Garante per la protezione dei dati personali (Italy) - 10211780
From GDPRhub
| Garante per la protezione dei dati personali - 10211780 | |
|---|---|
 | |
| Authority: | Garante per la protezione dei dati personali (Italy) |
| Jurisdiction: | Italy |
| Relevant Law: | Article 4(11) GDPR Article 5 GDPR Article 5(2) GDPR Article 7 GDPR Article 12 GDPR Article 13 GDPR Article 14 GDPR Article 24 GDPR Article 25 GDPR Article 26 GDPR Article 57(1)(u) GDPR Article 58(2)(b) GDPR Article 58(2)(d) GDPR |
| Type: | Investigation |
| Outcome: | Violation Found |
| Started: | |
| Decided: | 18.12.2025 |
| Published: | 18.12.2025 |
| Fine: | n/a |
| Parties: | Dream Land S.r.l. Jaguar Land Rover Italia S.p.A |
| National Case Number/Name: | 10211780 |
| European Case Law Identifier: | n/a |
| Appeal: | Unknown |
| Original Language(s): | Italian |
| Original Source: | Garante per la protezione dei dati personali (in IT) |
| Initial Contributor: | ligialagev |
Two joint controllers received a reprimand after their shared website deployed a cookie banner that blocked users from reading the cookie policy and provided contradictory information about the identity of the data controller.
English Summary
Facts
Jaguar Land Rover Italia S.p.A. (JLRI), the Italian subsidiary of the Jaguar Land Rover group, and Dream Land S.r.l. (Dream Land), an authorized automotive dealer, jointly operated a website used for promotional and commercial purposes. The website was owned by Jaguar Land Rover Limited and made available to Dream Land, whose technical infrastructure was managed by an external supplier provided by JLRI.
On 14 February 2024, the Italian DPA's delegated inspection unit accessed the website and found two problems. First, when a user clicked the link to the cookie policy within the consent banner, the banner remained visible and overlapped the policy text, preventing users from reading it in full before deciding whether to accept, reject, or configure cookies. Second, the cookie policy contained contradictory information about the identity of the data controller: it referred at one point to a geographic location rather than a legal entity, listed multiple entities as independent controllers while indicating only one was responsible for handling data subject requests, and referenced a VAT number that did not exist.
In March 2024, Dream Land signed a data privacy addendum to the dealership agreement, which described the parties as independent controllers. When the DPA initiated proceedings against JLRI in June 2024, JLRI argued that the website belonged to Dream Land and that it bore no responsibility for the banner configuration. Dream Land, notified in August 2024, argued the banner issue was the result of a technical malfunction and that it operated as an independent controller.
Holding
First, the DPA held that both JLRI and Dream Land were joint controllers under Article 26 GDPR. Despite the dealership agreement formally describing them as independent controllers, the DPA assessed their roles on a factual basis: both parties had jointly chosen to use the website to pursue shared commercial interests and had thus jointly determined the purposes and means of the processing underlying cookie-based user tracking, in line with the CJEU's reasoning in Wirtschaftsakademie (C-210/16) and Fashion ID (C-40/16).
Second, the DPA found that the cookie banner violated the principles of fairness and transparency under Article 5 GDPR and the information obligations under Articles 12 and 13 GDPR. By remaining visible and overlapping the cookie policy when users clicked on it, the banner prevented users from accessing complete information before making a choice. The DPA further held that the contradictory information about the data controller's identity compounded this lack of transparency. As a consequence, any consent obtained under these conditions failed to meet the validity requirements of Articles 4(11) and 7 GDPR.
Third, while both parties bore joint responsibility, the DPA considered JLRI primarily responsible for the banner's configuration, since it was the only party with the technical means to correct it. The DPA decided not to impose a fine and instead issued a reprimand to both joint controllers under Article 58(2)(b) GDPR. It also ordered JLRI to bring the banner into compliance with the Cookie Guidelines, and ordered both controllers to conclude an internal agreement under Article 26 GDPR defining their respective responsibilities and to provide users with accurate information about their joint controllership.
Comment
Cited cases: CJEU, 5 June 2018, C-210/16, Wirtschaftsakademie (joint controllership) CJEU, 29 July 2019, C-40/16, Fashion ID (Joint controllership in the context of websites)
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Italian original. Please refer to the Italian original for more details.
[web doc. no. 10211780] Measure of December 18, 2025 Register of Measures no. 760 of December 18, 2025 THE ITALIAN DATA PROTECTION AUTHORITY IN today's meeting, attended by Professor Pasquale Stanzione, President, Professor Ginevra Cerrina Feroni, Vice President, Dr. Agostino Ghiglia and Guido Scorza, members, and Dr. Luigi Montuori, Secretary General; HAVING REGARD TO Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (hereinafter, the "Regulation"); HAVING SEEN the Personal Data Protection Code, containing provisions for the adaptation of national legislation to Regulation (EU) 2016/679 (Legislative Decree No. 196 of June 30, 2003, as amended by Legislative Decree No. 101 of August 10, 2018, hereinafter the "Code"); HAVING SEEN the Guidelines on Cookies and Other Tracking Tools of June 10, 2021 (available at www.garanteprivacy.it, web doc. No. 9677876, hereinafter the "Cookie Guidelines"); HAVING SEEN the Memorandum of Understanding of March 30, 2021, signed by the Italian Financial Police and the Italian Data Protection Authority; HAVING SEEN Note No. 57504 of October 21, 2022, by which the Authority, taking into account the need to verify compliance with the aforementioned Guidelines, also in light of the numerous complaints received on the matter, delegated the Special Unit for the Protection of Privacy and Technological Fraud of the Guardia di Finanza (hereinafter also the "Unit") to conduct a series of online investigations, requesting that the activity be focused, in an initial phase, on a sample of potential e-commerce operators; SEEN Note No. 38468 of March 3, 2023, by which the Unit provided the lists of potential recipients, indicating their geographic area of origin and turnover; SEEN Notes No. 130776 of September 21, 2023, and No. 164141 of December 12, 2023, by which, in compliance with the principles of uniformity of intervention and in application of a predetermined and uniform selection criterion throughout the country, also based on size and geographic indicators, Jaguar Land Rover Italia S.p.a. (hereinafter also "JLRI") was identified among the entities subject to said checks, which were actually carried out on February 14, 2024, in relation to the website www.dreamland.landrover.it; WHEREAS, the following emerged from that review: - upon first access to the website, an instant-appearing banner regarding the use of cookies appeared on the homepage, containing a link to the cookie policy, as well as the "Allow All," "Cookie Preferences," and "Reject All" controls; - upon clicking on the aforementioned link, the user was redirected to the page where they could view the cookie policy, and the banner remained visible, preventing full viewing of the information; - The cookie policy contained the following information: a) "Pursuant to Article 4 of EU Regulation 679/2016, it is hereby specified that the Data Controller is the company Agliana (Pistoia), with registered office at Via A. Volta 22 – 51031 Agliana (PT), represented by its legal representative at the time."; b) "Pursuant to Article 4 of EU Regulation 679/2016, it is hereby specified that the independent Data Controllers are: JAGUAR LAND ROVER S.P.A., with registered office in Rome, Viale Alessandro Marchetti no. 105, represented by its legal representative at the time; JAGUAR LAND ROVER LIMITED, with registered office at Abbey Road, Whitley, Coventry CV3 4LF UK." - The cookie policy also stated that in order to exercise the rights referred to in Articles 15 et seq. of the Regulation, it was possible to contact Jaguar Land Rover S.p.A.; - the website footer contained a reference to the company "Agliana" and VAT no. IT001122334455. This VAT no. was found to be non-existent following a check of the databases used by the Unit; - the "View all authorizations and site data" section of the browser used, accessible at the URL "chrome://settings/content/all", revealed that the site used cookies; SEEN the note dated June 12, 2024 (ref. no. 71445) with which, pursuant to Article 166, paragraph 5, of the Code, the Authority notified JLRI of the initiation of proceedings for the possible adoption of the measures referred to in Article 58, paragraph 1, of the Code. 2 of the Regulation and the alleged violations of the law, identified, in this case, as the violation of Articles 4, point 11, 5, 7, 12, 13, 24, and 25 of the Regulation and Article 122 of the Code, as well as the indications contained in the Cookie Guidelines, attributable to the following: - the fact that the banner remained visible, preventing the user from fully viewing the cookie policy before making a choice regarding the use of cookies or otherwise making it difficult to fully consult it, constituted a violation of the principles of fairness and transparency since the processing of personal data was carried out, in effect, without the prior provision of the information or, at the very least, with information that was only partially accessible and, in any case, difficult to read, thus preventing the user from fully enjoying an informed and informed browsing experience; - the manifestly contradictory nature of the information provided regarding the identity of the data controller, sometimes merely indicating a geographical location, was such as to generate doubts and uncertainties, contributing to the processing's lack of fairness and transparency. Specifically, the aforementioned privacy notice identified multiple different entities as independent data controllers, although only one of them was responsible for managing data subjects' requests. Nor did the reference in the website footer to the company Agliana and a non-existent VAT number resolve the uncertainties; - this lack of clarity and transparency also impacted any consent given in relation to the use of cookies, which, without the provision of appropriate privacy notice, did not meet the validity requirements set forth in Articles 4 and 7 of the Regulation; - pursuant to Articles Pursuant to Articles 24 and 25 of the Regulation, the data controller is responsible not only for determining the purposes and means of processing but also for identifying all appropriate measures to achieve the dual objective of compliance with the regulations and the protection of the rights and freedoms of data subjects. Pursuant to Article 5, paragraph 2 of the Regulation, this data subject is also required to comply with all data protection principles and to provide adequate evidence; SEEN the note dated July 12, 2024 (acquired under file no. 86781 of July 15, 2025) in which JLRI argued that it was not entitled to be responsible for the display criteria of banners on the website www.dreamland.landrover.it, nor for the management of the related cookies, as the website is neither owned nor managed by it. The website is instead the exclusive property of the automotive dealer Dream Land S.r.l. (hereinafter also "Dream Land" or the "Dealer"), with registered office in Agliana (Pistoia), Via A. Volta snc, Tax Code and VAT No. 01845070976, with which JLRI is bound by a concession agreement. Under this agreement, Dream Land would operate completely independently, assuming full risk and using its own resources, cooperating with JLRI to contribute to the achievement of the established objectives. Dream Land would therefore be the data controller; also considering the fact that, since this entity negotiates directly with the potential customer, it collects and manages the customer's personal data for its own processing purposes, such as quoting, test driving the vehicle, and selling it, or providing its own marketing initiatives. SEEN the note dated August 26, 2024 (ref. no. 100897) with which, to supplement the cross-examination, the Office also notified Dream Land of the dispute already notified to JLRI; ACKNOWLEDGING that, in its defense brief dated September 23, 2024 (acquired on September 24, 2024 with ref. 111136), Dream Land S.r.l. highlighted that: - the commercial relationships with JLRI and Jaguar Land Rover Limited are governed by a concession agreement that qualifies each party "within the scope of its specific business interests and the development of its business, primarily as independent data controllers of the personal data of customers and potential customers of vehicles and services provided"; - In March 2024, Dream Land signed a new annex to the concession agreement called "Data Privacy Schedule / Personal Data Management Annex." The purpose of this annex is to identify the relevant data sharing activities and business processes associated with the Concession Agreement between Jaguar Land Rover Group companies and the dealer, as well as to agree on the respective roles and responsibilities of the parties associated with their data processing activities. This annex confirms the parties' role as independent data controllers; - As part of this relationship, Dream Land was provided with several tools to support its promotional and commercial activities, including, in particular, the use of the website www.dreamland.landrover.it, owned by Jaguar Land Rover Limited; - Regarding the functionality of the banner, it was reportedly the result of "some technical inconvenience" that caused the banner to remain visible and overlap with the link to the "cookie policy"; - the lack of Dream Land's name in the website's cookie policy and the presence of an incorrect VAT number would also be the result of a technical issue; - the changes made by the owner of the website in question to the banner functionality and the correct indication of the name and VAT number.Dream Land's VAT system confirms data controllers' awareness of the applicable rules; - In July 2024, Dream Land received an update to its Operations Manual and Guidelines from JLRI, containing rules for improved website operation by licensees, allowing them to independently make changes and updates to the sections of the website relating to their company data; ACKNOWLEDGING that, in its defense brief dated September 25, 2024 (acquired on September 26, 2024, under ref. 112178), JLRI highlighted that: - pursuant to the concession agreement signed between JLRI and Dream Land: "The Concessionaire will operate in complete autonomy, assuming full risk and using its own resources, while also cooperating with the Company—in accordance with its guidelines—to contribute to the achievement of the objectives set forth in this Agreement, and that no form of partnership is in any way conceivable in relation to the provisions of this Agreement." "The Dealer undertakes not to represent itself, in its dealings with third parties, as an agent and/or representative of the Company for the resale of Vehicles, Spare Parts, and Accessories, or for the provision of Authorized Repair Services, nor to accredit the existence of a relationship that authorizes it, towards third parties, to assume obligations in the name, or even merely on behalf, of the Company and/or Group Companies, or authorizes it to promise third parties the actions of such entities." "The Dealer undertakes to collect and send to JLRI data relating to its existing and potential customers, in compliance with personal data protection legislation and the relevant instructions given by JLRI on the Hub." Article 2.1 of the aforementioned document specifies the role of the parties to the concession agreement, stating: "This Privacy Annex sets out the framework for any access or sharing of Personal Data and Sensitive Personal Data between the parties—in the context of the Concession Agreement—as separate Data Controllers, joint Controllers, and/or, in certain limited circumstances, Data Processors (as applicable), as further detailed in Appendix 1. It defines the principles to which the parties must adhere and their mutual responsibilities. To the extent that the parties may be identified in Appendix 1 as joint Data Controllers, this Privacy Annex, together with the relevant parts of Appendix 1, will constitute the 'agreement' required under Article 26 of the GDPR." - The Dream Land dealership primarily engages in the wholesale and retail trade of automobiles. In this capacity, Dream Land negotiates directly with the potential customer, collects and manages their personal data for its immediate and direct purposes, including quoting, test driving, and selling the vehicle, as well as implementing its own marketing initiatives in accordance with the guidelines provided by JLRI. - JLRI and Dream Land are independent data controllers, and each is responsible for the processing purposes implemented and clearly and transparently declared to the data subjects in their separate privacy notices. - Appendix 1 to the dealership agreement specifically identifies the personal data processing processes and the parties' obligations and roles. - "In the case at hand, processes No. 2 "Lead Generation" and No. 4 "Lead Management System" can be identified, in which the parties, designated as the Dealer (Dream Land for the purposes of this document), JLRI, and [Jaguar Land Rover Limited], operate as independent data controllers." - "It should also be noted that, following further investigation and verification, the website www.dreamland.landrover.it is not owned and/or directly managed by Jaguar Land Rover Italia S.p.A. The website in question is owned by [Jaguar Land Rover Limited], made available and directly usable by Dream Land as a third-level website, with IT infrastructure managed by an external provider provided by JLRI, for which the dealer pays a fee. Specifically, the dealer may access and/or modify specific content on the aforementioned website independently, through dedicated access points or through the external provider made available to the dealer, following the instructions and guidelines circulated by JLRI over time, or in compliance with JLRI's requests and actions, always with a view to ensuring consistent and uniform management of dealer websites and in compliance with the obligations arising from the dealership agreement." - "Dream Land is the data controller for the activities covered by this investigation [...] and that what occurred with the cookie management banner is not attributable to a deliberate intent to evade legal obligations and the recommendations of this Authority, but rather to a technical issue to which JLRI could have also given greater attention and consideration, with reference to the quality of the service provided by the technical supplier made available to Dream Land." NOTICE that the parties, with autonomy and responsibility varying based on the specific activities covered by specific contractual agreements, process personal data in different ways, and that this investigation must be considered limited solely to the data processing carried out on the website www.dreamland.landrover.it through the use of markers such as cookies or other tools for tracking user navigation for the purposes (declared at the time of ascertaining the facts, specifically in the brief information contained in the cookie banner) necessary for optimal navigation of the site, as well as other non-technical purposes such as sending personalized promotional messages; NOTING that the concession agreement contains no provisions relating to the website under investigation, other than the sole provision in Article 16, paragraph 4, which states: "The Dealer undertakes not to use (i) an Internet Domain and/or (ii) use in any manner and/or on any medium, the names "JLR", "Jaguar", "Jag" or "JAG", "Land Rover and/or", "Jaguar", "Jag", "JAG", "Land Rover", "LR", "L.R.", "Landy", "Landie", "Range Rover", "Rangy", "Rangie", or any derivative thereof in any Internet domain name, legal entity, or trade name without the prior written consent of the Group Company with which the Dealer has signed the agreement referred to in paragraph 1 of this Article." NOTING that the documentation attached to the defense briefs contains no reference to the processing of personal data through cookies and other online tracking tools; CONSIDERING that processes No. 2 "Lead Generation" and No. 4 "Lead Management System" illustrated in Appendix 1 to the concession agreement also do not relate to the processing under investigation and disputed; CONSIDERING that, based on the documentation in the file, the internet domain under investigation is not owned by Dream Land but may be used by the latter only with the prior consent of JLRI and under the conditions established by the latter; CONSIDERING that, as stated by JLRI, the concessionaire may only independently access and/or modify specific content of the aforementioned website, through dedicated access points or through the external provider made available to the concessionaire. In any case, such modifications must follow the specific and timely instructions contained in the guidelines prepared by JLRI, or comply with JLRI's requests and actions; WHEREAS the qualifications attributed to data controllers are based on a factual, functional, and independent, rather than formal, analysis of the influence actually exercised by such data controllers over the purposes and means of the processing. This implies that the legal status of a data controller must, in principle, be determined by the activities actually performed in a specific situation rather than by its formal designation (See EDPB, Guidelines 07/2020 on the concepts of controller and processor under the GDPR, 7 July 2021); WHEREAS, although Dream Land could not materially influence the contested profiles without the cooperation of JLRI, both parties jointly chose to use a website to pursue their common interests and benefit from the resulting commercial advantages. These parties thus "jointly" determined the purposes and means of the processing underlying the tracking of users' browsing through cookies and other markers and, therefore, are to be considered joint controllers pursuant to Article 13 of the GDPR. 26 of the Regulation (see ECJ, 5 June 2018, Case C-210/16, Wirtschaftsakademie; ECJ, 29 July 2019, Case C-40/16, Fashion ID); NOTING that, following further access to the website by the Office, carried out after the investigation conducted by the Guardia di Finanza, the notification pursuant to Article 166, paragraph 5 of the Code, and the defence briefs, it was possible to ascertain that: the banner continues to prevent the user from adequately viewing the cookie policy; that furthermore, following the correct identification of the relevant roles in terms of personal data protection as reconstructed above, the indication of Dream Land as the sole data controller does not correspond to the factual reality under examination; NOTING that the existence of joint responsibility does not necessarily translate into equivalent responsibility of the various operators in the context of personal data processing.Conversely, these operators may be involved in different phases of such processing and at different levels, so the degree of responsibility of each must be assessed taking into account all relevant circumstances of the specific case. Given this, and without prejudice to the fact that the joint controllers are required to regulate, through an internal agreement, their respective responsibilities regarding compliance with the obligations arising from the Regulation, given that only JLRI—as it itself acknowledged in its defense—has the tools to determine the correct configuration of the banner, it is believed that the responsibility for ensuring the correctness of the processing performed should be primarily attributed to JLRI; WHEREAS, pursuant to applicable law and in this specific case, the joint controllers are required, based on the specific internal agreement, to provide information on the processing of personal data carried out through the use of cookies or other tracking tools. In the event of the use of cookies or other tracking technologies other than technical ones, the controller is also required to obtain the user's consent, while in the event of the use of exclusively technical cookies, the controller is only required to provide adequate information; WHEREAS, pursuant to the aforementioned information obligation, the joint controllers are responsible for explaining in a concise, transparent, intelligible, and easily accessible manner, as well as using clear and simple language, every aspect of the processing, including its purposes; WHEREAS, in this specific case, the fact that the banner prevents the user from fully viewing the cookie policy before making a choice regarding the use of cookies, or otherwise makes it difficult to fully consult it, constitutes a violation of the principles of fairness and transparency; The manifestly contradictory nature of the information provided regarding the identity of the data controller was such as to generate doubts and uncertainties, thus contributing to the processing being deficient in terms of fairness and transparency; NOTING, furthermore, that pursuant to Articles 4.11, 7, 12, and 13 of the Regulation, the lack of adequate clarity and transparency affects the validity of any consent given; NOTING furthermore that, pursuant to Articles 24 and 25 of the Regulation, the joint data controllers are responsible, on the basis of the internal agreement, for determining the purposes and means of processing, as well as for identifying all the most appropriate measures to achieve the dual objective of compliance with the law and the protection of the rights and freedoms of data subjects, and that, pursuant to Article 5, paragraph 2 of the Regulation, they are also obliged to comply with all data protection principles and to provide adequate evidence thereof; CONSIDERING that the conduct of the joint controllers constitutes a violation of Articles 4, point 11, 5, 7, 12, 13, 24, and 25 of the Regulation and Article 122 of the Code, as well as the provisions of the Cookie Guidelines; CONSIDERING, furthermore, that the changes made pending the proceedings are partially adequate to restore the site's compliance and that, therefore, it is necessary to: a) order JLRI, pursuant to Article 58, paragraph 2, letter d), of the Regulation, to bring the banner into line with the provisions of the Cookie Guidelines, in particular ensuring that this does not impede the correct reading of the privacy policy; b) order both joint controllers, subject to prior agreement, through an internal agreement pursuant to Article 26 of the Regulation, their respective responsibilities, particularly with regard to the exercise of the data subject's rights and their respective functions for communicating the information referred to in Articles 13 and 14 of the same Regulation, to provide accurate information regarding the joint controllership of the processing and the entity or entities to whom the data subject may contact to exercise the rights; CONSIDERING, given the specific nature of the investigation, the particular nature of the case, and the statements made in the defense brief, that in this case, the adoption of pecuniary sanctions may be dispensed with, but limited to issuing a warning to the joint controllers, pursuant to Article 58, paragraph 2, letter b) of the Regulation, for failure to comply with the provisions regarding the processing of personal data through the use of cookies and other tracking tools; CONSIDERING that the conditions for recording the data in the Authority's internal register pursuant to Article 57, paragraph 1, letter c) of the Regulation are met. 1, letter u) of the Regulation, regarding the measures adopted in this case against the joint controllers in accordance with Article 58, paragraph 2, of the Regulation; HAVING SEEN the documentation in the file; HAVING SEEN the observations of the Office, formulated by the Secretary General pursuant to Article 15 of the Regulation of the Garante no. 1/2000 of 28 June 2000; REPORTER: Professor Pasquale Stanzione; NOW CONSIDERING THE FOREGOING, THE GUARANTOR a) pursuant to Article 58, paragraph 2, letter b) of the Regulation, addresses Jaguar Land Rover Italia S.p.A., with registered office in Rome, Viale Alessandro Marchetti no. 105, Tax Code 06070621005, and Dream Land S.r.l., with registered office in Agliana (Pistoia), Via A. Volta snc, Tax Code 01845070976, as joint data controllers, a warning for non-compliance with the provisions in force regarding the processing of personal data through the use of cookies and other tracking tools, for the reasons better explained in the reasoned section; b) pursuant to Art. 58, paragraph 2, letter d) of the Regulation, orders Jaguar Land Rover Italia S.p.A. to align the banner with the instructions contained in the Cookie Guidelines, in particular ensuring that this does not impede the correct reading of the information; c) pursuant to Art. 58, paragraph 2, letter d) of the Regulation, orders both joint data controllers, after defining their respective responsibilities through an internal agreement pursuant to Art. 26 of the Regulation, to provide accurate information regarding the joint data controllership and the entity(ies) to whom they may contact to exercise their rights; ORDERS pursuant to Art. 17 of the Regulation of the Italian Data Protection Authority no. 1/2019, the recording in the Authority's internal register, provided for by Article 57, paragraph 1, letter u) of the Regulation, of the violations and the measures adopted. Pursuant to Article 78 of the Regulation, as well as Articles 152 of the Code and 10 of Legislative Decree No. 150 of September 1, 2011, an appeal against this provision may be lodged with the ordinary judicial authority, with an appeal filed either with the court of the place where the data controller resides or has its registered office or with the court of the place of residence of the data subject within thirty days from the date of notification of the provision itself, or sixty days if the appellant resides abroad. Rome, December 18, 2025 THE PRESIDENT Stanzione THE REPORTER Stanzione THE SECRETARY GENERAL Monturi [web doc. no. 10211780] Measure of December 18, 2025 Register of Measures No. 760 of December 18, 2025 THE ITALIAN DATA PROTECTION AUTHORITY IN today's meeting, attended by Professor Pasquale Stanzione, President, Professor Ginevra Cerrina Feroni, Vice President, Dr. Agostino Ghiglia and Guido Scorza, members, and Dr. Luigi Montuori, Secretary General; HAVING REGARD TO Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (hereinafter, the "Regulation"); HAVING SEEN the Personal Data Protection Code, containing provisions for the adaptation of national legislation to Regulation (EU) 2016/679 (Legislative Decree No. 196 of June 30, 2003, as amended by Legislative Decree No. 101 of August 10, 2018, hereinafter the "Code"); HAVING SEEN the Guidelines on Cookies and Other Tracking Tools of June 10, 2021 (available at www.garanteprivacy.it, web doc. No. 9677876, hereinafter the "Cookie Guidelines"); HAVING SEEN the Memorandum of Understanding of March 30, 2021, signed by the Italian Financial Police and the Italian Data Protection Authority; HAVING SEEN Note No. 57504 of October 21, 2022, by which the Authority, taking into account the need to verify compliance with the aforementioned Guidelines, also in light of the numerous complaints received on the matter, delegated the Special Unit for the Protection of Privacy and Technological Fraud of the Guardia di Finanza (hereinafter also the "Unit") to conduct a series of online investigations, requesting that the activity be focused, in an initial phase, on a sample of potential e-commerce operators; SEEN Note No. 38468 of March 3, 2023, by which the Unit provided the lists of potential recipients, indicating their geographic area of origin and turnover; SEEN Notes No. 130776 of September 21, 2023, and No. 164141 of December 12, 2023, by which, in compliance with the principles of uniformity of intervention and in application of a predetermined and uniform selection criterion throughout the country, also based on size and geographic indicators, Jaguar Land Rover Italia S.p.a. (hereinafter also "JLRI") was identified among the entities subject to said checks, which were actually carried out on February 14, 2024, in relation to the website www.dreamland.landrover.it; WHEREAS, the following emerged from that review: - upon first access to the website, an instant-appearing banner regarding the use of cookies appeared on the homepage, containing a link to the cookie policy, as well as the "Allow All," "Cookie Preferences," and "Reject All" controls; - upon clicking on the aforementioned link, the user was redirected to the page where they could view the cookie policy, and the banner remained visible, preventing full viewing of the information; - the cookie policy contained the following information: a) "Pursuant to art.4 of EU Regulation 679/2016, it is specified that the Data Controller is the company Agliana (Pistoia), with registered office at Via A. Volta 22 – 51031 Agliana (PT), represented by its legal representative at the time; b) "Pursuant to Article 4 of EU Regulation 679/2016, it is specified that the independent Data Controllers are: JAGUAR LAND ROVER S.P.A., with registered office in Rome, Viale Alessandro Marchetti no. 105, represented by its legal representative at the time; JAGUAR LAND ROVER LIMITED, with registered office at Abbey Road, Whitley, Coventry CV3 4 LF UK"; - the cookie policy also stated that to exercise the rights referred to in Articles 15 et seq. of the Regulation, users could contact Jaguar Land Rover S.p.A.; - The website footer contained a reference to the company "Agliana" and its VAT number IT001122334455. This VAT number was found to be non-existent following a check of the databases used by the Unit; - The "View all authorizations and site data" section of the browser used, accessible at the URL "chrome://settings/content/all," revealed that the site used cookies; SEEN the note dated June 12, 2024 (ref. no. 71445) with which, pursuant to Article 166, paragraph 5, of the Code, the Authority notified JLRI of the initiation of proceedings for the possible adoption of the measures referred to in Article 58, paragraph 2, of the Regulation and the alleged violations of the law, identified, in this case, as the violation of Articles 4, points 11, 5, 7, 12, 13, 24, and 25 of the Regulation and Article 122 of the Code, as well as the instructions contained in the Cookie Guidelines, attributable to the following: - the fact that the banner remained visible, preventing the user from fully viewing the cookie policy before making a choice regarding the use of cookies or otherwise making it difficult to fully consult it, constituted a violation of the principles of fairness and transparency, since the processing of personal data was carried out, in effect, without prior provision of the information or, at the very least, with information that was only partially accessible and, in any case, difficult to read, thus preventing the user from fully enjoying an informed and informed browsing experience; - the manifestly contradictory nature of the information provided regarding the identity of the data controller, sometimes merely indicating a geographical location, was such as to generate doubts and uncertainties, contributing to the processing's lack of fairness and transparency. Specifically, the aforementioned privacy notice identified multiple different entities as independent data controllers, although only one of them was responsible for managing data subjects' requests. Nor did the reference in the website footer to the company Agliana and a non-existent VAT number resolve the uncertainties; - this lack of clarity and transparency also impacted any consent given in relation to the use of cookies, which, without the provision of appropriate privacy notice, did not meet the validity requirements set forth in Articles 4 and 7 of the Regulation; - pursuant to Articles Pursuant to Articles 24 and 25 of the Regulation, the data controller is responsible not only for determining the purposes and means of processing but also for identifying all appropriate measures to achieve the dual objective of compliance with the regulations and the protection of the rights and freedoms of data subjects. Pursuant to Article 5, paragraph 2 of the Regulation, this data subject is also required to comply with all data protection principles and to provide adequate evidence; SEEN the note dated July 12, 2024 (acquired under file no. 86781 of July 15, 2025) in which JLRI argued that it was not entitled to be responsible for the display criteria of banners on the website www.dreamland.landrover.it, nor for the management of the related cookies, as the website is neither owned nor managed by it. The website is instead the exclusive property of the automotive dealer Dream Land S.r.l. (hereinafter also "Dream Land" or the "Dealer"), with registered office in Agliana (Pistoia), Via A. Volta snc, Tax Code and VAT No. 01845070976, with which JLRI is bound by a concession agreement. Under this agreement, Dream Land would operate completely independently, assuming full risk and using its own resources, cooperating with JLRI to contribute to the achievement of the established objectives. Dream Land would therefore be the data controller; also considering the fact that, since this entity negotiates directly with the potential customer, it collects and manages the customer's personal data for its own processing purposes, such as quoting, test driving the vehicle, and selling it, or providing its own marketing initiatives. SEEN the note dated August 26, 2024 (ref. no. 100897) with which, to supplement the cross-examination, the Office also notified Dream Land of the dispute already notified to JLRI; ACKNOWLEDGING that, in its defense brief dated September 23, 2024 (acquired on September 24, 2024 with ref. 111136), Dream Land S.r.l. highlighted that: - the commercial relationships with JLRI and Jaguar Land Rover Limited are governed by a concession agreement that qualifies each party "within the scope of its specific business interests and the development of its business, primarily as independent data controllers of the personal data of customers and potential customers of vehicles and services provided"; - In March 2024, Dream Land signed a new annex to the concession agreement called "Data Privacy Schedule / Personal Data Management Annex." The purpose of this annex is to identify the relevant data sharing activities and business processes associated with the Concession Agreement between Jaguar Land Rover Group companies and the dealer, as well as to agree on the respective roles and responsibilities of the parties associated with their data processing activities. This annex confirms the parties' role as independent data controllers; - As part of this relationship, Dream Land was provided with several tools to support its promotional and commercial activities, including, in particular, the use of the website www.dreamland.landrover.it, owned by Jaguar Land Rover Limited; - Regarding the functionality of the banner, it was reportedly the result of "some technical inconvenience" that caused the banner to remain visible and overlap with the link to the "cookie policy"; - The lack of Dream Land's name in the website's cookie policy and the presence of an incorrect VAT number are also thought to be the result of a technical glitch; - The changes made by the owner of the website in question to the banner functionality and the correct indication of Dream Land's name and VAT number confirm the data controllers' awareness of the applicable rules; - In July 2024, Dream Land received an update to its Operations Manual and Guidelines from JLRI, containing rules for improved website operation by licensees, allowing them to independently make changes and updates to the sections of the website relating to their company data; ACKNOWLEDGING that, in its defense brief dated September 25, 2024 (acquired on September 26, 2024, under ref. 112178), JLRI highlighted that: - pursuant to the concession agreement signed between JLRI and Dream Land: "The Concessionaire will operate in complete autonomy, assuming full risk and using its own resources, while also cooperating with the Company—in accordance with its guidelines—to contribute to the achievement of the objectives set forth in this Agreement, and that no form of partnership is in any way conceivable in relation to the provisions of this Agreement." "The Dealer undertakes not to represent itself, in its dealings with third parties, as an agent and/or representative of the Company for the resale of Vehicles, Spare Parts, and Accessories, or for the provision of Authorized Repair Services, nor to accredit the existence of a relationship that authorizes it, towards third parties, to assume obligations in the name, or even merely on behalf, of the Company and/or Group Companies, or authorizes it to promise third parties the actions of such entities." "The Dealer undertakes to collect and send to JLRI data relating to its existing and potential customers, in compliance with personal data protection legislation and the relevant instructions given by JLRI on the Hub." Article 2.1 of the aforementioned document specifies the role of the parties to the concession agreement, stating: "This Privacy Annex sets out the framework for any access or sharing of Personal Data and Sensitive Personal Data between the parties—in the context of the Concession Agreement—as separate Data Controllers, joint Controllers, and/or, in certain limited circumstances, Data Processors (as applicable), as further detailed in Appendix 1. It defines the principles to which the parties must adhere and their mutual responsibilities. To the extent that the parties may be identified in Appendix 1 as joint Data Controllers, this Privacy Annex, together with the relevant parts of Appendix 1, will constitute the 'agreement' required under Article 26 of the GDPR." - The Dream Land dealership primarily engages in the wholesale and retail trade of automobiles.In this capacity, Dream Land negotiates directly with the potential customer, collects and manages their personal data for its immediate and direct purposes, including quoting, test driving, and selling the vehicle, as well as implementing its own marketing initiatives in accordance with the guidelines provided by JLRI. - JLRI and Dream Land are independent data controllers, and each is responsible for the processing purposes implemented and clearly and transparently declared to the data subjects in their separate privacy notices. - Appendix 1 to the dealership agreement specifically identifies the personal data processing processes and the parties' obligations and roles. - "In the case at hand, processes No. 2 "Lead Generation" and No. 4 "Lead Management System" can be identified, in which the parties, designated as the Dealer (Dream Land for the purposes of this document), JLRI, and [Jaguar Land Rover Limited], operate as independent data controllers." - "It should also be noted that, following further investigation and verification, the website www.dreamland.landrover.it is not owned and/or directly managed by Jaguar Land Rover Italia S.p.A. The website in question is owned by [Jaguar Land Rover Limited], made available and directly usable by Dream Land as a third-level website, with IT infrastructure managed by an external provider provided by JLRI, for which the dealer pays a fee. Specifically, the dealer may access and/or modify specific content on the aforementioned website independently, through dedicated access points or through the external provider made available to the dealer, following the instructions and guidelines circulated by JLRI over time, or in compliance with JLRI's requests and actions, always with a view to ensuring consistent and uniform management of dealer websites and in compliance with the obligations arising from the dealership agreement." - "Dream Land is the data controller for the activities covered by this investigation [...] and that what occurred with the cookie management banner is not attributable to a deliberate intent to evade legal obligations and the recommendations of this Authority, but rather to a technical issue to which JLRI could have also given greater attention and consideration, with reference to the quality of the service provided by the technical supplier made available to Dream Land." NOTICE that the parties, with autonomy and responsibility varying based on the specific activities covered by specific contractual agreements, process personal data in different ways, and that this investigation must be considered limited solely to the data processing carried out on the website www.dreamland.landrover.it through the use of markers such as cookies or other tools for tracking user navigation for the purposes (declared at the time of ascertaining the facts, specifically in the brief information contained in the cookie banner) necessary for optimal navigation of the site, as well as other non-technical purposes such as sending personalized promotional messages; NOTING that the concession agreement contains no provisions relating to the website under investigation, other than the sole provision in Article 16, paragraph 4, which states: "The Dealer undertakes not to use (i) an Internet Domain and/or (ii) use in any manner and/or on any medium, the names "JLR", "Jaguar", "Jag" or "JAG", "Land Rover and/or", "Jaguar", "Jag", "JAG", "Land Rover", "LR", "L.R.", "Landy", "Landie", "Range Rover", "Rangy", "Rangie", or any derivative thereof in any Internet domain name, legal entity, or trade name without the prior written consent of the Group Company with which the Dealer has signed the agreement referred to in paragraph 1 of this Article." NOTING that the documentation attached to the defense briefs contains no reference to the processing of personal data through cookies and other online tracking tools; CONSIDERING that processes No. 2 "Lead Generation" and No. 4 "Lead Management System" illustrated in Appendix 1 to the concession agreement also do not relate to the processing under investigation and disputed; CONSIDERING that, based on the documentation in the file, the internet domain under investigation is not owned by Dream Land but may be used by the latter only with the prior consent of JLRI and under the conditions established by the latter; CONSIDERING that, as stated by JLRI, the concessionaire may only independently access and/or modify specific content of the aforementioned website, through dedicated access points or through the external provider made available to the concessionaire. In any case, such modifications must follow the specific and timely instructions contained in the guidelines prepared by JLRI, or comply with JLRI's requests and actions; WHEREAS the qualifications attributed to data controllers are based on a factual, functional, and independent, rather than formal, analysis of the influence actually exercised by such data controllers over the purposes and means of the processing. This implies that the legal status of a data controller must, in principle, be determined by the activities actually performed in a specific situation rather than by its formal designation (See EDPB, Guidelines 07/2020 on the concepts of controller and processor under the GDPR, 7 July 2021); WHEREAS, although Dream Land could not materially influence the contested profiles without the cooperation of JLRI, both parties jointly chose to use a website to pursue their common interests and benefit from the resulting commercial advantages. These parties thus "jointly" determined the purposes and means of the processing underlying the tracking of users' browsing through cookies and other markers and, therefore, are to be considered joint controllers pursuant to Article 13 of the GDPR. 26 of the Regulation (see ECJ, 5 June 2018, Case C-210/16, Wirtschaftsakademie; ECJ, 29 July 2019, Case C-40/16, Fashion ID); NOTING that, following further access to the website by the Office, carried out after the investigation conducted by the Guardia di Finanza, the notification pursuant to Article 166, paragraph 5 of the Code, and the defence briefs, it was possible to ascertain that: the banner continues to prevent the user from adequately viewing the cookie policy; that furthermore, following the correct identification of the relevant roles in terms of personal data protection as reconstructed above, the indication of Dream Land as the sole data controller does not correspond to the factual reality under examination; NOTING that the existence of joint responsibility does not necessarily translate into equivalent responsibility of the various operators in the context of personal data processing. Conversely, these operators may be involved in different phases of such processing and at different levels, so the degree of responsibility of each must be assessed taking into account all relevant circumstances of the specific case. Given this, and without prejudice to the fact that the joint controllers are required to regulate, through an internal agreement, their respective responsibilities regarding compliance with the obligations arising from the Regulation, given that only JLRI—as it itself acknowledged in its defense—has the tools to determine the correct configuration of the banner, it is believed that the responsibility for ensuring the correctness of the processing performed should be primarily attributed to JLRI; WHEREAS, pursuant to applicable law and in this specific case, the joint controllers are required, based on the specific internal agreement, to provide information on the processing of personal data carried out through the use of cookies or other tracking tools. In the event of the use of cookies or other tracking technologies other than technical ones, the controller is also required to obtain the user's consent, while in the event of the use of exclusively technical cookies, the controller is only required to provide adequate information; WHEREAS, pursuant to the aforementioned information obligation, the joint controllers are responsible for explaining in a concise, transparent, intelligible, and easily accessible manner, as well as using clear and simple language, every aspect of the processing, including its purposes; WHEREAS, in this specific case, the fact that the banner prevents the user from fully viewing the cookie policy before making a choice regarding the use of cookies, or otherwise makes it difficult to fully consult it, constitutes a violation of the principles of fairness and transparency; The manifestly contradictory nature of the information provided regarding the identity of the data controller was such as to give rise to doubts and uncertainties, thus contributing to the processing being deficient in terms of fairness and transparency; NOTICE, furthermore, that pursuant to Articles 4.11, 7, 12, and 13 of the Regulation, the lack of adequate clarity and transparency affects the validity of any consent given; NOTICE furthermore that, pursuant to Articles 24 and 25 of the Regulation, the joint data controllers are responsible, on the basis of the internal agreement, for determining the purposes and means of processing, as well as for identifying all the most appropriate measures to achieve the dual objective of compliance with the regulations and the protection of the rights and freedoms of data subjects, and that, pursuant to Article 11 of the Regulation, the data controller is responsible for determining the purposes and means of processing, as well as for identifying all the most appropriate measures to achieve the dual objective of compliance with the regulations and the protection of the rights and freedoms of data subjects.5, paragraph 2 of the Regulation, they are also required to comply with all data protection principles and to provide adequate evidence thereof; CONSIDERING that the conduct of the joint data controllers constitutes a violation of Articles 4, point 11, 5, 7, 12, 13, 24, and 25 of the Regulation and Article 122 of the Code, as well as the provisions of the Cookie Guidelines; CONSIDERING, furthermore, that the changes made during the proceedings are partially adequate to restore the site's compliance and that, therefore, it is necessary: a) to order JLRI, pursuant to Article 58, paragraph 2, letter d), of the Regulation, to bring the banner into conformity with the provisions of the Cookie Guidelines, in particular ensuring that this does not impede the correct reading of the information; b) order both joint controllers, after defining, through an internal agreement pursuant to Article 26 of the Regulation, their respective responsibilities, particularly with regard to the exercise of the data subject's rights and their respective duties to communicate the information referred to in Articles 13 and 14 of the Regulation, to provide accurate information regarding the joint controllership of the processing and the entity or entities to whom the data subject may contact to exercise such rights; CONSIDERING, given the specific nature of the investigation, the particular nature of the case, and the statements made in the defense brief, that in this case, the adoption of financial sanctions may be dispensed with, but limited to issuing a warning to the joint controllers, pursuant to Article 58, paragraph 2, letter b) of the Regulation, for failure to comply with the provisions regarding the processing of personal data through the use of cookies and other tracking tools; CONSIDERING that the conditions exist for recording the data in the Authority's internal register pursuant to Article 57, paragraph 1, letter u), of the Regulation, regarding the measures adopted in this case against the joint controllers in accordance with Article 58, paragraph 2, of the Regulation; CONSIDERING the documentation in the file; CONSIDERING the observations of the Office, formulated by the Secretary General pursuant to Article 15 of the Regulation of the Garante no. 1/2000 of 28 June 2000; RAPPORTEUR: Professor Pasquale Stanzione; NOW CONSIDERING ALL THE ABOVE, THE GUARANTOR a) pursuant to Article 58, paragraph 2, letter b), of the Regulation, addresses Jaguar Land Rover Italia S.p.A., with registered office in Rome, Viale Alessandro Marchetti no. 06070621005, and Dream Land S.r.l., with registered office in Agliana (Pistoia), Via A. Volta snc, Tax Code 01845070976, as joint data controllers, a warning for non-compliance with the applicable provisions regarding the processing of personal data through the use of cookies and other tracking tools, for the reasons better explained in the reasoned section; b) pursuant to Art. 58, paragraph 2, letter d) of the Regulation, orders Jaguar Land Rover Italia S.p.a. to adapt the banner to the instructions contained in the Cookie Guidelines, in particular ensuring that this does not hinder the correct reading of the information; c) pursuant to Art. 58, paragraph 2, letter d) of the Regulation, orders both joint data controllers, subject to prior agreement through an internal agreement pursuant to Art. 26 of the Regulation, of their respective responsibilities, to provide accurate information regarding the joint controllership of the processing and the entity(ies) to whom they can contact to exercise their rights; ORDERS pursuant to Art. 17 of the Garante Regulation No. 1/2019, the recording of violations and the measures adopted in the Authority's internal register, as required by Art. 57, paragraph 1, letter u) of the Regulation. Pursuant to Art. 78 of the Regulation, as well as Articles 152 of the Code and 10 of Legislative Decree No. 101 of 1 September 2011, 150, an appeal against this provision may be lodged with the ordinary judicial authority, with an appeal filed either with the court of the place where the data controller resides or has its registered office or with the court of the place of residence of the interested party within thirty days from the date of notification of the provision itself, or sixty days if the appellant resides abroad. Rome, December 18, 2025 THE PRESIDENT Stanzione THE REPORTER Stanzione THE SECRETARY GENERAL Monturi
