consents were involuntarily given to the system after accessing e-mails containing car insurance quotes. The Company cla