Garante per la protezione dei dati personali (Italy) - 9826417
From GDPRhub
| Garante per la protezione dei dati personali - 9826417 | |
|---|---|
 | |
| Authority: | Garante per la protezione dei dati personali (Italy) |
| Jurisdiction: | Italy |
| Relevant Law: | Article 4(11) GDPR Article 5(1) GDPR Article 5(2) GDPR Article 6 GDPR Article 7 GDPR Article 12(1) GDPR Article 13 GDPR |
| Type: | Complaint |
| Outcome: | Upheld |
| Started: | |
| Decided: | 10.11.2022 |
| Published: | |
| Fine: | 500,000 |
| Parties: | an unnamed data subject Vodafone Italia |
| National Case Number/Name: | 9826417 |
| European Case Law Identifier: | n/a |
| Appeal: | Unknown |
| Original Language(s): | Italian |
| Original Source: | Garante per la Protezione dei Dati Personali (in IT) |
| Initial Contributor: | Carloc |
The Italian DPA fined telecom provider Vodafone Italia €500,000 for processing personal data for direct marketing with no legal grounds, for collecting generic consent for distinct data processing operations, and for providing information about the processing of personal data in an incomprehensible way.
English Summary
Facts
An 85-year-old woman (the data subject) received a call from an Albanian call centre, working for Italian telecom provider Vodafone (the data controller) and allegedly concluded a contract with Vodafone over the phone. During the call, the telemarketer provided the data subject with information about the processing of her personal data. The operator collected a generic consent for the two distinct purposes of performing the contract and forwarding promotional information. All information regarding the contract was delivered at a speed of 200 words per minute, including the information on the processing of the subject's personal data.
The data subject's son later contacted the controller and protested that she never concluded a contract. The controller cancelled the contract and refunded all expenses. Three months later, the son of the data subject filed a complaint with the Italian DPA, claiming that the contract was concluded in violation of the GDPR.
Holding
During the investigation, the data controller claimed that the data subject herself previously contacted the call centre to conclude the contract. However, the controller failed to provide conclusive proof of the data subject's first call. The DPA dismissed the controller's version as highly unlikely and noted that the burden of proof of consent lies on the data controller according to the accountability principle laid down in Article 5(2) GDPR. For this reason, the DPA concluded that the call centre first contacted the data subject. The DPA held that the controller processed her personal data for direct marketing purposes with no legal basis and without providing any information on the processing, in violation of Articles 5(1), 6, 7, 12(1) and 13 GDPR.
The DPA also held that the data controller failed to collect specific consent for processing personal data for promotion purposes, in violation of Article 4(11) that requires that such consent is distinct from the other matters like the contract. Therefore, the DPA held that the controller violated Articles 5(1)(a), 6 and 7 GDPR.
The DPA finally held that the controller violated the principles of fairness and transparency under Article 5(1)(a) because the information on the processing of the subject's personal data was provided in an incomprehensible way.
Consequently, the DPA fined the controller €500,000 for the established violations.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Italian original. Please refer to the Italian original for more details.
SEE ALSO Newsletter of 28 November 2022
[doc. web no. 9826417]
Injunction against Vodafone Italia S.p.A. - November 10, 2022
Register of measures
no. 379 of 10 November 2022
THE GUARANTOR FOR THE PROTECTION OF PERSONAL DATA
IN today's meeting, which was attended by prof. Pasquale Stanzione, president, prof.ssa Ginevra Cerrina Feroni, vice president, dr. Agostino Ghiglia and the lawyer Guido Scorza, components and the cons. Fabio Mattei, general secretary;
HAVING REGARD TO Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data, as well as on the free circulation of such data and repealing Directive 95/46 /CE (General Data Protection Regulation, hereinafter "Regulation");
HAVING REGARD TO the Code regarding the protection of personal data (legislative decree 30 June 2003, n. 196), as amended by legislative decree 10 August 2018, n. 101, containing provisions for the adaptation of the national legal system to the aforementioned Regulation (hereinafter the "Code");
HAVING REGARD to the documentation in the deeds;
HAVING REGARD TO the observations made by the general secretary pursuant to art. 15 of the Guarantor's regulation n. 1/2000, adopted with resolution of 28 June 2000;
SPEAKER Prof. Geneva Cerrina Feroni;
1. THE INVESTIGATION ACTIVITY CARRIED OUT
1.1. Premise
With deed of 8 August 2022, n. 42684/22 (notified on the same date by certified e-mail), which here must be understood as reproduced in full, the Office has initiated, pursuant to art. 166, paragraph 5, of the Code, a procedure for the adoption of the provisions pursuant to art. 58, par. 2, of the Regulations against Vodafone Italia S.p.A., (hereinafter "Vodafone" or "the Company"), in the person of its pro-tempore legal representative, with registered office in Ivrea (TO), via Jervis 13, C.F. 08539010010.
The proceeding originates from an investigation initiated by the Authority, following the receipt of a complaint proposed on behalf of Ms XX by her son XX. The complaint stated that Ms XX, aged 85, was contacted, in the first days of December 2020, by a call center of the Vodafone sales network, with which she concluded, according to her without realizing it , a contract for the activation of fixed-line telephone services and related number portability in Vodafone.
Realizing what happened, the complainant requested the withdrawal from the contract, on 3 December 2020, which was followed by a request for recovery of expenses, equal to € 173.49, sent to the interested party by a company on behalf of Vodafone . The complainant exercised his right of access pursuant to art. 15 of the Regulation, asking Vodafone for information on the origin of personal data and on the methods of processing and communicating them. The telephone company acknowledged the request by indicating the data in its possession and representing that it had "proceded to revoke the commercial consent, previously released during the activation phase on 05/11/2020". It also indicated the data from the complainant's identity document, as acquired in the course of the sale of the telephone service. The complainant, deeming that Vodafone, during the telephone contact aimed at selling a service and in replying to the request for access, had not implemented conduct that complied with the provisions of the Regulation, requested the intervention of the Authority.
1.2. Requests for information formulated by the Authority
The Office, having received the complaint, proceeded to ask Vodafone for its own observations on the incident and the telephone company, with a note dated 5 August 2021, pointed out that "in relation to the acquisition of consent, prior to contacting the Vodafone Partner who completed the sale through Vocal Recording, from the evidence received from the same Partner, it appears that Mrs. XX, on 11/5/2020 at 13:33, made a call with her fixed number [...] to the IVR having the number 08119043605, at the time belonging to the sub-supplier Wocs of the Partner PROMARKETING SHPK" and that "consequently Mrs. XX, having given her consent to the recontact, was contacted again in recall by the same Partner who then finalized the activation of the contract "Tutto Facile Fisso ” via voice recording which, today, the Undersigned has sent to Mr. XX. The contact with Ms. XX was therefore made based on the consent acquired through the previous inbound contact made by the same. The release of the commercial consent was also confirmed by Mrs. XX during the voice recording phase; then revoked by Vodafone on 02/24/2021, at the customer's request. Finally, as regards the correctness of the Identity Card number, it should be noted that the document number present on Vodafone's systems is the same [...] that Mrs. XX provided during the voice recording carried out in November 2020 ”.
Following a reply from the complainant, who contested that she had ever made direct calls to Vodafone call centers to give consent to promotional recontact, the telephone company communicated its "willingness to receive objective elements from Ms XX regarding the absence of calls from the [...] line in your name to the IVR of the commercial Partner (e.g. details of the outgoing traffic in the month of November 2020). This is because Vodafone received from its Commercial Partner and provided in its response to the Authority the print screen of the incoming call received from the [...] line to the Commercial Partner's IVR, therefore it has taken note of it and, in the absence of evidence to the contrary, can only confirm and reiterate what has already been explained in its reply dated 7 August 2021 ”.
The Office, after the exchange of letters from the parties, proceeded to send a new request for information to Vodafone, pursuant to art. 157 of the Code, for the acquisition of the "recording of the telephone conversation which took place on 5 November 2020, at 1.33 pm, between Ms XX and the operator of the sub-supplier Wocs of the partner Vodafone Promarketing shpk, telephone conversation during the which Ms XX would have given her consent to the re-contact for the purpose of selling Vodafone products and services and would have provided the details of her identity document".
Vodafone, in response to the request, sent the telephone recording in which "Ms. XX, as part of the vocalisation of the contract, confirmed to the operator the details of her identity document, tax code and line migration code [ …], previously provided, and also gave consent for commercial purposes which the operator indicated the method of revocation at any time by contacting Vodafone Customer Service. Consent then revoked by Vodafone on 24/02/2021, at the request of the customer".
This recording, based on what is reported at minute 6 and 25" of the same and reiterated at minute 6 and 30", appears to have been made on November 4, 2020 (therefore one day before the alleged call by Ms XX on the call -center, to release your consent to the promotional contact).
1.3. Claiming Violations
At the end of the preliminary investigation, the Office adopted the aforementioned notice of dispute no. 42684/22 in which, in the first place, it was observed that the information and documents collected had confirmed the version of the complainant who always denied having autonomously contacted a Vodafone call center to give his consent to promotional recontact, with the consequent impossibility to bring the treatments operated by the Company back to a suitable consent given by the interested party.
Therefore, it was highlighted that, when exercising the rights, the answers provided by Vodafone, in particular with reference to the exhibition of a copy of the identity document of the claimant present in the company archives, were not completed.
In the notice of dispute, it was also represented that from the examination of the voice recording of the sale of the telephone service to the complainant, it emerged that the operator would have submitted to Ms XX the following consent formula: "In compliance with the law on privacy the personal data collected during registration will be used by Vodafone and communicated to other telecommunications operators to activate the service requested by you. You also authorize us to process your data to send advertising material on Vodafone initiatives or offers by post, email, telephone, sms, mms, push notifications, via app and similar methods". It was therefore observed that this formula was, in some points of the recording, difficult to understand and only after numerous re-listenings, given that the operator had managed to pronounce a good 63 words in the space of 16 seconds, and that the same envisaged the acquisition of an undifferentiated and unambiguous consent, both for data communications to other telephone operators, for the purpose of activating the service (type of treatment for which the different legal basis pursuant to article 6, paragraph 1 had to be indicated , letter b) of the Regulation), and for the multiple methods of contacting the interested party ("mail, email, telephone, sms, mms, push notification, via app and sending with similar methods").
On the basis of what is indicated in the notice of dispute, the examination of the voice recording revealed further critical elements connected to the choice of the call-center operator to submit the contract for the activation of the services to the complainant through a reading carried out at an estimated speed of about 200 words per minute for more than six minutes of recording, a technique which made the contract itself incomprehensible and invaluable, with consequent infringement of the principle of correctness and transparency in the processing of personal data.
Finally, the notice of dispute highlighted that the responses provided by Vodafone to the Authority's requests for information were unsuitable as the Company re-proposed the unrealistic version of the call-center agency of the spontaneous contact made by the claimant to provide the call-center same consent to a subsequent promotional re-contact and having failed to clarify in the reply that the voice recording provided was that of the sale of the service and that this sale had taken place in a period prior to that of the alleged spontaneous contact of the complainant.
The Office, therefore, challenged Vodafone for the following hypotheses of violation:
a) articles 12, par. 1, and 13, of the Regulation, for having made a promotional contact with the complainant, through the company incorporated under Albanian law Wocs Shpk, based in Tirana, responsible for the treatment designated by Vodafone, without having given the interested party the necessary information in the forms and times referred to in the aforementioned provisions;
b) articles 5, par. 1, 6 and 7 of the Regulation, as well as 130, paragraph 3, of the Code, for having made the aforementioned promotional contact without having acquired the required consent from the interested party;
c) articles 5, par. 1, lit. a), 6 and 7 of the Regulation, as well as 130, paragraphs 1, 2 and 3, for having acquired from the interested party, during the promotional contact referred to above, an undifferentiated and single consent for the different types of contact, consent then registered in the Vodafone systems;
d) articles 5, par. 1, lit. a), of the Regulations for having carried out the processing of personal data aimed at concluding a contract for the activation of telephone services for the complainant, in violation of the principles of correctness and transparency of the processing;
e) art. 15, par. 3, of the Regulation, for having provided the complainant with an unsuitable response to the request to exercise the right of access to one's personal data, with specific reference to the identity document acquired;
f) art. 157 of the Code, for having provided the Authority with inaccurate feedback on requests for information and presentation of documents.
2. THE DEFENSE OF THE OWNER
The party has requested a hearing before the Authority, on the basis of the provisions of art. 166, paragraph 6, of the Code and by art. 13 of the Guarantor's regulation n. 1/2019, hearing which took place on 7 October 2022.
Vodafone, on that occasion, explained that the case takes place in a time period coinciding with the Authority's provision against the Company on the subject of telemarketing. At the time, the finalization of contracts through vocal orders was much more used than it is today, since in current times this technique has been almost completely replaced with signing by digital signature. The vocal order is still used today for subjects who may have greater difficulties with the electronic medium, such as consumers in the older age groups. The vocal order, according to Vodafone, is therefore a form of ratification of contractual options which are submitted to the customer during the unrecorded part of the telephone call, when they are explained punctually and in a discursive form, so that the listener has full knowledge of them. This is what happened in the case of the contact complained of by the complainant, during which the call center operator proceeded to record the vocal order only after having explained to Ms XX the various offers and having found on her part an orientation favorable to the conclusion of the contract and after having acquired the necessary data from the same, including the details of the identification document. In this regard, Vodafone underlined that the vocal order contains the data which are acquired, in the part of the telephone call not subject to recording, and such data are not, nor could they already be present in the Vodafone systems since some of them, such as for example the migration code, is known only to the holder of the contract.
Vodafone then highlighted that effectively in the case raised by the complainant a discrepancy emerges between what is indicated in the call tag relating to the release of consent, which would have been made on 5 November 2020, and the vocal order of the sale, in which the operator indicates the date of 4 November 2020, however there is no possibility of tracing the cause of this discrepancy and above all, if it derives from an operator error during registration or from an error in the tag. Also for this reason Vodafone had asked the complainant for the documentation regarding outgoing telephone traffic, not to question Ms XX's indications but to acquire a documentary element suitable for clarifying the matter and possibly ascertaining whether it had been formed a false call tag and ask the teleseller to account for it.
In a document produced during the hearing, Vodafone highlighted that, although in the vocal order the operator refers, due to a possible error, to the date of November 4, 2020, the audio file shows (in the name of the file itself) the date of November 5; likewise, the creation of Ms XX's registry and the activation of the new fixed line both date back to 5 November 2020.
From the impossibility of correctly identifying the origin of the discrepancy as mentioned above, it follows, in Vodafone's opinion, given the possible error of the operator on the date of the vocal order, corroborated by the evidence regarding the circumstance that the sale would have taken place on 5 November 2020 and not November 4, which should exclude any form of violation of art. 157 of the Code due to the lack of suitable objective elements to corroborate this dispute, as well as suitable subjective elements that can attribute this dispute to the Company, even if only by way of fault.
In Vodafone's opinion, even the fact that the call with which the service was sold to the complainant took place as part of a campaign called "Vodafone Outbound", does not prove that it could not have been preceded by a call from same complainant to give his consent to the recontact: "the wording "Vodafone Outbound" procedurally indicates that the operator, following the inbound contact request, has correctly proceeded in outbound to recontact the interested party to present the offer of interest of Mrs. XX and, therefore, has in this sense reported the aforementioned wording in the system [...]. These last considerations, in addition to reinforcing what is indicated above with regard to an absence of violation of art. 157 of the Private Code, also lead the undersigned to believe that the alleged high dispute is not founded (see the dispute referred to in pt. 4, letter b) of the Communication) regarding the absence of consent to the promotional contact, from the moment that the latter occurred on the basis of a spontaneous action by the interested party".
From the foregoing it follows, in Vodafone's opinion that "since the conduct of the interested party requesting recontact by the teleseller has been proven above", even the dispute regarding information would have no merit since, as a rule, at the time of the first "spontaneous" contact by an interested party, the automatic response system of the teleseller provides a summary information (name of the teleseller, of the client and request for consent for the promotional recontact, which can be provided by pressing the "#1" keys)
With reference to the methods of acquiring consent during the vocal order, Vodafone intended to represent that the first part of the formula examined was not necessary, since the treatments to which reference is made are those connected to the execution of the contract and to the service delivery. On consent for marketing purposes, since there is no differentiation in the collection of consent due to the different contact methods, the formula as expressed appears correct, even if now obsolete contact methods are reported (such as fax or mms) which are no longer are used more and which contribute to making the formula heavier and which the Company has undertaken to eliminate in order to simplify procedures for the benefit of the customer.
As for the methods for responding to requests to exercise rights, Vodafone observed that the claimant exercised this right more than three months after the closure of the overall affair, by which time the contract had been terminated by virtue of the claimant's request for deactivation, still before the completion of the portability of his number to Vodafone, and in any case he pointed out that the response was as broad as possible and within the deadlines set, as per the Company's consolidated procedure.
Likewise, Vodafone made it clear that the collaboration with the Guarantor was, as always, maximum and based on availability, such as, for example, in the production of the vocal order relating to the sale, provided not to evade the request for registration of the call in which the complainant gave consent to the recontact, not present in the Vodafone archives, but with the intention of offering the Authority the broadest documentary support for a complete assessment of the matter.
3. ASSESSMENTS OF THE AUTHORITY
First of all, it should be noted that Vodafone's observations provided during the hearing appear suitable for excluding the Company's liability with regard to the objection referred to in points e) and f) of the section, given that an unsuitable response does not appear to be proven by the same to requests to exercise the rights of the claimant, with specific reference to the production of a copy of the identity document and must be considered produced in good faith, and not with the intention of misleading the preliminary investigation, the vocal order of the sale of the telephone service instead of the requested audio file relating to the acquisition of Ms XX's consent.
As for items a) and b) of the notice of dispute, they concern the main question raised by the complainant, namely that Vodafone made a promotional contact with Ms XX through its sales network, without having provided the necessary information and without having acquired the required consent. In this regard, it should be remembered that the complainant represented - with a declaration that in the event of a mendacious act, she is subject to criminal sanctions pursuant to art. 168 of the Code - that Ms XX "has never given, in the past, any consent to the processing of her data to Vodafone either for contractual purposes or, least of all, for marketing purposes".
On this point, Vodafone's line during the hearing of 7 October 2022 was in full confirmation of the statements made during the preliminary investigation which thus reconstruct the facts: Ms XX, of her own accord, contacted a call center managed by a teleseller under Albanian law which operates on behalf of Vodafone, and allegedly expressed its willingness to be contacted again to receive promotional offers to an automatic responder (IVR). This choice was allegedly made consciously, after having received a brief report, by typing a combination of keys on the telephone. Subsequently, Ms XX was actually contacted by the teleseller who allegedly carried out the sale of a telephone service with portability of the complainant's fixed number to Vodafone. Only about a month after the episode, the claimant decided to withdraw from the contract, a decision which resulted in the return of the number to the original telephone operator and the charge to Ms XX of € 173.49 for recovery of expenses (subsequently reversed in full by Vodafone).
This reconstruction, as well as being based on the unlikely assumption that someone, belonging to a customer group not characterized, by age and social characteristics, by a particular propensity to migrate from one telephone provider to another, can decide motu proprio to contact a call center (whose numbering is not known in which way it is knowable) to receive promotional offers in subsequent telephone communications, appears to be contradicted by various elements, the first of which, it is reiterated, is the claimant's declaration on the basis of which the same "has never given, in the past, any consent to the processing of their data to Vodafone either for contractual purposes or, least of all, for marketing purposes".
The aforementioned declaration should have led Vodafone to carry out a careful examination of the circumstances reported by the partner of its sales network, from which the first and most evident contradiction would certainly have emerged, namely that the "incoming call" from Ms XX was recorded in the Vodafone systems as being part of an "outbound" campaign, a term used to define commercial initiatives characterized by "outgoing" calls from the customer's network to potential customers.
Vodafone, on the other hand, stated that the promotional campaigns originating from a spontaneous contact of the interested party can be defined as "outbound" if the subsequent recontact takes place with "outgoing" calls, but this does not appear convincing since it cannot be understood as a subsequent event (the re-contact call) can modify a system annotation which takes place at a logically earlier moment (the "incoming" call from the customer requesting to be re-contacted), an annotation which, moreover, refers to the method of acquiring the consent of the interested party and not to the methods of carrying out the promotional campaign.
The second contradiction, no less relevant, is that regarding the date of the sale of the telephone service to Ms XX, which would appear to have been made on November 4, 2020, one day before, therefore, Ms XX's decision to contact the call center to release your consent to the recontact.
In this regard, Vodafone, while admitting that the elements supplied by it actually contradict each other, affirmed that it is not possible to establish which element is in contrast with reality, i.e. whether it was the call center that falsely noted that the Ms XX made a call on November 5, 2020 at 1.33 pm, expressing the wish to be contacted again, or it was the operator who incorrectly declared in the vocal order, that the contract had been finalized on November 4, 2020.
However, this uncertainty does not lead to an insufficiency of the probative elements suitable for determining the absence of the Company's liability with regard to the disputes referred to in paragraphs a) and b), provided that, pursuant to art. 5, par. 2 of the Regulation, as well as the related recital no. 42, it is precisely Vodafone that must prove that it has provided the interested party with suitable information and acquired the required consent before carrying out the promotional contact and this proof certainly cannot reside in contradictory documents of which the Company itself questions the real consistency , overshadowing a possible error by the operator in the "ratification" of the contractual agreement through the vocal order, or even the possible falsification of the call tag by the teleseller in relation to the alleged "spontaneous" call from Ms XX.
Therefore, in the light of the contradictions that emerged regarding the release of appropriate information to the complainant and the acquisition of her consent for promotional purposes, contradictions which reinforce the declaration of Ms XX who stated that she had never contacted the sales network of the Company to release its consent to any subsequent promotional contacts, the responsibility of Vodafone is confirmed in relation to items a) and b) of the notice of dispute.
For the sake of completeness, it should be noted that, even admitting that the "incoming" call by the claimant was actually made, the content of the same, as reconstructed by Vodafone (summary information issued by Vodafone through an automatic responder and consent to the processing of data for promotional purposes expressed by the interested party by typing the "#1" keys on their device), does not appear suitable to constitute a framework of legitimacy of subsequent treatments, due to the lack of both the minimum information elements offered to the interested party and the element of the unambiguousness of the consent itself (which does not seem to be ensured by the simple typing of an alphanumeric sequence of two elements).
With reference to the disputes sub c) and d), which concern the methods of acquiring the consent of the interested party in the context of the vocal order and the compatibility of the overall procedure with the principles of correctness and transparency pursuant to art. 5, par. 1, lit. a), of the Regulation, Vodafone's defensive observations must first of all be taken into account which, on the one hand, stated that no provision of the Regulation or of the Code prohibits the controller from requesting undifferentiated consent with reference to the various promotional contact methods of the 'interested. From this assumption it would therefore derive the non-existence of the contestation referred to in point c).
On this point it is necessary to place the element of the consent formula in the context of the overall vocal order which, although it is considered by Vodafone as a formal ratification of the meeting of the wishes of the telephone company and the customer in the context of the sale of a , must be considered as the only documentary element able to crystallize the decision-making moment of the interested party both in terms of consent for the processing of personal data, and, more generally, as regards the decision to adhere to Vodafone offers . Reducing this document to a mere formality, devoid of substantial significance, can favor a distorted use of the vocal order tool, despite the fact that it is now reserved, by explicit admission by Vodafone, for categories of older customers or in any case unfamiliar with the use of technological tools, with the consequence, represented in all its evidence in the case in question, that the different and complex contractual options, as well as the different purposes and methods of processing personal data, were listed in a very rapid sequence by the call center operator (about 200 words per minute for over six minutes), thus subjecting the interlocutor to an unsustainable conceptual bombardment which it is reasonable to believe prevented the client from having full knowledge of the scope of her choices.
From this point of view, the analysis of the so-called "formula of consent", consisting of over 60 words pronounced by the operator in about 16 seconds, appears to be an exercise of little use, if one considers that, above all other considerations, the observation prevails that this formula was found to be barely understandable only after repeated listening.
Specifically, however, this formula is incorrect, firstly because it includes in the same context treatments having different purposes (execution of a contract and promotional contact). The defensive consideration that, in any case, treatments having contractual purposes would be removed from the obligation of consent is worthless, since the inclusion of the same in the indistinct group of "consented" treatments introduces a further element of confusion in a framework of per se already affected by the critical issues highlighted above, from which it follows, in a nutshell, that the interested party would have given consent to the processing of their personal data for promotional purposes and with the most diverse contact methods, in one case after listening of a pre-recorded message and typing an alphanumeric combination of two elements and, subsequently, following listening to a formula read at a speed that is objectively unsustainable for adequate understanding, in which both the aims of the treatment for which it is not necessary to give consent, both promotional ones (without any distinction related to the m contact mode).
As for the consideration that, with reference to promotional contacts, no law prohibits the holder from requesting undifferentiated consent with reference to the various contact methods (automated methods or telephone contacts made by a human operator), it must be understood that this simplification element was introduced by the Guarantor with provision no. 242 of 15 May 2013 (in www.gpdp.it, web doc. n. 2543820), with which it was in any case underlined that the need to streamline bureaucratic obligations must in any case allow "the interested party, precisely in the presence of particularly invasive and onerous forms of commercial communication, the possibility of controlling the use of one's personal data, through the conscious and specific expression of consent". Therefore "from the information issued by the owner [...] and from the request for consent it must be clear that, with regard to the treatments carried out for "direct marketing" purposes, the consent of the interested party acquired pursuant to art. 130, paragraphs 1 and 2, of the Code, concerns not only automated, but also traditional methods of communication" and "moreover, with regard to the recognized possibility for the interested party to express his/her wish to receive commercial and promotional communications exclusively through methods traditional contact methods, it will be up to the data controller to expressly refer to it in the information and make this wish exercisable easily and free of charge". The consent formula prepared by Vodafone and inserted in the complainant's vocal order does not contain any reference to the system outlined above and must therefore be considered completely ineffective in achieving the reconciliation between the need for simplification of the obligations by the owner and the right to delimit the extent of the consent granted to the interested party, with the consequence that, in the case in question, the consent given is generic and undifferentiated, therefore in contrast with the principles present today in the articles 4, no. 11 and 7 of the Regulation, as well as in the related recital no. 32.
As for the dispute sub d), relating to the violation of the principles of correctness and transparency with reference to the processing connected with the sale of the telephone service to the complainant, as documented by the vocal order produced by the Company, Vodafone's reference to the peaceful ability to autonomously take care of her own interests by Ms XX, an ability which has never been questioned and which, in any case, could exclusively concern aspects linked to the possible annulment of the contract.
In this case, what was observed in the notice of dispute must be reiterated ("the choice of the call center operator, evidently authorized by a common practice well known to Vodafone which has the voice recordings of the contracts and should subject them to quality checks , to submit to the claimant the contract for the activation of the services through a reading carried out at an estimated speed of about 200 words per minute for more than six minutes of recording, so that the entire contract is completely incomprehensible and, above all, invaluable by the of whoever has to decide whether to join or not, makes the whole treatment, and not just the prodromal promotional part, illegitimate"), and highlight that not the subjective characteristics of the complainant but the objective anomalies of the telephone sale sealed by an audio document which constitutes to all intents and purposes the contractual basis and which is largely incomprehensible to a normal listener, renders any treatment carried out in relation to this contract, irreparably flawed precisely in those elements of correctness which should represent the first and irreplaceable guarantee in the agreement between a large service company and the consumer.
The principle of correctness does not overlap with that of lawfulness but amplifies its scope by calling each holder not only to comply with the specific provisions of the law, but to make their own the overall meaning and spirit of the legislation on the protection of personal data in order to facilitate the choices of the interested party, on the basis of the same canons used in civil law to identify the correctness of the debtor and the creditor (art. 1175 of the civil code) and the good faith in the execution of the contract (art. 1375 of the civil code), more widely included in the principle of social solidarity pursuant to art. 2 of the Constitution.
Precisely because of the aforementioned interpretative canons, the conduct of Vodafone, in the sale of the telephone service made to Ms XX, appears largely incomplete and justifies the reaction of the complainant who, despite having by now obtained from the telephone company the restoration of the situation quo ante and the reversal of the charges for the withdrawal from the contract, turned to the Authority for a question of principle linked to the correct declination of the relationship between the owner and the interested party, a question which, in the light of the preliminary evidence connected in particular to the formation of the will of the complainant as documented in the vocal order, must be considered largely founded.
Vodafone's responsibility must therefore be confirmed for the violations alleged under items c) and d).
4. CONCLUSIONS
In view of the above, Vodafone's liability is deemed to have been established for the following violations:
a) articles 12, par. 1, and 13, of the Regulation, for having made a promotional contact with the complainant, through the company incorporated under Albanian law Wocs Shpk, based in Tirana, responsible for the treatment designated by Vodafone, without having given the interested party the necessary information in the forms and times referred to in the aforementioned provisions;
b) articles 5, par. 1, 6 and 7 of the Regulation, as well as 130, paragraph 3, of the Code, for having made the aforementioned promotional contact without having acquired the required consent from the interested party;
c) articles 5, par. 1, lit. a), 6 and 7 of the Regulation, as well as 130, paragraphs 1, 2 and 3, for having acquired from the interested party, during the promotional contact referred to above, an undifferentiated and single consent for the different types of contact, consent then registered in the Vodafone systems;
d) articles 5, par. 1, lit. a), of the Regulations for having carried out the processing of personal data aimed at concluding a contract for the activation of telephone services for the complainant, in violation of the principles of correctness and transparency of the processing.
Having also ascertained the unlawfulness of the Company's conduct with reference to the treatments examined, it becomes necessary:
- impose on Vodafone, pursuant to art. 58, par. 2, lit. f) of the Regulation, the prohibition of any further processing of the complainant's data;
- adopt an injunction order, pursuant to articles 166, paragraph 7, of the Code and 18 of the law n. 689/1981, for the application against Vodafone of the pecuniary administrative sanction provided for by art. 83, para. 3 and 5, of the Regulation
5. ORDER-INJUNCTION FOR THE APPLICATION OF THE PECUNIARY ADMINISTRATIVE SANCTION
The violations indicated above require the adoption of an injunction order, pursuant to articles 166, paragraph 7, of the Code and 18 of the law n. 689/1981, for the application against Vodafone of the pecuniary administrative sanction provided for by art. 83, para. 3 and 5 of the Regulations (payment of a sum up to €20,000,000.00 or, for companies, up to 4% of the annual worldwide turnover of the previous year, if higher);
For the determination of the maximum legal amount of the pecuniary fine, it is therefore necessary to refer to the turnover of Vodafone, as obtained from the latest available financial statements (March 2022) in accordance with the previous provisions adopted by the Authority, and therefore this maximum is determined issued, in the case in question, in Euro 220,154,181.56
In order to determine the amount of the fine, it is necessary to take into account the elements indicated in art. 83, par. 2, of the Regulation;
In the present case, the following are relevant:
1) the seriousness of the violations (Article 83, paragraph 2, letter a) of the Regulation), taking into account the object and purpose of the data processed, attributable to the overall phenomenon of telemarketing, in relation to which the Authority has adopted, in particular in the last three years, numerous measures which have fully examined the many critical elements by providing the data controllers with numerous indications to adapt the treatments to current legislation and to mitigate the impact of nuisance calls on the interested parties;
2) as an aggravating factor, the fact that Vodafone appears to have been the recipient of a corrective and sanctioning provision regarding telemarketing (Article 83, paragraph 2, letter e) of the Regulation), no. 224 of 12 November 2020 (in www.gpdp.it, web doc. n. 9485681);
3) as a mitigating factor, the fact that Vodafone promptly restored the situation prior to the sale of the telephone service to Ms XX, also transferring the sums requested as reimbursement of expenses for late withdrawal (Article 83, paragraph 2, letter c) of the Regulation);
4) as a mitigating factor to be taken into consideration when setting the fine (Article 83, paragraph 2, letter k) of the Regulation), the general socio-economic context, characterized by a profound economic crisis following the serious emergencies still in progress course and the circumstance that the ascertained case turns out to be isolated.
Based on the set of elements indicated above, and the principles of effectiveness, proportionality and dissuasiveness provided for by art. 83, par. 1 of the Regulation, and taking into account the necessary balance between the rights of the interested parties and the freedom to do business, also in order to limit the economic impact of the fine on the organizational and functional needs of the Company, it is believed that the administrative fine of the payment should be applied to Vodafone of a sum of Euro 500,000.00 (five hundred thousand).
In the case in question, it is believed that the ancillary sanction of publication on the Guarantor's website of this provision should be applied, provided for by art. 166, paragraph 7 of the Code and art. 16 of the Regulation of the Guarantor n. 1/2019, taking into account the nature of the treatments and the conduct of the Company, as well as the elements of risk for the rights and freedoms of the interested parties.
Finally, the conditions set forth in art. 17 of Regulation no. 1/2019 concerning internal procedures having external relevance, aimed at carrying out the tasks and exercising the powers delegated to the Guarantor.
ALL THIS CONSIDERING THE GUARANTEE
a) requires Vodafone, pursuant to art. 58, par. 2, lit. f) of the Regulation, the prohibition of any further processing of the complainant's data;
b) enjoins Vodafone, pursuant to art. 157 of the Code, to communicate to the Authority, within thirty days of notification of this provision, the initiatives undertaken in order to implement the imposed measure; any failure to comply with the provisions of this point may result in the application of the administrative fine provided for by art. 83, paragraph 5, of the Regulation
ORDER
to Vodafone Italia S.p.A., in the person of its pro-tempore legal representative, with registered office in Ivrea (TO), via Jervis 13, C.F. 08539010010, to pay the sum of 500,000.00 (five hundred thousand) euros as an administrative fine for the violations indicated in the justification, representing that the offender, pursuant to art. 166, paragraph 8, of the Code has the right to settle the dispute, with the fulfillment of the instructions given and the payment, within the term of thirty days, of an amount equal to half of the fine imposed.
ENJOYS
to the aforementioned Company, in the event of failure to settle the dispute pursuant to art. 166, paragraph 8, of the Code, to pay the sum of 500,000.00 (five hundred thousand) euros, according to the methods indicated in the attachment, within 30 days of notification of this provision, under penalty of adopting the consequent executive deeds pursuant to art. . 27 of the law n. 689/1981.
HAS
The application of the ancillary sanction of publication on the Guarantor's website of this provision, provided for by articles 166, paragraph 7 of the Code and 16 of the Regulation of the Guarantor n. 1/2019, and the annotation of the same in the internal register of the Authority - provided for by art. 57, par. 1, lit. u), of the Regulation, as well as by art. 17 of Regulation no. 1/2019 concerning internal procedures having external relevance, aimed at carrying out the tasks and exercising the powers delegated to the Guarantor - relating to violations and measures adopted in compliance with art. 58, par. 2, of the Regulation itself.
Pursuant to articles 152 of the Code and 10 of Legislative Decree no. 150/2011, opposition to this provision may be lodged with the ordinary judicial authority, with an appeal filed with the ordinary court of the place where the data controller has its registered office, within the term of thirty days from the date of communication of the provision itself .
Rome, 10 November 2022
PRESIDENT
Station
THE SPEAKER
Cerrina Feroni
THE SECRETARY GENERAL
Matthew
SEE ALSO Newsletter of 28 November 2022
[doc. web no. 9826417]
Injunction against Vodafone Italia S.p.A. - November 10, 2022
Register of measures
no. 379 of 10 November 2022
THE GUARANTOR FOR THE PROTECTION OF PERSONAL DATA
IN today's meeting, which was attended by prof. Pasquale Stanzione, president, prof.ssa Ginevra Cerrina Feroni, vice president, dr. Agostino Ghiglia and the lawyer Guido Scorza, components and the cons. Fabio Mattei, general secretary;
HAVING REGARD TO Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data, as well as on the free circulation of such data and repealing Directive 95/46 /CE (General Data Protection Regulation, hereinafter "Regulation");
HAVING REGARD TO the Code regarding the protection of personal data (legislative decree 30 June 2003, n. 196), as amended by legislative decree 10 August 2018, n. 101, containing provisions for the adaptation of the national legal system to the aforementioned Regulation (hereinafter the "Code");
HAVING REGARD to the documentation in the deeds;
HAVING REGARD TO the observations made by the general secretary pursuant to art. 15 of the Guarantor's regulation n. 1/2000, adopted with resolution of 28 June 2000;
SPEAKER Prof. Geneva Cerrina Feroni;
1. THE INVESTIGATION ACTIVITY CARRIED OUT
1.1. Premise
With deed of 8 August 2022, n. 42684/22 (notified on the same date by certified e-mail), which here must be understood as reproduced in full, the Office has initiated, pursuant to art. 166, paragraph 5, of the Code, a procedure for the adoption of the provisions pursuant to art. 58, par. 2, of the Regulations against Vodafone Italia S.p.A., (hereinafter "Vodafone" or "the Company"), in the person of its pro-tempore legal representative, with registered office in Ivrea (TO), via Jervis 13, C.F. 08539010010.
The proceeding originates from an investigation initiated by the Authority, following the receipt of a complaint proposed on behalf of Ms XX by her son XX. The complaint stated that Ms XX, aged 85, was contacted, in the first days of December 2020, by a call center of the Vodafone sales network, with which she concluded, according to her without realizing it , a contract for the activation of fixed-line telephone services and related number portability in Vodafone.
Realizing what happened, the complainant requested the withdrawal from the contract, on 3 December 2020, which was followed by a request for recovery of expenses, equal to € 173.49, sent to the interested party by a company on behalf of Vodafone . The complainant exercised his right of access pursuant to art. 15 of the Regulation, asking Vodafone for information on the origin of personal data and on the methods of processing and communicating them. The telephone company acknowledged the request by indicating the data in its possession and representing that it had "proceded to revoke the commercial consent, previously released during the activation phase on 05/11/2020". It also indicated the data from the complainant's identity document, as acquired in the course of the sale of the telephone service. The complainant, deeming that Vodafone, during the telephone contact aimed at selling a service and in replying to the request for access, had not implemented conduct that complied with the provisions of the Regulation, requested the intervention of the Authority.
1.2. Requests for information formulated by the Authority
The Office, having received the complaint, proceeded to ask Vodafone for its own observations on the incident and the telephone company, with a note dated 5 August 2021, pointed out that "in relation to the acquisition of consent, prior to contacting the Vodafone Partner who completed the sale through Vocal Recording, from the evidence received from the same Partner, it appears that Mrs. XX, on 11/5/2020 at 13:33, made a call with her fixed number [...] to the IVR having the number 08119043605, at the time belonging to the sub-supplier Wocs of the Partner PROMARKETING SHPK" and that "consequently Mrs. XX, having given her consent to the recontact, was contacted again in recall by the same Partner who then finalized the activation of the contract "Tutto Facile Fisso ” via voice recording which, today, the Undersigned has sent to Mr. XX. The contact with Ms. XX was therefore made based on the consent acquired through the previous inbound contact made by the same. The release of the commercial consent was also confirmed by Mrs. XX during the voice recording phase; then revoked by Vodafone on 02/24/2021, at the customer's request. Finally, as regards the correctness of the Identity Card number, it should be noted that the document number present on Vodafone's systems is the same [...] that Mrs. XX provided during the voice recording carried out in November 2020 ”.
Following a reply from the complainant, who contested that she had ever made direct calls to Vodafone call centers to give consent to promotional recontact, the telephone company communicated its "willingness to receive objective elements from Ms XX regarding the absence of calls from the [...] line in your name to the IVR of the commercial Partner (e.g. details of the outgoing traffic in the month of November 2020). This is because Vodafone received from its Commercial Partner and provided in its response to the Authority the print screen of the incoming call received from the [...] line to the Commercial Partner's IVR, therefore it has taken note of it and, in the absence of evidence to the contrary, can only confirm and reiterate what has already been explained in its reply dated 7 August 2021 ”.
The Office, after the exchange of letters from the parties, proceeded to send a new request for information to Vodafone, pursuant to art. 157 of the Code, for the acquisition of the "recording of the telephone conversation which took place on 5 November 2020, at 1.33 pm, between Ms XX and the operator of the sub-supplier Wocs of the partner Vodafone Promarketing shpk, telephone conversation during the which Ms XX would have given her consent to recontact for the purpose of selling Vodafone products and services and would have provided the details of her identity document".
Vodafone, in response to the request, sent the telephone recording in which "Mrs. XX, as part of the vocalization of the contract, confirmed to the operator the details of her identity document, tax code and line migration code [ …], previously provided, and also gave consent for commercial purposes which the operator indicated the method of revocation at any time by contacting Vodafone Customer Service. Consent then revoked by Vodafone on 24/02/2021, at the request of the customer".
This recording, based on what is reported at minute 6 and 25" of the same and reiterated at minute 6 and 30", appears to have been made on November 4, 2020 (therefore one day before the alleged call by Ms XX on the call -center, to release your consent to the promotional contact).
1.3. Claiming Violations
At the end of the investigation, the Office adopted the above-mentioned statement of objection no. 42684/22 in which, in the first place, it was observed that the information and documents collected had confirmed the version of the complainant who always denied having autonomously contacted a Vodafone call center to give his consent to promotional recontact, with the consequent impossibility to bring the treatments operated by the Company back to a suitable consent given by the interested party.
Therefore, it was highlighted that, when exercising the rights, the answers provided by Vodafone, in particular with reference to the exhibition of a copy of the identity document of the claimant present in the company archives, were not completed.
In the notice of dispute, it was also represented that from the examination of the voice recording of the sale of the telephone service to the complainant, it emerged that the operator would have submitted to Ms XX the following consent formula: "In compliance with the law on privacy the personal data collected during registration will be used by Vodafone and communicated to other telecommunications operators to activate the service requested by you. You also authorize us to process your data to send advertising material on Vodafone initiatives or offers by post, email, telephone, sms, mms, push notifications, via app and similar methods". It was therefore observed that this formula was, in some points of the recording, difficult to understand and only after numerous re-listenings, given that the operator had managed to pronounce a good 63 words in the space of 16 seconds, and that the same envisaged the acquisition of an undifferentiated and unambiguous consent, both for data communications to other telephone operators, for the purpose of activating the service (type of treatment for which the different legal basis pursuant to article 6, paragraph 1 had to be indicated , letter b) of the Regulation), and for the multiple methods of contacting the interested party ("mail, email, telephone, sms, mms, push notification, via app and sending with similar methods").
On the basis of what is indicated in the notice of dispute, the examination of the voice recording revealed further critical elements connected to the choice of the call-center operator to submit the contract for the activation of the services to the complainant through a reading carried out at an estimated speed of about 200 words per minute for more than six minutes of recording, a technique which made the contract itself incomprehensible and invaluable, with consequent infringement of the principle of correctness and transparency in the processing of personal data.
Finally, the notice of dispute highlighted that the responses provided by Vodafone to the Authority's requests for information were unsuitable as the Company re-proposed the unrealistic version of the call-center agency of the spontaneous contact made by the claimant to provide the call-center same consent to a subsequent promotional re-contact and having failed to clarify in the reply that the voice recording provided was that of the sale of the service and that this sale had taken place in a period prior to that of the alleged spontaneous contact of the complainant.
The Office, therefore, challenged Vodafone for the following hypotheses of violation:
a) articles 12, par. 1, and 13, of the Regulation, for having made a promotional contact with the complainant, through the company incorporated under Albanian law Wocs Shpk, based in Tirana, responsible for the treatment designated by Vodafone, without having given the interested party the necessary information in the forms and times referred to in the aforementioned provisions;
b) articles 5, par. 1, 6 and 7 of the Regulation, as well as 130, paragraph 3, of the Code, for having made the aforementioned promotional contact without having acquired the required consent from the interested party;
c) articles 5, par. 1, lit. a), 6 and 7 of the Regulation, as well as 130, paragraphs 1, 2 and 3, for having acquired from the interested party, during the promotional contact referred to above, an undifferentiated and single consent for the different types of contact, consent then registered in the Vodafone systems;
d) articles 5, par. 1, lit. a), of the Regulations for having carried out the processing of personal data aimed at concluding a contract for the activation of telephone services for the complainant, in violation of the principles of correctness and transparency of the processing;
e) art. 15, par. 3, of the Regulation, for having provided the complainant with an unsuitable response to the request to exercise the right of access to one's personal data, with specific reference to the identity document acquired;
f) art. 157 of the Code, for having provided the Authority with inaccurate feedback on requests for information and presentation of documents.
2. THE DEFENSE OF THE OWNER
The party has requested a hearing before the Authority, on the basis of the provisions of art. 166, paragraph 6, of the Code and by art. 13 of the Guarantor's regulation n. 1/2019, hearing which took place on 7 October 2022.
Vodafone, on that occasion, explained that the case takes place in a time period coinciding with the Authority's provision against the Company on the subject of telemarketing. At the time, the finalization of contracts through vocal orders was much more used than it is today, since in current times this technique has been almost completely replaced with signing by digital signature. The vocal order is still used today for subjects who may have greater difficulties with the electronic medium, such as consumers in the older age groups. The vocal order, according to Vodafone, is therefore a form of ratification of contractual options which are submitted to the customer during the unrecorded part of the telephone call, when they are explained punctually and in a discursive form, so that the listener has full knowledge of them. This is what happened in the case of the contact complained of by the complainant, during which the call center operator proceeded to record the vocal order only after having explained to Ms XX the various offers and having found on her part an orientation favorable to the conclusion of the contract and after having acquired the necessary data from the same, including the details of the identification document. In this regard, Vodafone underlined that the vocal order contains the data which are acquired, in the part of the telephone call not subject to recording, and such data are not, nor could they already be present in the Vodafone systems since some of them, such as for example the migration code, is known only to the holder of the contract.
Vodafone then highlighted that effectively in the case raised by the complainant a discrepancy emerges between what is indicated in the call tag relating to the release of consent, which would have been made on 5 November 2020, and the vocal order of the sale, in which the operator indicates the date of 4 November 2020, however there is no possibility of tracing the cause of this discrepancy and above all, if it derives from an operator error during registration or from an error in the tag. Also for this reason Vodafone had asked the complainant for the documentation regarding outgoing telephone traffic, not to question Ms XX's indications but to acquire a documentary element suitable for clarifying the matter and possibly ascertaining whether it had been formed a false call tag and ask the teleseller to account for it.
In a document produced during the hearing, Vodafone highlighted that, although in the vocal order the operator refers, due to a possible error, to the date of November 4, 2020, the audio file shows (in the name of the file itself) the date of November 5; likewise, the creation of Ms XX's registry and the activation of the new fixed line both date back to 5 November 2020.
From the impossibility of correctly identifying the origin of the discrepancy as mentioned above, it follows, in Vodafone's opinion, given the possible error of the operator on the date of the vocal order, corroborated by the evidence regarding the circumstance that the sale would have taken place on 5 November 2020 and not November 4, which should exclude any form of violation of art. 157 of the Code due to the lack of suitable objective elements to corroborate this dispute, as well as suitable subjective elements that can attribute this dispute to the Company, even if only by way of fault.
In Vodafone's opinion, even the fact that the call with which the service was sold to the complainant took place as part of a campaign called "Vodafone Outbound", does not prove that it could not have been preceded by a call from same complainant to give his consent to the recontact: "the wording "Vodafone Outbound" procedurally indicates that the operator, following the inbound contact request, has correctly proceeded in outbound to recontact the interested party to present the offer of interest of Mrs. XX and, therefore, has in this sense reported the aforementioned wording in the system [...]. These last considerations, in addition to reinforcing what is indicated above with regard to an absence of violation of art. 157 of the Private Code, also lead the undersigned to believe that the alleged high dispute is not founded (see the dispute referred to in pt. 4, letter b) of the Communication) regarding the absence of consent to the promotional contact, from the moment that the latter occurred on the basis of a spontaneous action by the interested party".
From the foregoing it follows, in Vodafone's opinion that "since the conduct of the interested party requesting recontact by the teleseller has been proven above", even the dispute regarding information would have no merit since, as a rule, at the time of the first "spontaneous" contact by an interested party, the automatic response system of the teleseller provides a summary information (name of the teleseller, of the client and request for consent for the promotional recontact, which can be provided by pressing the "#1" keys)
With reference to the methods of acquiring consent during the vocal order, Vodafone intended to represent that the first part of the formula examined was not necessary, since the treatments to which reference is made are those connected to the execution of the contract and to the service delivery. On consent for marketing purposes, since there is no differentiation in the collection of consent due to the different contact methods, the formula as expressed appears correct, even if now obsolete contact methods are reported (such as fax or mms) which are no longer are used more and which contribute to making the formula heavier and which the Company has undertaken to eliminate in order to simplify procedures for the benefit of the customer.
As for the methods for responding to requests to exercise rights, Vodafone observed that the claimant exercised this right more than three months after the closure of the overall affair, by which time the contract had been terminated by virtue of the claimant's request for deactivation, still before the completion of the portability of his number to Vodafone, and in any case he pointed out that the response was as broad as possible and within the deadlines set, as per the Company's consolidated procedure.
Likewise, Vodafone made it clear that the collaboration with the Guarantor was, as always, maximum and based on availability, such as, for example, in the production of the vocal order relating to the sale, provided not to evade the request for registration of the call in which the complainant gave consent to the recontact, not present in the Vodafone archives, but with the intention of offering the Authority the broadest documentary support for a complete assessment of the matter.
3. ASSESSMENTS OF THE AUTHORITY
First of all, it should be noted that Vodafone's observations provided during the hearing appear suitable for excluding the Company's liability as regards the objection referred to in points e) and f) of the heading, given that an unsuitable response does not appear to be proven by the same to requests to exercise the rights of the claimant, with specific reference to the production of a copy of the identity document and must be considered produced in good faith, and not with the intention of misleading the preliminary investigation, the vocal order of the sale of the telephone service instead of the requested audio file relating to the acquisition of Ms XX's consent.
As for items a) and b) of the notice of dispute, they concern the main question raised by the complainant, namely that Vodafone made a promotional contact with Ms XX through its sales network, without having provided the necessary information and without having acquired the required consent. In this regard, it should be remembered that the complainant represented - with a declaration that in the event of a mendacious act, she is subject to criminal sanctions pursuant to art. 168 of the Code - that Ms XX "has never given, in the past, any consent to the processing of her data to Vodafone either for contractual purposes or, least of all, for marketing purposes".
On this point, Vodafone's line during the hearing of 7 October 2022 was in full confirmation of the statements made during the preliminary investigation which thus reconstruct the facts: Ms XX, of her own accord, contacted a call center managed by a teleseller under Albanian law which operates on behalf of Vodafone, and allegedly expressed its willingness to be contacted again to receive promotional offers to an automatic responder (IVR). This choice was allegedly made consciously, after having received a brief report, by typing a combination of keys on the telephone. Subsequently, Ms XX was actually contacted by the teleseller who allegedly carried out the sale of a telephone service with portability of the complainant's fixed number to Vodafone. Only about a month after the episode, the claimant decided to withdraw from the contract, a decision which resulted in the return of the number to the original telephone operator and the charge to Ms XX of € 173.49 for recovery of expenses (subsequently reversed in full by Vodafone).
This reconstruction, as well as being based on the unlikely assumption that someone, belonging to a customer group not characterized, by age and social characteristics, by a particular propensity to migrate from one telephone provider to another, can decide motu proprio to contact a call center (whose numbering is not known in which way it is knowable) to receive promotional offers in subsequent telephone communications, appears to be contradicted by various elements, the first of which, it is reiterated, is the claimant's declaration on the basis of which the same "has never given, in the past, any consent to the processing of their data to Vodafone either for contractual purposes or, least of all, for marketing purposes".
The aforementioned declaration should have led Vodafone to carry out a careful examination of the circumstances reported by the partner of its sales network, from which the first and most evident contradiction would certainly have emerged, namely that the "incoming call" from Ms XX was recorded in the Vodafone systems as being part of an "outbound" campaign, a term used to define commercial initiatives characterized by "outgoing" calls from the customer's network to potential customers.
Vodafone, on the other hand, stated that the promotional campaigns originating from a spontaneous contact of the interested party can be defined as "outbound" if the subsequent recontact takes place with "outgoing" calls, but this does not appear convincing since it cannot be understood as a subsequent event (the re-contact call) can modify a system annotation which takes place at a logically earlier moment (the "incoming" call from the customer requesting to be re-contacted), an annotation which, moreover, refers to the method of acquiring the consent of the interested party and not to the methods of carrying out the promotional campaign.
The second contradiction, no less relevant, is that regarding the date of the sale of the telephone service to Ms XX, which would appear to have been made on November 4, 2020, one day before, therefore, Ms XX's decision to contact the call center to release your consent to the recontact.
In this regard, Vodafone, while admitting that the elements supplied by it actually contradict each other, affirmed that it is not possible to establish which element is in contrast with reality, i.e. whether it was the call center that falsely noted that the Ms XX made a call on November 5, 2020 at 1.33 pm, expressing the wish to be contacted again, or it was the operator who incorrectly declared in the vocal order, that the contract had been finalized on November 4, 2020.
However, this uncertainty does not lead to an insufficiency of the probative elements suitable for determining the absence of the Company's liability with regard to the disputes referred to in paragraphs a) and b), provided that, pursuant to art. 5, par. 2 of the Regulation, as well as the related recital no. 42, it is precisely Vodafone that must prove that it has provided the interested party with suitable information and acquired the required consent before carrying out the promotional contact and this proof certainly cannot reside in contradictory documents of which the Company itself questions the real consistency , overshadowing a possible error by the operator in the "ratification" of the contractual agreement through the vocal order, or even the possible falsification of the call tag by the teleseller in relation to the alleged "spontaneous" call from Ms XX.
Therefore, in the light of the contradictions that emerged regarding the release of appropriate information to the complainant and the acquisition of her consent for promotional purposes, contradictions which reinforce the declaration of Ms XX who stated that she had never contacted the sales network of the Company to release its consent to any subsequent promotional contacts, the responsibility of Vodafone is confirmed in relation to items a) and b) of the notice of dispute.
For the sake of completeness, it should be noted that, even admitting that the "incoming" call by the claimant was actually made, the content of the same, as reconstructed by Vodafone (summary information issued by Vodafone through an automatic responder and consent to the processing of data for promotional purposes expressed by the interested party by typing the "#1" keys on their device), does not appear suitable to constitute a framework of legitimacy of subsequent treatments, due to the lack of both the minimum information elements offered to the interested party and the element of the unambiguousness of the consent itself (which does not seem to be ensured by the simple typing of an alphanumeric sequence of two elements).
With reference to the disputes sub c) and d), which concern the methods of acquiring the consent of the interested party in the context of the vocal order and the compatibility of the overall procedure with the principles of correctness and transparency pursuant to art. 5, par. 1, lit. a), of the Regulation, Vodafone's defensive observations must first of all be taken into account which, on the one hand, stated that no provision of the Regulation or of the Code prohibits the controller from requesting undifferentiated consent with reference to the various promotional contact methods of the 'interested. From this assumption it would therefore derive the non-existence of the contestation referred to in point c).
On this point it is necessary to place the element of the consent formula in the context of the overall vocal order which, although it is considered by Vodafone as a formal ratification of the meeting of the wishes of the telephone company and the customer in the context of the sale of a , must be considered as the only documentary element able to crystallize the decision-making moment of the interested party both in terms of consent for the processing of personal data, and, more generally, as regards the decision to adhere to Vodafone offers . Reducing this document to a mere formality, devoid of substantial significance, can favor a distorted use of the vocal order tool, despite the fact that it is now reserved, by explicit admission by Vodafone, for categories of older customers or in any case unfamiliar with the use of technological tools, with the consequence, represented in all its evidence in the case in question, that the different and complex contractual options, as well as the different purposes and methods of processing personal data, were listed in a very rapid sequence by the call center operator (about 200 words per minute for over six minutes), thus subjecting the interlocutor to an unsustainable conceptual bombardment which it is reasonable to believe prevented the client from having full knowledge of the scope of her choices.
From this point of view, the analysis of the so-called "formula of consent", consisting of over 60 words pronounced by the operator in about 16 seconds, appears to be an exercise of little use, if one considers that, above all other considerations, the observation prevails that this formula was found to be barely understandable only after repeated listening.
Specifically, however, this formula is incorrect, firstly because it includes in the same context treatments having different purposes (execution of a contract and promotional contact). The defensive consideration that, in any case, treatments having contractual purposes would be removed from the obligation of consent is worthless, since the inclusion of the same in the indistinct group of "consented" treatments introduces a further element of confusion in a framework of per se already affected by the critical issues highlighted above, from which it follows, in a nutshell, that the interested party would have given consent to the processing of their personal data for promotional purposes and with the most diverse contact methods, in one case after listening of a pre-recorded message and typing an alphanumeric combination of two elements and, subsequently, following listening to a formula read at a speed that is objectively unsustainable for adequate understanding, in which both the aims of the treatment for which it is not necessary to give consent, both promotional ones (without any distinction related to the m contact mode).
As for the consideration that, with reference to promotional contacts, no law prohibits the holder from requesting undifferentiated consent with reference to the various contact methods (automated methods or telephone contacts made by a human operator), it must be understood that this simplification element was introduced by the Guarantor with provision no. 242 of 15 May 2013 (in www.gpdp.it, web doc. n. 2543820), with which it was in any case underlined that the need to streamline bureaucratic obligations must in any case allow "the interested party, precisely in the presence of particularly invasive and onerous forms of commercial communication, the possibility of controlling the use of one's personal data, through the conscious and specific expression of consent". Therefore "from the information issued by the owner [...] and from the request for consent it must be clear that, with regard to the treatments carried out for "direct marketing" purposes, the consent of the interested party acquired pursuant to art. 130, paragraphs 1 and 2, of the Code, concerns not only automated, but also traditional methods of communication" and "moreover, with regard to the recognized possibility for the interested party to express his/her wish to receive commercial and promotional communications exclusively through methods traditional contact methods, it will be up to the data controller to expressly refer to it in the information and make this wish exercisable easily and free of charge". The consent formula prepared by Vodafone and inserted in the complainant's vocal order does not contain any reference to the system outlined above and must therefore be considered completely ineffective in achieving the reconciliation between the need for simplification of the obligations by the owner and the right to delimit the extent of the consent granted to the interested party, with the consequence that, in the case in question, the consent given is generic and undifferentiated, therefore in contrast with the principles present today in the articles 4, no. 11 and 7 of the Regulation, as well as in the related recital no. 32.
As for the dispute sub d), relating to the violation of the principles of correctness and transparency with reference to the processing connected with the sale of the telephone service to the complainant, as documented by the vocal order produced by the Company, Vodafone's reference to the peaceful ability to autonomously take care of her own interests by Ms XX, an ability which has never been questioned and which, in any case, could exclusively concern aspects linked to the possible annulment of the contract.
In this case, what was observed in the notice of dispute must be reiterated ("the choice of the call center operator, evidently authorized by a common practice well known to Vodafone which has the voice recordings of the contracts and should subject them to quality checks , to submit to the claimant the contract for the activation of the services through a reading carried out at an estimated speed of about 200 words per minute for more than six minutes of recording, so that the entire contract is completely incomprehensible and, above all, invaluable by the of whoever has to decide whether to join or not, makes the whole treatment, and not just the prodromal promotional part, illegitimate"), and highlight that not the subjective characteristics of the complainant but the objective anomalies of the telephone sale sealed by an audio document which constitutes to all intents and purposes the contractual basis and which is largely incomprehensible to a normal listener, renders any treatment carried out in relation to this contract, irreparably flawed precisely in those elements of correctness which should represent the first and irreplaceable guarantee in the agreement between a large service company and the consumer.
The principle of correctness does not overlap with that of lawfulness but amplifies its scope by calling each holder not only to comply with the specific provisions of the law, but to make their own the overall meaning and spirit of the legislation on the protection of personal data in order to facilitate the choices of the interested party, on the basis of the same canons used in civil law to identify the correctness of the debtor and the creditor (art. 1175 of the civil code) and the good faith in the execution of the contract (art. 1375 of the civil code), more widely included in the principle of social solidarity pursuant to art. 2 of the Constitution.
Precisely because of the aforementioned interpretative canons, the conduct of Vodafone, in the sale of the telephone service made to Ms XX, appears largely incomplete and justifies the reaction of the complainant who, despite having by now obtained from the telephone company the restoration of the situation quo ante and the reversal of the charges for the withdrawal from the contract, turned to the Authority for a question of principle linked to the correct declination of the relationship between the owner and the interested party, a question which, in the light of the preliminary evidence connected in particular to the formation of the will of the complainant as documented in the vocal order, must be considered largely founded.
Vodafone's responsibility must therefore be confirmed for the violations alleged under items c) and d).
4. CONCLUSIONS
In view of the above, Vodafone's liability is deemed to have been established for the following violations:
a) articles 12, par. 1, and 13, of the Regulation, for having made a promotional contact with the complainant, through the company incorporated under Albanian law Wocs Shpk, based in Tirana, responsible for the treatment designated by Vodafone, without having given the interested party the necessary information in the forms and times referred to in the aforementioned provisions;
b) articles 5, par. 1, 6 and 7 of the Regulation, as well as 130, paragraph 3, of the Code, for having made the aforementioned promotional contact without having acquired the required consent from the interested party;
c) articles 5, par. 1, lit. a), 6 and 7 of the Regulation, as well as 130, paragraphs 1, 2 and 3, for having acquired from the interested party, during the promotional contact referred to above, an undifferentiated and single consent for the different types of contact, consent then registered in the Vodafone systems;
d) articles 5, par. 1, lit. a), of the Regulations for having carried out the processing of personal data aimed at concluding a contract for the activation of telephone services for the complainant, in violation of the principles of correctness and transparency of the processing.
Having also ascertained the unlawfulness of the Company's conduct with reference to the treatments examined, it becomes necessary:
- impose on Vodafone, pursuant to art. 58, par. 2, lit. f) of the Regulation, the prohibition of any further processing of the complainant's data;
- adopt an injunction order, pursuant to articles 166, paragraph 7, of the Code and 18 of the law n. 689/1981, for the application against Vodafone of the pecuniary administrative sanction provided for by art. 83, para. 3 and 5, of the Regulation
5. ORDER-INJUNCTION FOR THE APPLICATION OF THE PECUNIARY ADMINISTRATIVE SANCTION
The violations indicated above require the adoption of an injunction order, pursuant to articles 166, paragraph 7, of the Code and 18 of the law n. 689/1981, for the application against Vodafone of the pecuniary administrative sanction provided for by art. 83, para. 3 and 5 of the Regulations (payment of a sum up to €20,000,000.00 or, for companies, up to 4% of the annual worldwide turnover of the previous year, if higher);
For the determination of the maximum legal amount of the pecuniary fine, it is therefore necessary to refer to the turnover of Vodafone, as obtained from the latest available financial statements (March 2022) in accordance with the previous provisions adopted by the Authority, and therefore this maximum is determined issued, in the case in question, in Euro 220,154,181.56
In order to determine the amount of the fine, it is necessary to take into account the elements indicated in art. 83, par. 2, of the Regulation;
In the present case, the following are relevant:
1) the seriousness of the violations (Article 83, paragraph 2, letter a) of the Regulation), taking into account the object and purpose of the data processed, attributable to the overall phenomenon of telemarketing, in relation to which the Authority has adopted, in particular in the last three years, numerous measures which have fully examined the many critical elements by providing the data controllers with numerous indications to adapt the treatments to current legislation and to mitigate the impact of nuisance calls on the interested parties;
2) as an aggravating factor, the fact that Vodafone appears to have been the recipient of a corrective and sanctioning provision regarding telemarketing (Article 83, paragraph 2, letter e) of the Regulation), no. 224 of 12 November 2020 (in www.gpdp.it, web doc. n. 9485681);
3) as a mitigating factor, the fact that Vodafone promptly restored the situation prior to the sale of the telephone service to Ms XX, also transferring the sums requested as reimbursement of expenses for late withdrawal (Article 83, paragraph 2, letter c) of the Regulation);
4) as a mitigating factor to be taken into consideration when setting the fine (Article 83, paragraph 2, letter k) of the Regulation), the general socio-economic context, characterized by a profound economic crisis following the serious emergencies still in progress course and the circumstance that the ascertained case turns out to be isolated.
Based on the set of elements indicated above, and the principles of effectiveness, proportionality and dissuasiveness provided for by art. 83, par. 1, of the Regulation, and taking into account the necessary balance between the rights of the interested parties and the freedom to do business, also in order to limit the economic impact of the fine on the organizational and functional needs of the Company, it is believed that the administrative fine of the payment should be applied to Vodafone of a sum of Euro 500,000.00 (five hundred thousand).
In the case in question, it is believed that the ancillary sanction of publication on the Guarantor's website of this provision should be applied, provided for by art. 166, paragraph 7 of the Code and art. 16 of the Regulation of the Guarantor n. 1/2019, taking into account the nature of the treatments and the conduct of the Company, as well as the elements of risk for the rights and freedoms of the interested parties.
Finally, the conditions set forth in art. 17 of Regulation no. 1/2019 concerning internal procedures having external relevance, aimed at carrying out the tasks and exercising the powers delegated to the Guarantor.
ALL THIS CONSIDERING THE GUARANTEE
a) requires Vodafone, pursuant to art. 58, par. 2, lit. f) of the Regulation, the prohibition of any further processing of the complainant's data;
b) enjoins Vodafone, pursuant to art. 157 of the Code, to communicate to the Authority, within thirty days of notification of this provision, the initiatives undertaken in order to implement the imposed measure; any failure to comply with the provisions of this point may result in the application of the administrative fine provided for by art. 83, paragraph 5, of the Regulation
ORDER
to Vodafone Italia S.p.A., in the person of its pro-tempore legal representative, with registered office in Ivrea (TO), via Jervis 13, C.F. 08539010010, to pay the sum of 500,000.00 (five hundred thousand) euros as an administrative fine for the violations indicated in the justification, representing that the offender, pursuant to art. 166, paragraph 8, of the Code has the right to settle the dispute, with the fulfillment of the instructions given and the payment, within the term of thirty days, of an amount equal to half of the fine imposed.
ENJOYS
to the aforementioned Company, in the event of failure to settle the dispute pursuant to art. 166, paragraph 8, of the Code, to pay the sum of 500,000.00 (five hundred thousand) euros, according to the methods indicated in the attachment, within 30 days of notification of this provision, under penalty of adopting the consequent executive deeds pursuant to art. . 27 of the law n. 689/1981.
HAS
The application of the ancillary sanction of publication on the Guarantor's website of this provision, provided for by articles 166, paragraph 7 of the Code and 16 of the Regulation of the Guarantor n. 1/2019, and the annotation of the same in the internal register of the Authority - provided for by art. 57, par. 1, lit. u), of the Regulation, as well as by art. 17 of Regulation no. 1/2019 concerning internal procedures having external relevance, aimed at carrying out the tasks and exercising the powers delegated to the Guarantor - relating to violations and measures adopted in compliance with art. 58, par. 2, of the Regulation itself.
Pursuant to articles 152 of the Code and 10 of Legislative Decree no. 150/2011, opposition to this provision may be lodged with the ordinary judicial authority, with an appeal filed with the ordinary court of the place where the data controller has its registered office, within the term of thirty days from the date of communication of the provision itself .
Rome, 10 November 2022
PRESIDENT
Station
THE SPEAKER
Cerrina Feroni
THE SECRETARY GENERAL
Matthew
