Garante per la protezione dei dati personali (Italy) - 10072622

Garante per la protezione dei dati personali - 10072622

Authority:	Garante per la protezione dei dati personali (Italy)
Jurisdiction:	Italy
Relevant Law:	Article 5 GDPR Article 6 GDPR Article 7 GDPR Article 12 GDPR Article 13 GDPR Article 14 GDPR Article 15 GDPR Article 21 GDPR Article 58 GDPR Article 130, Italian Data Protection Code Article 157, Italian Data Protection Code
Type:	Investigation
Outcome:	Violation Found
Started:	18.08.2023
Decided:	26.09.2024
Published:	26.09.2024
Fine:	n/a
Parties:	n/a
National Case Number/Name:	10072622
European Case Law Identifier:	n/a
Appeal:	Unknown
Original Language(s):	Italian
Original Source:	Garante (in IT)
Initial Contributor:	Mgrd

Garante issued a reprimand againt a controller after it chose, as a processor, a Tunisian company to perform marketing phone calls to data subjects, and did not comply with several GDPR and Italian law rules.

English Summary

Facts

On February 10, 2023, the data subject received an unsolicited promotional call in which the caller identified himself as an employee of a multibrand agency operating in the telecommunications sector. He offered services for setting up contracts on behalf of various national providers and requested to schedule an appointment with a local agent.

The data subject, who was registered in the Registro Pubblico delle Opposizioni (Public Opt-Out Register) to block telemarketing calls, had not provided consent for promotional communications. Also, the data subject independently investigated the organization behind the call and sent two emails to the local agent mentioned on the call to request information about how his data was obtained. The local agent replied denying possession of the data subject's personal data or the use of any marketing tools.

On August 18, 2023, the data subject submitted a formal complaint to the Garante. He highlighted the unsolicited promotional call, lack of consent for the data processing and his registration in the Public Opt-Out Register.

On November 30, 2023, Garante initiated an inquiry and sent an information request to the local agent, under Article 157 Italian Data Protection Code. The local agent responded, claiming the call was commissioned to Ste Nabi Call, a Tunisian market research company, that he had no direct involvement in contacting the data subject and did not possess his personal data.

Garante sent a second request for clarification, asking the agent to provide details about the service agreement with Ste Nabi Call and clarify the ownership and use of the phone number which called the data subject.

In his response, the agent provided information about the agreement with Ste Nabi Call, stating it was for market research. Also, he denied knowledge of the phone number used for the promotional call.

Holding

The Garante concluded that the local agent was the data controller, responsible for ensuring legal compliance, even when outsourcing activities to third parties like Ste Nabi Call. Also, they highlighted that the promotional call violated multiple GDPR articles (Articles 5, 6, 7, 12, 13, 14, 15 and 21) and the Italian Data Protection Code (Article 130 and 157) due to lack of consent, failure to provide information about how personal data was processed or used and non-compliance with the Public Opt-Out Register, since the data subject's phone number should not have been contacted.

For this reasons, Garante issued a reprimand, under Article 58(2)(b) GDPR, stablishing a prohibition on further promotional data processing without proper consent and compliance measures, instructions to notify Ste Nabi Call of the data subject's objection to further data processing and a 30-day deadline for the agent to report compliance with these measures to the Garante.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Italian original. Please refer to the Italian original for more details.

[web doc. no. 10072622]

Provision of 26 September 2024

Register of provisions
no. 586 of 26 September 2024

THE GUARANTOR FOR THE PROTECTION OF PERSONAL DATA

IN today's meeting, attended by Prof. Pasquale Stanzione, President, Prof. Ginevra Cerrina Feroni, Vice President, Dr. Agostino Ghiglia and Attorney Guido Scorza, members, and Councillor Fabio Mattei, Secretary General;

HAVING SEEN Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation, hereinafter “Regulation”);

HAVING SEEN the Personal Data Protection Code (Legislative Decree 30 June 2003, no. 196), as amended by Legislative Decree 10 August 2018, no. 101, containing provisions for the adaptation of the national legal system to the aforementioned Regulation (hereinafter the “Code”);

HAVING SEEN the documentation in the files;

HAVING SEEN the observations formulated by the Secretary General pursuant to art. 15 of the Regulation of the Guarantor no. 1/2000, adopted with resolution of 28 June 2000;

REPORTER: Attorney Guido Scorza;

1. THE INVESTIGATIVE ACTIVITY CARRIED OUT

1.1. Introduction

With deed of 26 April 2024, no. 51845/298626 (notified on the same date by certified e-mail), which must be considered fully referenced and reproduced here, the Office has initiated, pursuant to art. 166, paragraph 5, of the Code, a proceeding for the adoption of the provisions referred to in art. 58, paragraph 2, of the Regulation against the individual enterprise Pojer Giordano, in the person of its legal representative, with registered office in Altavalle (TN), via della Villa Alta n. 8, P.I. 02308710223, c.f. PJRGDN89T24C372Q.

The proceeding originates from a complaint sent to the Authority on 18 August 2023, in which the interested party complained about the undue telephone contact for promotional purposes made on 10 February 2023, at around 9:00 am, from the number 3388321206, which, following subsequent checks, was found not to be registered in the Register of Communication Operators. The operator who spoke to the complainant declared that she was calling from a “multibrand” agency and reported that she carried out her activity in the telephone sector to propose supply activations on behalf of various national companies. The operator asked the complainant to be available to make an appointment with the agent, Mr. Giordano Pojer, operating in the Trento area; subsequently, the telephone call was interrupted when the complainant asked the operator questions about the origin of the interested party’s personal data and the legal basis of the processing.

The complainant therefore proceeded to carry out independent investigations on the person who had commissioned the promotional call, following which he exercised his rights pursuant to Articles 15-22 of the Regulation against the individual company Pojer Giordano: in response to two emails sent by the complainant on the same day, 10 February 2023, Mr. Pojer communicated that "my agency does not have any of his data and that it does not use any marketing tools towards him".

Considering the response insufficient, the interested party filed a complaint with the Authority, stating that he had never given consent for processing for promotional purposes and highlighting that his telephone number which was the subject of the contact was registered in the Register of Oppositions "almost since the institution of the same".

1.2. Conduct of the investigation

The Office, with a note dated 30 November 2023, sent Mr. Pojer a request for information pursuant to art. 157 of the Code to acquire the elements useful for a complete assessment of the case, which was supported by the company “P.G. Service” of the aforementioned Mr. Pojer.

In the note, the individual company represented that “Mr. Pojer has already had the opportunity to personally communicate to [the interested party] both by telephone and by email [that] he is not the owner of any sensitive and/or personal data of the complainant. He has only relied on an agency that operates in the field of market research for the identification of potential customers, paying a regular invoice […]. He has never directly contacted [the complainant] for commercial reasons nor had he given instructions to Ste Nabi Call (the aforementioned agency) to do so. He is not in possession nor has he ever been in possession of any personal data of the [complainant] and has never processed any of it concerning him”.

The Office proceeded to send a second request pursuant to art. 157 of the Code, inviting Mr. Pojer to specify “in detail the nature of the service offered by the Ste Nabi Call agency and, in particular, what activities were carried out with reference to the “identification of potential customers” and what results were returned to you”, as well as to “provide information, to the best of your knowledge, on the ownership or possible use of telephone number 338.8321206, which the complainant declares to be the number from which the disputed contact call was made”. Mr. Pojer responded to this request by stating that “as for the details on the nature of the service, there are no particular issues to highlight. Mr. Pojer was contacted at the time by a company in the sector, "Ste Nabi Call" for the market research service. The only contacts he had with the company in question were already made and the only detail that Mr. Pojer may add that the invoice issued concerned the market research provided for approximately 30/35 subjects. As for telephone number 3388321206, Mr. Pojer has no idea who the owner or user is, despite some searches carried out on his mobile phone in order to verify traces of the same user”.

1.3. Contestation of violations

The Office, following the investigation, adopted the aforementioned contestation act no. 51845/298626 against the individual company Pojer Giordano, believing first of all that the latter acted, in the matter in question, as the owner of the personal data processing based on what was represented by the Guarantor with provision no. 230 of 15 June 2011 (in www.gpdp.it, web doc. no. 1821257), but also what is expressly established in law no. 5/2018, sources that attribute the ownership of the related processing to the person who entrusts call center activities to third parties for making telephone calls.

Therefore, in the notice of dispute, it was highlighted that, based on the "principle of accountability" (art. 5, par. 2, and 24, par. 1, of the Regulation), the burden of demonstrating that the processing is carried out in accordance with the provisions on the protection of personal data lies exclusively with the data controller.

On the merits of the case, it was observed that the preliminary investigation documents confirm the statements of the complainant, who received, on 10 February 2023, on his landline telephone number registered in the Register of Oppositions, a promotional communication aimed at setting up an appointment with Mr. Pojer, a precursor to the possible activation of a supply of telephone services. As confirmed by Mr. Pojer himself, this promotional communication was commissioned by the individual company Pojer Giordano to a Tunisian company, Ste Nabi Call, based in Sousse, under an agreement for the procurement of 40 “multibrand appointments”, for which a fee of €1120 was paid.

It was therefore considered that the promotional contact with the complainant occurred in violation of the principle of lawfulness pursuant to art. 5, par. 1, letter a) and 24, par. 1, of the Regulation and in the absence of an appropriate legal basis (in particular the consent provided for by art. 130, paragraph 3, of the Code or the use of public telephone directories in derogation from the aforementioned provision) and that the contact itself was not preceded by the prior verification of the telephone number of the interested party with the Register of objections. With reference to these necessary obligations, the owner did not provide any element in the investigation phase, thus failing to comply with the aforementioned principle of accountability.

It also emerged that the processing was not preceded by exhaustive information that could allow the complainant to become aware of the origin of the personal data used for the promotion, the legal basis, the purposes of the processing, the subjects who actually carried out the processing, the scope of communication of the data as well as the right of the interested party to exercise the rights referred to in arts. 15-22 of the Regulation. All this also in violation of the principles of transparency and fairness referred to in art. 5, par. 1, letter a), of the Regulation.

With regard to the exercise of the aforementioned rights, it was observed that the response provided to the interested party to the request for access to their data (art. 15 of the Regulation) and to the opposition to the processing for promotional and advertising purposes (art. 21 of the Regulation), was insufficient, since the owner did not provide the interested party with any of the elements subsequently communicated to the Authority relating to the existence of a relationship with a foreign call center, and did not ensure the correct reception of the opposition, since the individual company only represented in the response that it "does not have any of his data and that it does not use any marketing tools towards him".

On the basis of the aforementioned observations, the Office contested the d.i. Pojer Giordano, the alleged violation of the following provisions:

a) art. 5, par. 1, letter a), and 2; arts. 6 and 7; art. 24, par. 1, of the Regulation and art. 130 of the Code, for having carried out the above-described processing of the complainant's personal data in conflict with the principles of lawfulness and accountability and in the absence of an appropriate legal basis, failing to acquire from the interested party the necessary consent provided for by paragraph 3 of art. 130 of the Code and to check the telephone number of the aforementioned with the Register of objections, pursuant to the subsequent paragraph 3-bis;

b) art. 5, par. 1, letter a), 13 and 14 of the Regulation, for having carried out the above-described processing in conflict with the principles of transparency and fairness and without having provided the interested party with appropriate information at least on the occasion of the first promotional contact;

c) art. 12, par. 2 and 3, in relation to art. 15 and 21 of the Regulation, for having provided the interested party with insufficient and omissive feedback to the request to exercise the right of access to the data and the right to object to the processing for promotional and advertising purposes.

2. OBSERVATIONS BY THE OWNER

Mr. Giordano Pojer, by email dated 28 May 2024, requested a hearing pursuant to art. 166, paragraph 6, of the Code. The Office therefore scheduled the hearing for 2 July 2024, a hearing that did not take place due to the applicant's failure to appear, despite the customary summons.

Subsequently, the Authority received a new request for a hearing from the same Mr. Pojer, which also contained justifications for his failure to appear at the summons on 2 July. The Office, with a view to maximising the owner's right to be heard by the Authority, proceeded to summon him again.

The hearing of the owner took place, therefore, on 23 and 31 July 2024 and in it the party represented that, in the case in question "the conduct of the individual company was fully compliant with the provisions on the protection of personal data, both with reference to the legal basis of the processing of personal data carried out, and with regard to the feedback provided to the complainant when exercising the rights pursuant to art. 15-22 of Regulation (UF) 2016/679". Therefore, a declaration dated 24 July 2024 was produced, signed by the owner of the Tunisian company Nabi Call, Mrs Kahoula Nllik, in which she represented that “the activity carried out by our company concerning the search for multibrand appointments on behalf of the aforementioned PG Service took place in compliance with Legislative Decree 30 June 2003, n.196 (Code regarding the protection of personal data), and therefore also through the prior control of any registrations of the subjects contacted in the public register of oppositions. I also declare that Mr Giordano Pojer contacted us repeatedly, each time recommending compliance with the regulations regarding the protection of personal data”.

The hearing concluded with the request of the party to archive the proceedings, “having the d.i. Pojer Giordano fully documented the care and commitment in respecting the rules on privacy and having, the partner company, represented not only the observance of the relevant provisions, but also the constant monitoring of Mr. Pojer in the activities of the same”.

3. AUTHORITY’S EVALUATIONS

The defensive observations do not appear suitable to exclude the liability of the d.i. Pojer Giordano in relation to the conduct contested with the act of initiation of the proceeding no. 51845/298626.

As already highlighted in the aforementioned act, the subjects who entrust promotional activities outside their business reality, assume in any case the legal role of the owner of the related processing of personal data. This approach, already present in the aforementioned provision of the Guarantor no. 230 of 15 June 2011, is confirmed in law no. 5/2018 (“New provisions on the registration and operation of the register of objections and the establishment of national prefixes for telephone calls for statistical, promotional and market research purposes”) where, in art. 1, paragraph 11, it is reiterated that “the data controller is jointly liable for violations of the provisions of this law even in the case of entrusting call center activities to third parties for making telephone calls”.

In the case in question, moreover, having entrusted the telephone contact activities, even if aimed at setting a few dozen appointments on behalf of Mr. Pojer, to a company not established in the territory of the European Union and therefore exempt from the regulatory constraints on the protection of personal data provided for in the Regulation and in the Code, makes it even more evident that the only entity to which the obligations relating to the processing must be traced is the individual company Pojer Giordano, where the personal data processed by the agency arrived, following the commissioned promotional contacts.

Having outlined the perimeter of the ownership of the processing, it must be noted that the investigation carried out by the Office and the subsequent procedural phase initiated with the notice of dispute lead to confirming what was represented by the interested party in the notice of complaint.

The same individual company has in fact confirmed that the complained promotional contact (of which the complainant also provided the related audio track) actually occurred: the related processing of personal data does not appear to have been preceded by the acquisition of the required consent, by the release of the necessary information and by the verification of the possible presence of the telephone number contacted in the Public Register of Oppositions.

In this regard, the documentation produced by the Pojer company during the hearing, consisting of a generic declaration by the owner of the Tunisian company, does not appear to be sufficient to prove that adequate information was provided and that formal consent was obtained for the processing of personal data by the interested party (and any other parties contacted) and, as for the statement regarding compliance by the Tunisian agency with the provisions regarding the Public Register of Oppositions, the same appears to lack credibility given that neither the Tunisian company nor the Pojer company are registered in the aforementioned Register as operators authorised to consult.

With regard to the methods by which the sole proprietorship Pojer Giordano guaranteed the exercise of the right of access and the right to object to the complainant, it has clearly emerged that the owner's findings have been largely lacking, the latter having limited himself to declaring to the complainant that he had not processed his personal data, without mentioning the contractual relationship with the Tunisian company and without communicating to the latter the interested party's opposition to the processing for promotional and advertising purposes.

Therefore, the liability of the sole proprietorship Pojer appears to be confirmed in relation to the ascribed conduct, which however appears to be of modest relevance, both due to the fact that the unlawful processing of the complainant appears to have materialized in a single unwanted contact, and due to the low invasiveness of the promotional campaign commissioned to the Tunisian company, limited to the setting of a few dozen appointments: the case can therefore be classified as a "minor violation" pursuant to art. 83, par. 2, and recital no. 148 of the Regulation. It is also necessary to take into account the personal nature of the company that is the data controller, which, on the one hand, leads to considering the conduct as a symptom of substantial disorganization and unpreparedness with reference to the matter of personal data protection and, on the other, requires the adoption of corrective measures provided with the requirement of proportionality.

4. CONCLUSIONS

In light of the above, the liability of the d.i. Pojer Giordano is deemed to be established in relation to the following violations:

a) art. 5, par. 1, letter a), and 2; arts. 6 and 7; art. 24, par. 1, of the Regulation and art. 130 of the Code, for having processed the personal data of the complainant described in the motivation in conflict with the principles of lawfulness and accountability and in the absence of an appropriate legal basis, failing to acquire from the interested party the necessary consent provided for in paragraph 3 of art. 130 of the Code and to check the telephone number of the aforementioned with the Register of objections, pursuant to the following paragraph 3-bis;

b) art. 5, par. 1, letter a), 13 and 14 of the Regulation, for having carried out the processing referred to above in conflict with the principles of transparency and fairness and without having provided the interested party with suitable information at least on the occasion of the first promotional contact;

c) art. 12, par. 2 and 3, in relation to arts. 15 and 21 of the Regulation, for having provided the interested party with insufficient and omission feedback to the request to exercise the right of access to the data and the right to object to the processing for promotional and advertising purposes.

Having also ascertained the unlawfulness of the processing in question, it is necessary to:

- contact the d.i. Pojer Giordano, pursuant to art. 58, par. 2, letter a) b), of the Regulation, a warning for having carried out the described processing of personal data in violation of the regulations on the protection of personal data;

- impose on the d.i. Pojer Giordano, pursuant to art. 58, par. 2, letter f) of the Regulation, the prohibition of any further processing of the complainant's data and any future processing of personal data for promotional purposes through the use of external agencies, where for such processing it is not possible to document the release of appropriate information to the interested parties, the acquisition of the required consent and the correct fulfillment of the provisions regarding the Public Register of Objections;

- require the d.i. Pojer Giordano, pursuant to art. 58, par. 2, letter d), of the Regulation, to communicate without delay to the Tunisian company Ste Nabi Call the will of the complainant to oppose any future processing of his personal data for promotional purposes, also informing the complainant that this requirement has been fulfilled.

CONSIDERING ALL THE ABOVE, THE GUARANTOR

a) issues to d.i. Pojer Giordano, in the person of its legal representative, with registered office in Altavalle (TN), via della Villa Alta n. 8, P.I. 02308710223, c.f. PJRGDN89T24C372Q pursuant to art. 58, par. 2, letter b), of the Regulation, a warning for having carried out the described processing of personal data in violation of the regulations on the protection of personal data;

b) imposes on d.i. Pojer Giordano, pursuant to art. 58, par. 2, letter b), of the Regulation, a warning for having carried out the described processing of personal data in violation of the regulations on the protection of personal data; f) of the Regulation, the prohibition of any further processing of the complainant's data and any future processing of personal data for promotional purposes through the use of external agencies, where for such processing it is not possible to document the release of appropriate information to the interested parties, the acquisition of the required consent and the correct fulfillment of the provisions regarding the Public Register of Objections;

c) requires the d.i. Pojer Giordano, pursuant to art. 58, par. 2, letter d), of the Regulation, to communicate without delay to the Tunisian company Ste Nabi Call the will of the complainant to oppose any future processing of his personal data for promotional purposes, also informing the complainant himself of the fulfillment of this requirement;

d) orders the d.i. Pojer Giordano, pursuant to art. 157 of the Code, to communicate to the Authority, within thirty days of notification of this provision, the initiatives undertaken in order to implement the measures imposed; Any failure to communicate within the indicated time limit may result in the application of the administrative pecuniary sanction provided for by Article 83, paragraph 5, of the Regulation.

ORDERS

The publication of this provision, pursuant to Articles 154-bis of the Code and 37 of Regulation no. 1/2019 on the website of the Guarantor, and the annotation of the same in the internal register of the Authority - provided for by Article 57, paragraph 1, letter u), of the Regulation, as well as by Article 17 of Regulation no. 1/2019 concerning internal procedures with external relevance, aimed at carrying out the tasks and exercising the powers delegated to the Guarantor - relating to the violations and measures adopted in accordance with Article 58, paragraph 2, of the Regulation itself.

Pursuant to Articles 152 of the Code and 10 of Legislative Decree no. 150/2011, opposition to this provision may be lodged with the ordinary judicial authority, with an appeal filed with the ordinary court of the place identified in the same Article. 10, within thirty days from the date of communication of the provision itself.

Rome, 26 September 2024

THE PRESIDENT
Stanzione

THE REPORTER
Scorza

THE GENERAL SECRETARY
Mattei

[web doc. no. 10072622]

Provision of 26 September 2024

Register of provisions
no. 586 of 26 September 2024

THE GUARANTOR FOR THE PROTECTION OF PERSONAL DATA

IN today's meeting, attended by Prof. Pasquale Stanzione, president, Prof. Ginevra Cerrina Feroni, vice-president, Dr. Agostino Ghiglia and the lawyer Guido Scorza, members and Councillor Fabio Mattei, general secretary;

HAVING SEEN Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation, hereinafter “Regulation”);

HAVING SEEN the Personal Data Protection Code (Legislative Decree no. 196 of 30 June 2003), as amended by Legislative Decree no. 101 of 10 August 2018, containing provisions for the adaptation of national law to the aforementioned Regulation (hereinafter “Code”);

HAVING SEEN the documentation in the files;

HAVING SEEN the observations formulated by the Secretary General pursuant to art. 15 of the Regulation of the Guarantor no. 1/2000, adopted with resolution of 28 June 2000;

REPORTER the lawyer Guido Scorza;

1. THE INVESTIGATIVE ACTIVITY CARRIED OUT

1.1. Introduction

With deed dated 26 April 2024, no. 51845/298626 (notified on the same date by certified e-mail), which must be considered fully recalled and reproduced here, the Office initiated, pursuant to art. 166, paragraph 5, of the Code, a proceeding for the adoption of the provisions referred to in art. 58, paragraph 2, of the Regulation against the individual enterprise Pojer Giordano, in the person of its legal representative, with registered office in Altavalle (TN), via della Villa Alta n. 8, VAT no. 02308710223, tax code PJRGDN89T24C372Q.

The proceeding originates from a complaint sent to the Authority on 18 August 2023, in which the interested party complained about the undue telephone contact for promotional purposes made on 10 February 2023, at around 9:00 am, from the number 3388321206, which, following subsequent checks, was found not to be registered in the Register of Communication Operators. The operator who spoke to the complainant declared that she was calling from a “multibrand” agency and reported that she carried out her activity in the telephone sector to propose supply activations on behalf of various national companies. The operator asked the complainant to be available to make an appointment with the agent, Mr. Giordano Pojer, operating in the Trento area; subsequently, the telephone call was interrupted when the complainant asked the operator questions about the origin of the interested party’s personal data and the legal basis of the processing.

The complainant therefore proceeded to carry out independent investigations on the person who had commissioned the promotional call, following which he exercised his rights pursuant to Articles 15-22 of the Regulation against the individual company Pojer Giordano: in response to two emails sent by the complainant on the same day, 10 February 2023, Mr. Pojer communicated that "my agency does not have any of his data and that it does not use any marketing tools towards him".

Considering the response insufficient, the interested party filed a complaint with the Authority, stating that he had never given consent for processing for promotional purposes and highlighting that his telephone number which was the subject of the contact was registered in the Register of Oppositions "almost since the institution of the same".

1.2. Conduct of the investigation

The Office, with a note dated 30 November 2023, sent Mr. Pojer a request for information pursuant to art. 157 of the Code to acquire the elements useful for a complete assessment of the case, which was supported by the company “P.G. Service” of the aforementioned Mr. Pojer.

In the note, the individual company represented that “Mr. Pojer has already had the opportunity to personally communicate to [the interested party] both by telephone and by email [that] he is not the owner of any sensitive and/or personal data of the complainant. He has only relied on an agency that operates in the field of market research for the identification of potential customers, paying a regular invoice […]. He has never directly contacted [the complainant] for commercial reasons nor had he given instructions to Ste Nabi Call (the aforementioned agency) to do so. He is not in possession nor has he ever been in possession of any personal data of the [complainant] and has never processed any of it concerning him”.

The Office proceeded to send a second request pursuant to art. 157 of the Code, inviting Mr. Pojer to specify “in detail the nature of the service offered by the Ste Nabi Call agency and, in particular, what activities were carried out with reference to the “identification of potential customers” and what results were returned to you”, as well as to “provide information, to the best of your knowledge, on the ownership or possible use of telephone number 338.8321206, which the complainant declares to be the number from which the disputed contact call was made”. Mr. Pojer responded to this request by stating that “as for the details on the nature of the service, there are no particular issues to highlight. Mr. Pojer was contacted at the time by a company in the sector, "Ste Nabi Call" for the market research service. The only contacts he had with the company in question were already made and the only detail that Mr. Pojer may add that the invoice issued concerned the market research provided for approximately 30/35 subjects. As for telephone number 3388321206, Mr. Pojer has no idea who the owner or user is, despite some searches carried out on his mobile phone in order to verify traces of the same user”.

1.3. Contestation of violations

The Office, following the investigation, adopted the aforementioned contestation act no. 51845/298626 against the individual company Pojer Giordano, believing first of all that the latter acted, in the matter in question, as the owner of the personal data processing based on what was represented by the Guarantor with provision no. 230 of 15 June 2011 (in www.gpdp.it, web doc. no. 1821257), but also what is expressly established in law no. 5/2018, sources that attribute the ownership of the related processing to the person who entrusts call center activities to third parties for making telephone calls.

Therefore, in the notice of dispute, it was highlighted that, based on the "principle of accountability" (art. 5, par. 2, and 24, par. 1, of the Regulation), the burden of demonstrating that the processing is carried out in accordance with the provisions on the protection of personal data lies exclusively with the data controller.

On the merits of the case, it was observed that the preliminary investigation documents confirm the statements of the complainant, who received, on 10 February 2023, on his landline telephone number registered in the Register of Oppositions, a promotional communication aimed at setting up an appointment with Mr. Pojer, a precursor to the possible activation of a supply of telephone services. As confirmed by Mr. Pojer himself, this promotional communication was commissioned by the individual company Pojer Giordano to a Tunisian company, Ste Nabi Call, based in Sousse, under an agreement for the procurement of 40 “multibrand appointments”, for which a fee of €1120 was paid.

It was therefore considered that the promotional contact with the complainant occurred in violation of the principle of lawfulness pursuant to art. 5, par. 1, letter a) and 24, par. 1, of the Regulation and in the absence of an appropriate legal basis (in particular the consent provided for by art. 130, paragraph 3, of the Code or the use of public telephone directories in derogation from the aforementioned provision) and that the contact itself was not preceded by the prior verification of the telephone number of the interested party with the Register of objections. With reference to these necessary obligations, the owner did not provide any element in the investigation phase, thus failing to comply with the aforementioned principle of accountability.

It also emerged that the processing was not preceded by exhaustive information that could allow the complainant to become aware of the origin of the personal data used for the promotion, the legal basis, the purposes of the processing, the subjects who actually carried out the processing, the scope of communication of the data as well as the right of the interested party to exercise the rights referred to in arts. 15-22 of the Regulation. All this also in violation of the principles of transparency and fairness referred to in art. 5, par. 1, letter a), of the Regulation.

With regard to the exercise of the aforementioned rights, it was observed that the response provided to the interested party to the request for access to their data (art. 15 of the Regulation) and to the opposition to the processing for promotional and advertising purposes (art. 21 of the Regulation), was insufficient, since the owner did not provide the interested party with any of the elements subsequently communicated to the Authority relating to the existence of a relationship with a foreign call center, and did not ensure the correct reception of the opposition, since the individual company only represented in the response that it "does not have any of its data and that it does not use any marketing tools towards its person".

On the basis of the aforementioned observations, the Office contested the d.i. Pojer Giordano, the alleged violation of the following provisions:

a) art. 5, par. 1, lett. a), and 2; arts. 6 and 7; art. 24, par. 1, of the Regulation and art. 130 of the Code, for having carried out the above-described processing of the complainant's personal data in conflict with the principles of lawfulness and accountability and in the absence of an appropriate legal basis, failing to acquire from the interested party the necessary consent provided for by paragraph 3 of art. 130 of the Code and to check the telephone number of the aforementioned with the Register of Oppositions, pursuant to the subsequent paragraph 3-bis;

b) art. 5, par. 1, letter a), 13 and 14 of the Regulation, for having carried out the above-described processing in conflict with the principles of transparency and fairness and without having provided the interested party with appropriate information at least on the occasion of the first promotional contact;

c) art. 12, par. 2 and 3, in relation to art. 15 and 21 of the Regulation, for having provided the interested party with insufficient and omissive feedback to the request to exercise the right of access to the data and the right to object to the processing for promotional and advertising purposes.

2. OBSERVATIONS OF THE DATA CONTROLLER

Mr. Giordano Pojer, by email dated 28 May 2024, requested a hearing pursuant to art. 166, paragraph 6, of the Code. The Office therefore arranged for the hearing to be held on 2 July 2024, a hearing that did not take place due to the applicant's failure to appear, despite the customary summons.

Subsequently, the Authority received a new request for a hearing from the same Mr. Pojer, which also contained justifications for the failure to appear at the summons on 2 July. The Office, with a view to maximising the protection of the owner's right to be heard by the Authority, proceeded to a new summons for the same.