Garante per la protezione dei dati personali (Italy) - 10138948

Garante per la protezione dei dati personali - 10138948
Authority:	Garante per la protezione dei dati personali (Italy)
Jurisdiction:	Italy
Relevant Law:	Article 5(1)(a) GDPR Article 5(1)(b) GDPR Article 6(1)(a) GDPR Article 12(3) GDPR Article 15 GDPR Article 21 GDPR Art. 130 c. 2 d. lgs. 196/2003
Type:	Complaint
Outcome:	Upheld
Started:	02.02.2023
Decided:	13.03.2025
Published:
Fine:	40,000 EUR
Parties:	n/a
National Case Number/Name:	10138948
European Case Law Identifier:	n/a
Appeal:	Unknown
Original Language(s):	Italian
Original Source:	GPDP (in IT)
Initial Contributor:	cci

The DPA fined an online flower retailer €40,000 for unlawfully sending direct marketing SMS to a customer and for failing to comply with the customer's opt-out request.

English Summary

Facts

A data subject occasionally bought flowers from online flower retailer Interflora Italia S.p.a. (the controller). In the context of these purchases, the data subject was required to provide their phone number.

The website did not inform the data subject that the number would be used for direct marketing and did not collect consent to the advertising. Nonetheless, the controller later forwarded promotional SMSs to the data subject’s number. The messages did not explain how to opt out of direct marketing.

The data subject reached out to the controller’s DPO in order to stop the messaging but received no reply. The data subject later filed a complaint with the DPA. As soon as the DPA reached out to the controller, the controller stopped sending promotional messages to the data subject.

During the investigation, the DPA found that due to the economic impact of the Covid pandemic, the controller did not have enough staff to consistently monitor the DPO’s mail account.

Holding

The DPA held that the controller violated:

• Articles 5(1)(a) and 6(1)(a) GDPR as well as 130(2) d. lgs. 196/2003, for carrying out direct advertising without the data subject’s consent;
• Article 5(1)(b) GDPR, for processing the data subject’s phone number for purposes other than those stated by its website;
• Articles 12(3), 15, and 21 GDPR, by failing to respond to the data subject’s request and to honor their objection to direct marketing.

The DPA fined the controller for €40,000. In this regard, the DPA considered that the controller’s economic situation during the pandemic was dire and that the controller later improved its practices with regards to direct marketing.

Comment

€40,000 is not an unreasonably high amount for the controller: Interflora is a large and well-known company active throughout Italy.

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Italian original. Please refer to the Italian original for more details.

[web doc. n. 10138948]
Provision of 13 March 20205
Register of provisions
n. 155 of 13 March 20205
THE GUARANTOR FOR THE PROTECTION OF PERSONAL DATAIN today's meeting, attended by Prof. Pasquale Stanzione, President, Prof. Ginevra Cerrina Feroni, Vice President, Dr. Agostino Ghiglia and Attorney Guido Scorza, members, and Councillor Fabio Mattei, Secretary General;
SEEN Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation, hereinafter “Regulation”);
HAVING SEEN the Personal Data Protection Code (Legislative Decree 30 June 2003, no. 196), as amended by Legislative Decree 10 August 2018 no. 101, containing provisions for the adaptation of the national legal system to the aforementioned Regulation (hereinafter the “Code”);
HAVING SEEN the documentation in the files;
HAVING SEEN the observations formulated by the Secretary General pursuant to art. 15 of the Guarantor’s regulation no. 1/2000;
REPORTER Dr. Agostino Ghiglia;
WHEREAS
1. THE INVESTIGATIVE ACTIVITY CARRIED OUT
With a report dated 2 February 2023, regularized as a complaint on 22 May 2023, Mr. XX complained about the continuous receipt of promotional text messages from Interflora Italia S.p.A. (hereinafter, Interflora or the Company) without the possibility of objecting. In particular, the complainant stated that he had made sporadic purchases on the Company's e-commerce site without ever registering an account (by logging in as a guest) but noted that, every time he wanted to place an order on the site, he was required to give his consent to receive promotional messages, under penalty of being unable to proceed. The complainant documented that he had already requested the intervention of the Data Protection Officer (on 2 December 2022) but had never received a response, while continuing to receive unwanted text messages. Finally, the complainant specified that the text messages received (some of which were attached to the complaint) did not contain any indication of how to object.
With certified email dated 20 July 2023, the Office requested Interflora to provide information regarding the above.
The following day, Mr. XX informed the Guarantor that he had received an email from Interflora containing only the confirmation of cancellation from the contact lists.
Since no response was received by the Guarantor within the indicated timeframes, with note prot. 125736 of 8 September 2023, the Office sent a reminder via certified email to respond, noting that the previous communication was correctly notified and that the partial response provided to the complainant documented its acknowledgment.
Since no response was received even after the reminder, the act of initiating the procedure was adopted note prot. 135840 of 3 October 2023, to contest the violation referred to in articles 157 and 166, paragraph 2 of the Code. Due to the continuing silence of the Company - an unexpected circumstance since it is a business reality known for years in the online sale of floral arrangements - it was necessary to appoint the Special Privacy and Technological Fraud Unit of the Guardia di Finanza to notify the act.
Following the investigations carried out to notify the act of initiation of the proceeding, the Guardia di Finanza communicated that the legal representative of Interflora was not resident in Italy; at the address of the registered office of the Company, the presence of a coworking space called "Talent Garden" was found and from statements released by the reception of the structure, the domicile of the registered office of Interflora was confirmed but the total absence of offices dedicated to it.
The Office therefore proceeded to notify the act of initiation of the proceeding also via certified email with note prot. no. 49219 of 19 April 2024, acknowledging all the attempts made and highlighting that, in the event of delivery of the certified email, the notification would be considered completed.
On May 20, 2024, a defense brief was received from the law firm appointed by Interflora, in which it was stated that the Company had been affected by significant organizational changes between 2022 and 2023, resulting in the closure of the Rome office and a significant reduction in staff. For these reasons, the certified email box had not been properly manned, being managed intermittently by the staff available from time to time based on turnover.
On June 14, 2024, a communication was received from the lawyer XX, informing the Guarantor that he had been assigned by Interflora to assume its defense, requesting a short extension to examine the documents. In the meantime, the previous defenders also renounced their mandate.
On June 25, 2024, a brief was received in which, preliminarily, some details were integrated regarding the reasons for the lack of response, due to a drastic reduction in staff following the losses recorded after the pandemic. On the merits, it was stated that the event that occurred to Mr. XX was the starting point for activating a review of the company procedures with regard to the protection of personal data. It was also stated that the marketing activities were based on the legitimate interest of the owner.
Lastly, with a note dated 1 August 2024, the Company's counsel integrated the information provided, attaching the new version of the privacy policy and declaring that, based on the new procedures, the Company would collect the consents of the interested parties for the sending of promotional messages. It was also added that, until the procedure was completed, the sending of text messages would be interrupted and the Company was proceeding with the deletion from its archives of the data used for the sending of promotional text messages for which no suitable consent was available.
Finally, with regard to the methods of data collection at the time of the events complained of by Mr. XX, on 8 September 2023, in order to verify the complainant's declarations regarding the illicit procedures for acquiring consent during the purchase phase, the Office accessed the website www.interflora.it and observed the following.
At the bottom of the website, the registered office in Rome was listed, via Giacomo Dina 36, while the privacy information was indicated (always as the registered office) as the Milan office, via Arcivescovo Calabiana 6.
Under the heading "privacy information", there were two documents:
- privacy information provided pursuant to art. 13 of the Regulation (addressed to subjects who made purchases via the website): reference was made to the possibility of receiving promotional messages, for various purposes, exclusively via email, while there was no mention of the possible receipt of promotional text messages; in particular, reference was made to the legal basis of the legitimate interest for sending emails containing the offer of products and services similar to those already purchased or for sending newsletters on the basis of consent;
- privacy information provided pursuant to art. 14 of the Regulation (addressed to recipients of floral gifts purchased by Interflora customers): it was indicated that the data would be processed for the execution of the order and for sending an SMS "that allows you to evaluate the quality of the service received, through the optional completion of a satisfaction questionnaire"; the consent of the interested party was indicated as the legal basis for this processing.
The purchase procedure for a floral product was then simulated, logging in as a guest (without creating an account). To complete the purchase procedure, the following personal data marked as mandatory were requested: title, name, surname, address, mobile phone. In particular, under the box for entering the mobile phone number there was the following notice "the mobile phone number will allow the florist to deliver on time". There was no other information regarding the possibility of receiving promotional messages nor was the request to give the relevant consent.
2. DISPUTE OF VIOLATIONS
With a note dated 30 September 2024 (prot. no. 113461/24) the Company was informed of the initiation of the procedure, pursuant to art. 166, paragraph 5, of the Code, for the adoption of any measures referred to in art. 58, paragraph 2, of the Regulation, recognizing Interflora's liability for the alleged violation of the following provisions:
- art. 6, paragraph 1, letter a) of the Regulation and art. 130, paragraph 2 of the Code, for sending promotional messages via SMS to Mr. XX, carried out for a long time, without the necessary legal basis for consent;
- art. 5, paragraph 1, letter b) of the Regulation. a) and b) of the Regulation, since the same method of data collection through online purchasing procedures was carried out in a manner that did not respect the will of the interested parties: in fact, it was mandatory to release the mobile phone number specifying that it would be used for service purposes without any mention of the possible use for promotional purposes (for which consent should have been acquired in any case). This procedure was therefore considered to have been implemented in violation of the principles of lawfulness, correctness and transparency as well as limitation of purposes;
- art. 12, par. 3 and arts. 15 and 21 of the Regulation, since the facts described have shown the failure to respond to the request of Mr. XX, made on 2 December 2022 via certified email to Interflora, to know the methods of data acquisition and to oppose the processing for marketing purposes; this request, as mentioned, was not followed by any response and, to stop receiving unwanted messages, Mr. XX was forced to contact the Guarantor.
3. THE COMPANY'S DEFENSE
The Company submitted its own defense briefs on October 29, 2024, in which, in addition to what has already been stated, it represented that, as a result of a significant drop in turnover, a major corporate restructuring activity had become necessary, with a reduction in staff and the transfer of the registered office from Rome to Milan. In this context, the request of Mr. XX had not been processed, as well as the second request of the Guarantor, due to the lack of constant control of the mailbox. However, as soon as it became aware of the matter, the Company had taken steps to accept the interested party's request for cancellation, as confirmed by him in a note dated July 21, 2023.
With regard to the other violation profiles, the Company confirmed that it had learned, precisely following the report of Mr. XX, of the incorrect setting of the procedures aimed at collecting personal data for promotional purposes and the consequent incorrect formulation of the information. Therefore, as already anticipated in the preliminary investigation, Interflora has taken steps to implement all the necessary corrective measures. To this end, it has modified the form for collecting personal data by inserting specific boxes for the release of consent to receive promotional messages both via email and via SMS; consequently, it has proceeded to modify the information by making the new version available online from 28 October 2024.
Furthermore, in the same period, the Company has proceeded to stop sending promotional messages both via email and via SMS, deleting the telephone numbers collected from the contact lists.
Lastly, the Company, with a note dated 21 January 2025, confirmed that it had completed the training on personal data protection for the employees in charge of processing.
4. CONCLUSIONS
What has been reconstructed so far acknowledges the fact that Interflora carried out promotional activities, by sending SMS to its customers, without having acquired suitable consent for this purpose; furthermore, it had not taken steps to receive the request for opposition to the processing and access to the data submitted by the complainant. Finally, it had not provided a response to the request for information from the Guarantor.
Therefore, based on the factual profiles highlighted above and the statements made during the response, for which the declarant is responsible pursuant to art. 168 of the Code, it is believed that the violations found in the above-mentioned dispute documents should be confirmed.
However, it is useful to make some considerations regarding the conduct of the owner and the corrective measures adopted since Interflora, as soon as it took note of the complaint of Mr. XX, promptly proceeded to delete the data and to take action for the overall reorganization of the company procedures in order to ensure compliance with the regulations, also interrupting the processing for promotional purposes of the data collected prior to the changes described.
Also with regard to the failure to respond to the request of the Guarantor, we acknowledge the circumstances that led to the failure to process the request, due to contingent conditions and likely not attributable to systematic deficiencies.
Therefore, having ascertained the unlawfulness of Interflora's conduct with reference to the treatments under examination, taking into account that all violations have been remedied in the meantime, there are no grounds for adopting corrective measures against the owner; with regard to the violations that have occurred, it is instead necessary to adopt an injunction order, pursuant to articles 166, paragraph 7, of the Code and 18 of law no. 689/1981, for the application against Interflora of the administrative pecuniary sanction provided for by art. 58, paragraph 2, letter i) and 83 of the Regulation.
In light of the provisions of art. 154-bis, paragraph 3 of the Code, this provision is published on the Authority's website (see also art. 37 of the internal regulation of the Guarantor no. 1/2019).
It is also noted that the conditions set out in art. 17 of the Regulation of the Guarantor no. 1/2019 concerning internal procedures with external relevance, aimed at carrying out the tasks and exercising the powers delegated to the Guarantor, for the annotation of the violations detected here in the internal register of the Authority, provided for by art. 57, paragraph 1, letter u) of the Regulation, are met.
5. INJUNCTION ORDER FOR THE APPLICATION OF THE PECUNIARY ADMINISTRATIVE SANCTION
Based on the above, various provisions of the Regulation and the Code have been violated in relation to connected treatments carried out by Interflora, for which reason art. 83, paragraph 3, of the Regulation, according to which, if, in relation to the same processing or to connected processing, a data controller violates, with intent or negligence, several provisions of the Regulation, the total amount of the administrative pecuniary sanction does not exceed the amount specified for the most serious violation, with consequent application of only the sanction provided for by art. 83, par. 5, of the Regulation.
For the purposes of quantifying the administrative sanction, the aforementioned art. 83, par. 5, in setting the maximum amount set by law at 20 million euros or, for companies, at 4% of the annual worldwide turnover of the preceding financial year, if higher, specifies the methods of quantifying the aforementioned sanction which must "in any case [be] effective, proportionate and dissuasive" (art. 83, par. 1, of the Regulation), identifying, to this end, a series of elements, listed in par. 2, to be assessed when quantifying the relative amount.
In compliance with this provision, assuming, on the basis of the information found in the latest balance sheet (recorded on 31 December 2023), the occurrence of the first hypothesis provided for by the aforementioned art. 83, par. 5 and therefore quantified at 20 million euros as the maximum applicable fine, the following aggravating circumstances must be considered: 1. the seriousness and duration of the violations since the interested parties were invited to provide their mobile phone number during the purchase phase believing that this would be used to facilitate the delivery of the product, without being aware that the data were instead used to send promotional text messages and without them having been able to express consent for this additional purpose; it should also be added that the consequences of the conduct did not only concern the complainant but also all the subjects who had made purchases through the Interflora e-commerce portal; this conduct also continued for a long period of time, since Mr. XX had contacted the Company's data protection officer at the end of 2022, but the first corrective measures were implemented only in June 2024 and only after the investigation had been started by the Guarantor (Article 83, paragraph 2, letter a), of the Regulation);
2 the negligent nature of the violation, since the Company demonstrated serious negligence in adopting organizational measures that were not adequate to guarantee the lawfulness of the processing carried out, especially given that the services it offers are widely known and the volume of data collected through the e-commerce portal is vast (Article 83, paragraph 2, letter b), of the Regulation);
As mitigating factors, it is believed that the following can be taken into account:
1. the measures adopted by the data controller to mitigate the damage suffered by the interested parties, taking into account that Interflora spontaneously proceeded to eliminate from the contact lists the data of all the subjects who had provided them with the methods in force before the corrective changes, for which the Company was not able to document the expression of an appropriate consent (Article 83, paragraph 2, letter e of the Regulation);
2. the absence of previous proceedings initiated against the Company (Article 83, paragraph 2, letter e of the Regulation);
3. the measures implemented during the investigation to put an end to the contested violations (Article 83, paragraph 2, letter f of the Regulation);
4. the nature of the data processed, consisting of common personal and contact data (Article 83, paragraph 2, letter g of the Regulation).
In an overall perspective of necessary balance between the rights of the interested parties and freedom of enterprise, it is necessary to prudently evaluate the aforementioned criteria, also in order to limit the economic impact of the sanction.
Therefore, it is believed that - based on the set of elements indicated above - the administrative sanction of payment of a sum of €40,000.00.00 (forty thousand/00) equal to 0.2% of the maximum statutory sanction of €20 million should be applied to Interflora.
In the case in question, it is believed that the accessory sanction of publication of this provision on the website of the Guarantor should also be applied, provided for by art. 166, paragraph 7, of the Code and art. 16 of the Guarantor Regulation no. 1/2019.
In implementation of the principles set out in art. 83 of the Regulation, the imposition of such an ancillary sanction appears proportionate in relation to the seriousness and the particular disvalue of the conduct subject to censure, taking into account the elements of risk for the rights and freedoms of the interested parties (potentially all the subjects for whom the collection method described above has been adopted).
GIVEN ALL THE ABOVE, THE GUARANTOR
pursuant to art. 57, par. 1, letter f), of the Regulation, declares the processing described in the terms of the motivation carried out by Interflora Italia S.p.A.., with registered office in via Sorteni, 5, Monza, VAT number 08998971009, to be unlawful; consequently
ORDERS
pursuant to art. 58, par. 2, letter i), of the Regulation, to Interflora Italia S.p.A. in the person of its legal representative, to pay the sum of Euro 40,000.00.00 (forty thousand/00) as an administrative pecuniary sanction for the violations indicated in the reasons; it is represented that the offender, pursuant to art. 166, paragraph 8, of the Code, has the right to settle the dispute by paying, within 30 days, an amount equal to half of the sanction imposed.
ORDERS
the aforementioned Company, in the event of failure to settle the dispute pursuant to art. 166, paragraph 8, of the Code, to pay the sum of 40,000.00.00 (forty thousand/00) according to the methods indicated in the attachment, within 30 days of notification of this provision, under penalty of the adoption of the consequent executive acts pursuant to art. 27 of Law no. 689/1981;
ORDER
a) pursuant to articles 154-bis of the Code and 37 of Regulation no. 1/2019, the publication of this provision and, pursuant to art. 166, paragraph 7, of the Code, the publication of this injunction order on the website of the Guarantor;
b) pursuant to art. 17 of the Guarantor Regulation no. 1/2019, orders the annotation in the internal register of the Authority, provided for by art. 57, paragraph 1, letter u) of the Regulation, of the violations and the measures adopted.
Pursuant to art. 78 of Regulation (EU) 2016/679, as well as arts. 152 of the Code and 10 of Legislative Decree no. 1 September 2011, 150, an appeal against this provision may be lodged with the ordinary judicial authority, with an appeal filed with the ordinary court of the place where the data controller resides, or, alternatively, with the court of the place of residence of the interested party, within thirty days from the date of communication of the provision itself, or sixty days if the appellant resides abroad.
Rome, March 13, 2025
THE PRESIDENT
Stanzione
THE REPORTER
Ghiglia
THE GENERAL SECRETARY
Mattei