Garante per la protezione dei dati personali (Italy) - 9756869
From GDPRhub
| Garante per la protezione dei dati personali (Italy) - 9756869 | |
|---|---|
 | |
| Authority: | Garante per la protezione dei dati personali (Italy) |
| Jurisdiction: | Italy |
| Relevant Law: | Article 5(1)(a) GDPR Article 6(1) GDPR Article 7 GDPR Article 12(1) GDPR |
| Type: | Complaint |
| Outcome: | Upheld |
| Started: | 14.04.2021 |
| Decided: | 10.02.2022 |
| Published: | 30.03.2022 |
| Fine: | 5000 EUR |
| Parties: | Studio Colli Aniene Verderocca S.r.l. |
| National Case Number/Name: | 9756869 |
| European Case Law Identifier: | n/a |
| Appeal: | n/a |
| Original Language(s): | Italian |
| Original Source: | Garante per la Protezione dei Dati Personali (in IT) |
| Initial Contributor: | Cesar Manso-Sayao |
The Italian DPA issued a fine of €5000 against a company for lacking a valid legal basis to make unsolicited marketing calls using information obtained on the internet, as well as for not handling a data subject's access and deletion requests, in violation of Articles 5(1)(a), 6(1), 7 and 12(1) GDPR.
English Summary
Facts
A data subject filed a complaint with the Italian DPA (Garante per la Protezione dei Dati Personali – Garante) claiming he had received numerous undesired and periodic telephone calls promoting the real estate agency Tecnocasa in relation to a property he owns. The data subject also stated that he had not received a response to access and deletion requests under Article 15 GDPR and Article 17 GDPR respectively, which were forwarded to Studio Colli Aniene Verderocca S.r.l., a marketing company, which was the registered holder of the telephone numbers making the calls.
The Garante initiated an investigation, and determined that the marketing company (and not the real estate agency) was the autonomous controller in this case, since it processed the data based on its own data collection, and had established the purposes and methods of contact for the marketing calls independently.
When responding to the Garante’s request for information, the marketing company argued that they had only called the data subject twice. On the first occasion they had asked for his consent to the calls, which the company acknowledged that the data subject had objected to. The second call was admittedly made by a “mere error in good faith”, in light of the previously acknowledged objection. The company also claimed that the acquisition of the personal data was lawful since it had been found on the internet on publicly available websites as well as through Google searches, and also stated that it had deleted the complainant’s personal data from its databases.
Holding
The Garante noted that irrespective of the amount of calls made to the data subject, the fact that the data was obtained from the internet and that the initial call was made without prior consent or any other legal basis, constituted a violation of Articles 6 and 7 GDPR. Additionally, the Garante stated according to its own jurisprudence (see here) a telephone call aimed at obtaining consent for marketing purposes in itself constitutes processing for marketing purposes, and hence would circumvent the required consent required for the processing to begin with. Moreover, the Garante held that the unwanted telephone call received by the data subject due to a "mere error made in good faith" does not relieve the company of liability since it has not proven the inevitability of this mistake.
Regarding the collection of data using publicly available websites and Google searches, the Garante stated that the controller used the data collected on the internet to promote its services and products, pursuing a different purpose that is incompatible with the original purpose for which the data were made public (i.e. to facilitate the contacts of the data subject with its potential customers, with limited regard to the exercise of his profession) and therefore not according to the data subject’s legitimate expectations. The Garante also clarified that the easy availability of personal data on the internet does not justify the processing of such data for any purpose other than for what it was orignally published, and held that in this case, the collection and processing of this data was also in violation of Article 6(1) GDPR by lacking a valid legal basis.
The Garante also held that the company had violated its transparency obligations under Articles 5(1)(a) and 12(1) GDPR by failing to grant the data subject’s access and deletion requests, and by not providing any proof of internal framework and measures to handle these requests, or of the actual deletion of the data itself.
Based on these considerations, the Garante issued a fine of €5000 against the marketing company. It also ordered the company to take measures to comply with GDPR by ceasing its processing operations related to unsolicited marketing calls and obtaining personal data on the internet without a legal basis, as well as the implementation of procedures to ensure the response to data subjects’ exercise of their data protection rights, and to provide these with appropriate information with regard to the processing of their personal data.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Italian original. Please refer to the Italian original for more details.
[doc. web n. 9756869] Order injunction against Studio Colli Aniene Verderocca S.r.l. - February 10, 2022 Record of measures n. 49 of 10 February 2022 THE GUARANTOR FOR THE PROTECTION OF PERSONAL DATA IN today's meeting, which was attended by prof. Pasquale Stanzione, president, Professor Ginevra Cerrina Feroni, vice president, Avv. Guido Scorza, member, and the cons. Fabio Mattei, general secretary; GIVEN the Regulation (EU) 2016/679 of the European Parliament and of the Council, of 27 April 2016, concerning the protection of individuals with regard to the processing of personal data, as well as the free circulation of such data and which repeals Directive 95/46 / EC (General Data Protection Regulation, hereinafter the "Regulation"); GIVEN the Code regarding the protection of personal data (Legislative Decree 30 June 2003, n.196), as amended by Legislative Decree 10 August 2018, n. 101, containing provisions for the adaptation of national law to the aforementioned Regulation (hereinafter the "Code"); HAVING REGARD to the documentation on file; HAVING REGARD to the observations made by the Secretary General pursuant to art. 15 of the regulation of the Guarantor n. 1/2000; SPEAKER Prof. Ginevra Cerrina Feroni; WHEREAS 1. THE INVESTIGATION ACTIVITY CARRIED OUT With the complaint of May 14, 2021 presented to this Authority pursuant to art. 77 of the Regulations, Mr. XX complained that he received unwanted "periodic phone calls" aimed at promoting the services of the Tecnocasa Agency regarding a property he owned and, moreover, represented that he had not received a response to the request to exercise the rights, pursuant to art. 15 and 17 of the Regulations, sent via certified email on 17 February 2020 to the Affiliate Studio Colli Aniene Verderocca S.r.l. (hereinafter «Studio Colli Aniene», or «Company») “holder of the telephone numbers” calling; the same complainant highlighted the perpetuation of further unwanted contacts on the part of the aforementioned Company up to the date of the filing of the complaint. In this regard, the Office has launched an investigation, with requests for information made on the dates of May 19 and June 24, 2021 (the latter requested on September 2, 2021, pursuant to Article 157 of the Code), in order to to acquire elements of evaluation which allowed to exclude violations of Tecnocasa Franchising SpA with regard to the promotional contacts complained of in the complaint, as carried out by the company Studio Colli Aniene Verderocca S.r.l., as an independent data controller, on the basis of its own independent data collection. In response to the aforementioned requests for information, the Company, with notes dated 8 June and 3 September 2021, declared that it had contacted the complainant in only two circumstances (6 February and 14 May 2020), adding that it had requested consent to the processing. of personal data for promotional, market research and profiling purposes, on the occasion of the first phone call and providing, in this circumstance, to register the refusal opposed by Mr. XX, only to then contact the latter again for "mere mistake made in total good faith". The Company, which has ensured that it has deleted the complainant's data from its databases, also represented that it lawfully processed the same data as it was found on the Internet, by consulting the websites www.trovanumeri.com and www.psicologi.it and carrying out a nominal survey on the search engine "Google". The complainant, in the observations sent to this Authority on 23 June 2021 and formulated regarding the response of 8 June 2021, with regard to the telephone calls received, objected to the smallness of the same in the terms represented by the Company, pointing out, on the contrary, that the same allegedly omitted "the numerous other phone calls, even in previous years, where it had already been pointed out, with extreme courtesy, that they do not like calls with the offer of unsolicited services, not failing to invite, with equal kindness, the cancellation of their data and his wife from their databases ". 2. CONTESTATION OF VIOLATIONS AND EXERCISE OF THE RIGHT OF DEFENSE 2.1. The dispute In light of what emerged from the preliminary investigation in the terms summarized above, also on the basis of the statements of the Company to which the declarant responds pursuant to art. 168 of the Code, on 12 November 2021 Studio Colli Aniene was notified of the initiation of the procedure pursuant to art. 166, paragraph 5, of the Code. It should be noted in advance that Studio Colli Aniene is to be considered the owner of the processing of personal data, since it has established both the purposes and the methods of contact (see Article 28 of the Regulations); therefore, both the obligations set by the legislation on the protection of personal data and the responsibility for the violations detected are directly attributable to the same Company. Having said this, the Office, in particular, observed that, regardless of the number of contacts complained of, personal data processing operations appear to have been carried out, both with regard to the systematic collection of data found on the network and the subsequent commercial contact activity ( at least on February 6 and May 14, 2020) in the absence of the necessary prior informed consent of the interested party in relation to the marketing activity and in the absence of another suitable legal basis, thus integrating the violation of articles 6 and 7 of the Regulation and 130 of the Code. Furthermore, it did not appear that the Company provided the data subject with the information referred to in art. 14 of the Regulation for data not collected directly from the same, nor that the same has found the request to exercise the rights (sent via certified email by the complainant) within the terms provided for by art. 12, par. 3, of the Regulations, the reception of which has not, however, been denied. During the procedure, the Company did not provide explanations regarding the lack of response, despite this being expressly requested by the Office, and it does not even appear that it adequately acknowledged the opposition expressed by the interested party during the complained contacts, considering the '' admission by the same Company of the making, for an alleged error, of a further unwanted phone call. Therefore, it does not appear that Studio Colli Aniene has adopted a system that facilitates the exercise of the rights of the interested parties; therefore, overall, the possible violation of articles 12, par. 3, 14, 15, 17 and 21 of the Regulations; Moreover, the information requested by the Office to supplement the first response (of 8 June 2021) was found to be late (having been received only following the reminder made on 2 September 2021, pursuant to art.157 of the Code) and overall unsatisfactory. . In particular, the Company, with communication dated 3 September 2021, limited itself to confirming what has already been expressed with the first aforementioned reply and to declare generically that it carries out "a marketing and research activity, aimed at bringing together supply and demand real estate in a specific area, carrying out their work in compliance with the provisions of the law ". It also did not produce the various additional elements required, with particular regard to the number of data collected online for the promotional campaign, any profiling carried out and the measures taken to ensure the exercise of the right of opposition of the interested parties. This conduct, therefore, is in contrast with the provisions contained in Articles 5, par. 2, and 24 of the Regulation which frame the responsibilities of the owner with a view to accountability aimed at ensuring the implementation of the obligations provided for by the Regulation and to prove, at the appropriate time (in particular possibly following requests from the 'Office or, even earlier, at the requests of the interested parties), the fulfilments carried out. 3. LEGAL ASSESSMENTS As already emerged in the introduction (paragraph 1), it is noted that the Company has declared that it has requested consent to the processing of personal data for promotional, market research and profiling purposes, on the occasion of the first phone call to the interested party (who Studio Colli Aniene dates back to 6 February 2020), confirming, therefore, that it had carried out the aforementioned treatment in the absence of the necessary legal basis for the commercial activity. This telephone call, aimed at obtaining consent for marketing purposes, is to be considered "commercial communication", as recently established by the jurisprudence of legitimacy (Cass. Civ., Section I, ord. April 26, 2021, n. 11019) that - in confirming the validity of the provision of the Guarantor of 22 June 2016 n. 275 (web doc. 5255159) on the unlawfulness of telephone calls for the "recovery of consent" of the interested parties - has, once again, highlighted that "The purpose to which the consent required for processing is unavoidably linked cannot fail to contribute to qualify the processing itself, reason why the processing of the data of the interested party to request consent for marketing purposes is itself a processing for marketing purposes "(see in the same sense the Guidelines on promotional activities and contrast to spam - 4 July 2013; web doc. 2542348). It follows that the contact, even if carried out exclusively to obtain consent for promotional purposes, would have eluded the fundamental principle of self-determination of the interested party with regard to the processing of his personal data which manifests itself in the related fulfillment of free, specific and documented consent for the aforementioned commercial purpose. It should also be noted that the unsolicited phone call received by the interested party for "mere error committed in total good faith" does not relieve the Company of the liability deriving from the violation of the aforementioned provisions nor does it allow for the application of the exemption, even if invoked by the same Company , pursuant to art. 3 of the law n. 689/1981, having not been able to prove the inevitability. Furthermore, in the context of the feedback, Studio Colli Aniene did not produce, in a collaborative and proactive perspective, adequate answers regarding the elements requested, that is, such as to better understand the factual dynamics and its treatment policy, replying with generic formulas and standardized and preventing a more in-depth evaluation of the treatments by the Authority. As already pointed out, in fact, in response to the request of the Office of 24 June 2021, aimed at supplementing the information provided with the first reply of 8 June 2021, the Company has not provided any response, except after having been in this sense requested with the note dated 2 September 2021, formulated pursuant to art. 157 of the Code. In this regard, it should be remembered that the elements useful for defining the investigation framework should be promptly provided by the recipients of the Authority's requests in the competent investigation center to avoid lengthening and burdening the procedural process, as occurred in the present case (see in this regard, engineering order 13 May 2021, web doc. 9670025; provision 16 December 2021, web doc. no. 9735672). Moreover, in the incomplete representation provided, the Company limited itself to ensuring that it had proceeded with the cancellation of the complainant's personal data, without however giving evidence of the actions taken, especially in a more articulated framework of measures and interventions that, at company level, should be foreseen for the management of these problems. The negligent nature of the conduct with which the Company did not provide the requested information, to be considered grossly negligent, reveals a serious flaw in the transparency obligations of Studio Colli Aniene (articles 5, paragraph 1 letter a) and 12, par. 1, of the Regulations) which, in the opacity of its work, has violated the aforementioned fundamental guarantees provided by law. With regard to the collection of personal data online and the use of these for marketing purposes (as happened for the data of Mr. XX collected by consulting the websites www.psicologi.it and www.trovanumeri.com and carrying out a nominal survey on the Google search engine), it was considered possible to deduce that these practices fall within the usual operating methods or, at least, are not considered to be in conflict with them. As already described above, the Company reaffirmed its conviction regarding the lawfulness of the online acquisition of the registry lists relating to telephone numbers to be used for marketing purposes, as a preordained operating mode for the execution of subsequent business contacts. In the present case, therefore, Studio Colli Aniene used the data collected on the Internet to promote its services and products, pursuing a different and incompatible purpose with the original one for which the data were made public (such as facilitating contacts with 'interested with his own potential customers, with limited regard to the exercise of his profession) and therefore does not fall within the legitimate expectations of the complainant who, moreover, from the documents, does not appear to have ever expressed and advertised the will to put his own immobile. In this regard, it should be remembered that the Guarantor has repeatedly clarified that "the easy availability of personal data on the internet (such as telephone numbers or e-mail addresses) does not involve the free availability of the same nor does it authorize the processing of such data for any purposes, but - in compliance with the principles of correctness and purpose (see art. 5, par. 1, lett. a) and b), Regulation) - only for the purposes underlying their publication "(see general provision on the subject of electoral propaganda and political communication - 18 April 2019; web doc. 9105201; Guidelines on spam, cit.). Therefore, also with regard to marketing activities, the general prohibition of using the data found on the web for this purpose must be highlighted, without specific informed consent for the aforementioned purpose (see articles 6, 7 and 14, Regulation; for a similar case, relating to real estate services subject to promotional communications sent to contact data taken from the web, and in particular from the social network Linkedin, deviating from the purpose for which the data were published: see injunction order of 16 September 2021, web doc. 9705632). The conduct described therefore entailed, as highlighted above, that the processing of data - which resulted in the collection of the data and the making of telephone calls for promotional purposes - took place in the absence of a suitable legal basis, not being attributable to any of the conditions of lawfulness pursuant to art. 6, par. 1, of the Regulation. Having acknowledged that the Company has not presented defensive writings or requested to be heard by the Authority, it is deemed necessary to confirm the alleged violations. Therefore, it is necessary, pursuant to art. 58, par. 2, lett. f), prohibit the processing for promotional purposes of personal data found on the Internet and for which the Company is unable to prove the acquisition of suitable consent by the interested parties. Furthermore, since the Company has not provided feedback to the complainant's requests, unless after the intervention of the Guarantor, it is deemed necessary to order Studio Colli Aniene, pursuant to art. 58, par. 2, lett. d), to adopt appropriate procedures to ensure full and effective feedback to the exercise of rights. Furthermore, it is necessary to order the Company to issue suitable prior information to the interested parties regarding the processing of their data. Finally, with regard to the treatments already carried out and with dissuasive purposes, it is believed that the conditions exist for the application of a pecuniary administrative sanction pursuant to Articles 58, par. 2, lett. i) and 83 of the Regulation, by means of the following injunction order. 4. INJUNCTION ORDER FOR THE APPLICATION OF THE ADMINISTRATIVE PECUNIARY SANCTION On the basis of the above, given the violations referred to, the sanction provided for by art. 83, par. 5, of the Regulation. For the purposes of quantifying the administrative sanction, the aforementioned art. 83, par. 5, in setting the maximum legal limit in the sum of 20 million euros or, for companies, in 4% of the annual worldwide turnover of the previous year, whichever is higher, specifies the methods of quantifying the aforementioned sanction, which must "in any case [ be] effective, proportionate and dissuasive "(art. 83, par. 1 of the Regulations), identifying, for this purpose, a series of elements listed in par. 2 of art. 83 in question, to be assessed when quantifying the relative amount. What aggravating circumstances, in the present case, must be considered: 1. the subjective dimension of the conduct, to be considered grossly negligent, with particular reference to the repeated and insistent nature of the telephone contacts complained of even after the opposition to the processing, as well as the continuing substantial avoidance of the information requested by both the interested party and the Authority ( letter b); 2. the inadequate degree of cooperation shown in the discussions with the Authority as the Company did not provide, even in the face of two requests for information, the necessary additions for an adequate assessment of the treatments (letter f); 3. the discrepancy of the Company's conduct with respect to the substantial provisional activity of the Authority (letter k). As mitigating elements, it is believed that we must instead take into account: 1. the nature of the data processed, of a common type (letters a, g); 2. the isolated nature of the complaint which, as far as it was possible to ascertain, given the lack of cooperation of the Company, concerned only one interested party (letter a); 3. the limited volume of business for the year 2020, as resulting from the "VAT 2021 model" (approximately 125,000 euros); 4. the absence of previous proceedings against the Company (letter e). Based on the set of elements indicated above, in application of the principles of effectiveness, proportionality and dissuasiveness indicated in art. 83, par. 1, of the Regulation, taking into account the necessary balance between the rights of the interested parties and freedom of enterprise, also in order to limit the economic impact of the sanction on the organizational, functional and employment needs of the Company in proportion to the turnover resulting from the financial statements of the company, it is believed that it should apply to Studio Colli Aniene Verderocca Srl - also taking into account other similar cases (see for example the provision of 16 September 2021, cit.) - the administrative sanction of the payment of a sum of 5,000.00 (five thousand / 00) euros, equal to 0.05% of the maximum legal limit of 20 million euros. In the case in question, it is believed that the ancillary sanction of the publication on the website of the Guarantor of this provision, provided for by art. 166, paragraph 7, of the Code and art. 16 of the Guarantor Regulation n. 1/2019, taking into account the matter under investigation, namely the phenomenon of unwanted marketing, with respect to which this Authority has adopted numerous measures both of a general nature and aimed at certain data controllers and on which the attention of the 'user. Finally, the conditions set out in art. 17 of Regulation no. 1/2019 concerning internal procedures with external relevance, aimed at carrying out the tasks and exercising the powers delegated to the Guarantor, for the annotation of the violations found here in the internal register of the Authority, provided for by art. 57, par. 1, lett. u) of the Regulations. WHEREAS, THE GUARANTOR pursuant to art. 57, par. 1, lett. f), of the Regulations, declares illegal the processing described in the terms set out in the motivation by Studio Colli Aniene Verderocca S.r.l., based in Rome, Viale Sacco and Vanzetti 191, VAT no. 07803151005, and consequently: - pursuant to art. 58, par. 2, lett. f), of the Regulations, orders the definitive limitation of the processing of personal data of interested parties found on the web and for which he does not have an informed, free and specific consent for the promotional purpose or of another suitable and documented legal basis pursuant to of articles 6 and 7 of the Regulations; - pursuant to art. 58, par. 2, lett. d), orders the Company to adopt appropriate procedures to ensure a complete and timely response to the exercise of the rights of the interested parties as well as the release of suitable prior information regarding the processing of their personal data, pursuant to Articles 13 and 14 of the Regulation. ORDER to Studio Colli Aniene Verderocca S.r.l., with registered office in Rome, Viale Sacco and Vanzetti 191, VAT no. 07803151005, to pay the sum of € 5,000.00 (five thousand / 00) as a fine for the violations indicated in the motivation, representing that the offender, pursuant to art. 166, paragraph 8, of the Code, has the right to settle the dispute, with the fulfillment of the prescribed requirements and the payment, within thirty days, of an amount equal to half of the sanction imposed. INJUNCES to the aforementioned Company, in the event of failure to settle the dispute pursuant to art. 166, paragraph 8, of the Code, to pay the sum of € 5,000.00 (five thousand / 00), according to the methods indicated in the annex, within 30 days of notification of this provision, under penalty of the adoption of the consequent executive acts pursuant to 'art. 27 of the law n. 689/1981. HAS as an ancillary sanction, pursuant to art. 166, paragraph 7, of the Code and art. 16 of the Guarantor Regulation n. 1/2019, the publication on the website of the Guarantor of this provision and, pursuant to art. 17 of the Guarantor Regulation n. 1/2019, the annotation in the internal register of the Authority, provided for by art. 57, par. 1, lett. u) of the Regulations, violations and measures adopted. The Guarantor, pursuant to art. 58, par. 1, of the Regulations, also invites the data controller to communicate, within 30 days from the date of receipt of this provision, which initiatives have been undertaken in order to implement the provisions of this provision and in any case to provide adequately documented feedback. Please note that failure to respond to the request pursuant to art. 58 is punished with the administrative sanction referred to in art. 83, par. 5, lett. e), of the Regulations. Pursuant to art. 78 of Regulation (EU) 2016/679, as well as of articles 152 of the Code and 10 of the legislative decree 1 September 2011, n. 150, opposition to this provision may be filed with the ordinary judicial authority, with an appeal filed with the ordinary court of the place where the data controller is resident, or, alternatively, to the court of the place of residence of the person concerned. , within thirty days from the date of communication of the provision itself, or sixty days if the applicant resides abroad. Rome, February 10, 2022 PRESIDENT Stanzione THE RAPPORTEUR Cerrina Feroni THE SECRETARY GENERAL Mattei
