Commify Italia S.r.l. – €80,000 Fine (Italy, 2023)

Commify Italia s.r.l. (controller) offers to business customers the service available at the Skebby platform (www.skebby.it) by which text messages can be sent via a web application or through application programming interfaces. The Italian DPA carried out inspection activities at the controller place of business on several occasions: in 2018 as a result of a data breach notified by a client of the controller. In 2019 as a result of additional documentation provided by the controller and a complaint from which it emerged the potential unlawful storage of the content of text messages sent through the platform. Precisely with regard to the lawfulness of the procedures adopted regarding the storage of the content of text messages sent, in 2021 the DPO of a client company requested the intervention of the Italian DPA. As a result, the Italian DPA carried out a further inspection to verify the functioning of the platform. The inspection revealed that: • The controller stored in its systems the content of messages sent by its customers, which also included special categories of personal data (such as, reservations for health services, messages sent by political parties to their members). The controller justified this retention on the grounds that the content of the messages was to be considered traffic data in accordance with Article 121(1-bis)(h) of Legislative Decree no. 196 of 30 June 2003 (the Italian Data Protection Code) with the consequent obligation to retain them pursuant to Articles 123 and 132 of the Code. • With regard to the technical and organisational measures taken by the controller, it appeared that the traffic data (including the content of text messages) were stored in the controller's systems without any physical or logical distinction according to the purpose of retention (e.g. crime prevention and prosecution, billing, making the text available to the customer for consultation). Consequently, there was also no differentiation of retention periods ac