Garante per la protezione dei dati personali (Italy) - 351/2026

Garante per la protezione dei dati personali - 351/2026
Authority:	Garante per la protezione dei dati personali (Italy)
Jurisdiction:	Italy
Relevant Law:	Article 5(1)(a) GDPR Article 14 GDPR Article 5(2) GDPR Article 13 ePrivacy Directive Article 130 d.lgs. 196/2003
Type:	Complaint
Outcome:	Upheld
Started:	05.03.2025
Decided:	14.05.2026
Published:
Fine:	1500.0 EUR
Parties:	Ditta individuale Francesco Gagliardi
National Case Number/Name:	351/2026
European Case Law Identifier:	n/a
Appeal:	Unknown
Original Language(s):	Italian
Original Source:	GPDP (in IT)
Initial Contributor:	carloc

The DPA fined a marketing company €1,500 for unlawfully sending unsolicited communications in the context of a B2B marketing campaign.

English Summary

Facts

An individual company (the controller) engaged in a B2B marketing campaign. To this end, it bought a data set from a third-party: a sales platform called Apollo.io. The set consisted of about 2,500 professional contacts, including email addresses, phone numbers, and personal details of the contacts as well as their role within organizations. It is not known how Apollo acquired the information.

The controller then used the data for sending unsolicited marketing communications. The controller relied on its legitimate interest as the legal basis of its legitimate interest. Every email contained a short footer that explained the legal basis of the processing, identified Apollo.io as the source for the email address, and included an opt-out link.

An individual (the data subject) filed a complaint after receiving one of said emails.

Holding

Overall, the DPA found violations of Articles 5(1)(a) and 14 GDPR as well as Art. 130 c.1. d. lgs. 196/2003 (i.e.: the Italian implementation of Article 13 of the ePrivacy Directive).

The DPA issued a €1,500 fine. In quantifying the fine, the DPA took into account that the controller had taken steps to fix its violations before the decision.

Additionally, the DPA ordered the controller to bring its processing of personal data into compliance – which included, among others, erasing the data and providing the addressees of its marketing campaign with all the information required by Article 14.

On the applicable legal regime

First, the DPA clarified that the case fell within the scope of both the GDPR and the Article 13 of the ePrivacy Directive (as well as its implementation in Italian law).

The DPA pointed out that the data set, which the controller bought and processed, contained at least some personal data. On these grounds, the DPA held that the case fell within the scope of the GDPR even though the controller’s campaign was B2B in nature.

With regards to the ePrivacy Directive, the DPA observed that Article 13 covers marketing carried out towards subscribers or users of an electronic communications network, and clarified that the notions of “subscriber” or “users” may also cover legal persons. On these grounds, the DPA held that the Article applied to the case at hand regardless of the personal or non-personal nature of the data processed.

On lawfulness

Article 13 of the ePrivacy Directive requires consent for sending unsolicited marketing emails. In the DPA’s view, this made it unlawful for the controller to rely on legitimate interest as its legal basis. On these grounds, the DPA held that the controller unlawfully processed personal data for marketing purposes.

On transparency

The DPA acknowledged that the controller’s marketing emails contained a privacy notice but found it to be severely lacking. On these grounds, the DPA held that the controller violated Article 14 GDPR as well as the transparency principle.

On the controller's accountability

In its defence, the controller pointed out that Apollo had put forward claims that its processing complied with applicable laws and that the data set it sold, could lawfully be used for marketing. The DPA, however, applied the principle of accountability (Article 5(2) GDPR) and concluded that the documental or contractual guarantees provided a third-party, did not exempt the controller from assessing the lawfulness of its processing and did not shield the controller from liability.

Comment

The case is a reminder that in the view of the Garante, Article 13 of the ePrivacy Directive (and its implementation in Italian legislation) may also cover marketing campaigns that do not involve the processing of personal data under the GDPR.

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Italian original. Please refer to the Italian original for more details.

[Web Doc. No. 10263918]

Decision of May 14, 2026

Register of Decisions
No. 351 of May 14, 2026

THE DATA PROTECTION AUTHORITY

AT today’s meeting, attended by Prof. Pasquale Stanzione, President; Prof. Ginevra Cerrina Feroni, Vice President; Dr. Agostino Ghiglia, Member; and Dr. Luigi Montuori, Secretary General;

HAVING REGARD TO Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016, on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation, hereinafter “Regulation” or “GDPR”);

HAVING REGARD TO the Code on Data Protection (Legislative Decree No. 196 of June 30, 2003), as amended by Legislative Decree No. 101 of August 10, 2018, containing provisions for the adaptation of national law to the aforementioned Regulation (hereinafter the “Code”);

HAVING REGARD TO the documentation on file;

HAVING REGARD TO the observations made by the Secretary General pursuant to Art. 15 of the Data Protection Authority’s Regulation No. 1/2000, adopted by resolution of June 28, 2000;

REPORTER: Prof. Pasquale Stanzione;

1. THE PRELIMINARY INVESTIGATION CONDUCTED

1.1. Introduction

By communication ref. no. 177444 dated December 22, 2025 (served on the same date via certified email), which is hereby deemed to be incorporated in its entirety, the Office initiated, pursuant to Article 166, paragraph 5, of the Code, a proceeding to adopt the measures referred to in Art 58, para 2, of the Regulation against the sole proprietorship of Francesco Gagliardi (hereinafter also referred to as the “Business” or the “Owner”).

The proceedings stem from a report dated May 5, 2025 (registered under ref. no. 60002 on May 6, 2025), in which the complainant informed the Authority that he had received a promotional email from the Firm, which had obtained his email address through the Apollo.io platform (hereinafter also “Apollo”). This information was disclosed to the complainant by the Company, and the complainant thus learned that, although he had never registered with or given consent to the collection or processing of his personal data by the Apollo platform, nor had he received any privacy notice from it, his personal email address and other information pertaining to him were nonetheless available on the platform.

The complainant therefore exercised his right to erasure of his data, a request that was subsequently granted by the Company. 

1.2. The Authority’s Request for Information

On September 18, 2025 (Ref. No. 122622 of the same date), the Office issued a request for information to the Company, pursuant to Article 157 of the Code, regarding the matters raised in the complaint, also requesting that the Company explain the measures taken to ensure that marketing activities are conducted in compliance with applicable law and, in particular, with specific reference to the use of the Apollo platform, to provide information regarding: the origin of the personal data; the grounds justifying its collection and subsequent processing; whether and how the data subjects were provided with the privacy notice regarding the processing of personal data; and whether and how the data subjects’ consent to the processing of their data for promotional purposes was obtained.

By certified email dated October 23, 2025 (registered under ref. no. 140790 on the same date) the Company responded to the Office’s request for information, stating first and foremost that it carries out “B2B Lead Generation” activities, primarily through Direct Email Marketing (DEM) campaigns, and therefore, with regard to the report, maintaining that it had acted in full compliance with the regulations governing personal data.

The Company’s business is based on the selection of target companies, specifically those aligned with its clients’ products and services. The data of the target individuals is then collected via the Apollo platform—which claims to be compliant with the Regulation—after which the Company sends promotional communications. 

Each communication sent includes information in the email footer such as the data controller’s name and contact information, the legal basis, the source of the data, the right to unsubscribe, and compliance with the Regulation.

The text in the email footer is as follows: “This email was sent pursuant to Art. 6, para. 1, subparagraph f) of EU Regulation 2016/679 (GDPR) because we believe it may be of interest to your business. Your contact information was obtained from Apollo.io and is used exclusively for informational and commercial purposes related to our services. If you no longer wish to receive communications from us, you may reply to this email by writing “REMOVE,” and your address will be immediately deleted from our filing system.” 

In confirming the acquisition of data from Apollo, the Company stated that on January 24, 2025, and upon payment of $224.00 (two hundred twenty-four dollars), it purchased 2,500 contacts, including email addresses, phone numbers, and the job title held by the relevant contact at the target company. The Data Controller also added that it considers this data to be “exclusively business-related.”

Finally, the erasure of the whistleblower’s data was confirmed.

2. CONTESTATION OF THE VIOLATIONS AND DEFENSE BRIEF

Following the preliminary investigation, the Office issued the aforementioned Decision No. 177444 dated December 22, 2025, charging the Company, in its capacity as controller, with possible violations of the law as set forth below.

2.1. Sending commercial communications without an appropriate legal basis and without providing adequate information to the data subjects

The statements provided revealed that the Data Controller had obtained personal data from third parties without verifying the source of the data or whether its reuse was lawful. The data was processed for the Company’s own commercial or marketing purposes based on the legitimate interest referred to in Article 5, para 1, subparagraph (f) of the Regulation and without providing adequate information. 

The Data Controller stated that it had made further contacts based on both the phone numbers and email addresses acquired, as its business activity consisted precisely of contacting the target companies whose data had been acquired through Apollo. To that end, the Data Controller stated that it had collected approximately 2,500 contacts relating to “the point of contact within the company […] where the individual works.”

Finally, the Data Controller provided the contacted individuals—along with the promotional communication in the email footer—with a brief notice regarding the ongoing processing, indicating the legal basis for the processing, the source of the data, and the possibility of exercising the right to object.

The identification of legitimate interest as the legal basis for processing personal data for marketing purposes was likely to conflict with the principle of lawfulness and fairness of processing and, in particular, with the provisions requiring the acquisition of prior consent for sending commercial communications; thus potentially violating Article 5(1)(a) of the Regulation and Article 130, paragraphs 2, 3, and 3-bis of the Code.

Similarly, the lack of adequate and complete information regarding the processing activities in progress was likely to constitute a possible violation of the principle of transparency set forth in Articles 5(1)(a) and 14 of the Regulation.

In light of the foregoing, the Office alleged, in summary, a possible violation of: Article 5(1)(a) and Article 14 of the Regulation, as well as Article 130 of the Code, on the grounds that the Company conducted personal data processing for commercial purposes without a suitable level of lawfulness and without providing adequate information to the data subjects.

2.2. Defense Brief

The Data Controller, pursuant to Article 166, paragraph 6, of the Code and Art 13 of the Data Protection Authority’s Internal Regulation No. 1/2019, submitted its defense briefs via a letter dated January 29, 2026, which was entered into the record on the same date (Protocol No. 12983).

In that submission, the Data Controller first confirmed the methods by which it carried out “B2B Lead Generation” activities through direct email marketing (DEM), an activity suspended following the Authority’s initial written notice. The Data Controller further stated that it had always limited the number of emails sent to each contact to a maximum of three, spaced three days apart.

I then reiterated that I had considered the contact data used—first name, last name, and work email address—to have come from legitimate sources because it was collected via the Apollo platform, which declared its compliance with the Regulation. In particular, in addition to declaring compliance with the Regulation, Apollo states that it adheres to the “EU-U.S. Data Privacy Framework” and adopts other security standards (such as ISO 27001 certification, encryption, and audits regarding access control, risk, information security, and IT infrastructure). 

Consequently, the Data Controller concluded that Apollo had, first and foremost, collected the data lawfully and that the Company could, in turn, base the sending of promotional emails on the legitimate interest pursuant to Art. 6(1)(f) of of the Regulation, further supported by the fact that it was operating within a B2B context and considering the activity to be non-intrusive, likely to cause only a minor inconvenience to the recipients.

That said, while acknowledging “that the contacts acquired, although used in a professional context, remain personal data relating to natural persons and that, under Italian law, promotional communications via email and telephone are subject to the special provisions of Art. 130 of the Code, which establishes prior consent as the general rule for lawfulness,” the Data Controller justified its conduct by relying on the contractual and documentary representations provided by Apollo as an entity operating internationally in the B2B data sector, believing in good faith that this was sufficient to ensure the lawfulness of the contacts transferred. 

With regard to the privacy notice, while emphasizing that it had provided, in the footer of the emails sent to data subjects, crucial information regarding the processing (such as the source of the data), the Data Controller acknowledged that the privacy notice sent “did not in fact include all the content required by Article 14 of the Regulation and did not even refer to another, more comprehensive privacy notice.” 

The Data Controller thus outlined the corrective measures adopted to address the issues identified by the Office. Specifically: it ceased using the contacts collected by Apollo; suspended all sending of promotional communications based on legitimate interest; and committed to conducting marketing activities only with the prior consent of the data subjects; it began preparing comprehensive and up-to-date privacy notices, drafting the record of processing activities, and establishing procedures for a prior assessment of database providers, including checks such as the provider’s location, the presence of an EU representative, privacy notices, and the necessary consents.

3. THE AUTHORITY’S ASSESSMENTS

As a preliminary matter, it should be noted that anyone who, in proceedings before the Data Protection Authority, falsely declares or attests to facts or circumstances, or produces false documents or records, is criminally liable pursuant to Art. 168 of the Code.

On the merits, following the conclusion of the preliminary investigation and after evaluating the arguments put forward by the Company, it is considered that these arguments are not sufficient to exclude the Company’s accountability.

First, it should be noted that, although the Data Controller initially believed that the contacts acquired were exclusively of an enterprise/professional nature—since they pertained to individuals acting within the scope of their enterprise or professional activities—the type of data collected (first name, last name, business email address, phone number, and the data subject’s position/role within the target company), it is readily apparent that the use of the data in a business context does not preclude its classification as “personal data” under Art. 4(1) of the Regulation. Such data are undisputedly, as acknowledged by the Data Controller in its defense brief, information concerning identified or identifiable natural persons. 

Furthermore, in this specific case, promotional activities carried out through electronic communication channels (such as sending text messages or emails, but also making phone calls) is subject to the special provisions set forth in Directive 2002/58/EC, transposed into Italian law by Title X of the Code. In particular, pursuant to this legislation, the protected party is not the natural person who may qualify as a “data subject,” but rather the “contracting party” or “User,” as defined, respectively, in Art. 121, paragraph 1-bis, letter f) and (g) of the Code as: “any natural person, legal entity, body, or association that is party to a contract with a provider of publicly available electronic communications services for the provision of such services, or is otherwise a recipient of such services via prepaid cards” and “any natural person who uses a publicly available electronic communications service, for private or business purposes, without necessarily being a subscriber.” Thus, the “business” or “professional” nature of the information processed would not, in any case, have been sufficient to fall outside the scope of application of the special legislation.

However, this point is not contested by the Data Controller; thus, it can be confirmed that the Data Controller processed, for commercial purposes, information relevant both under the Regulation and under Title X of the Code.

The documentation on file therefore shows that the Data Controller processed personal data for commercial or marketing purposes by obtaining the contact information of the data subjects from a third party without having verified: whether it had obtained prior consent pursuant to Article 130 of the Code, and whether the third-party source had obtained valid consent for the processing of personal data for third-party marketing purposes.

Specifically, it is noted that, for a cost of $224.00, the Data Controller purchased a package of 2,500 data records—including information such as the data subject’s name, professional email address, phone number, and job title/position—which were then reused to send commercial communications.

The Data Controller maintained that it acted in good faith and relied on the guarantees offered by the Apollo platform.

While it is not possible at this time to ascertain the lawfulness of the data collection and processing carried out by that platform, it should be noted that the Data Controller has not provided or documented any evidence on the basis of which it could be considered not only thatApollo’s original collection of the data was based on a lawful basis permitting its reuse for commercial purposes by third parties, but also that the Data Controller itself possessed the consent required by law for sending commercial communications.

In particular, the elements on which the Data Controller claims to have relied are, on the one hand, extremely generic—such as the alleged and abstract declaration of compliance with the Regulation—and, on the other hand, irrelevant and unsuitable for demonstrating the prerequisites for the proper reuse of the data. In this regard, both the reference to the “EU-U.S. Data Privacy Framework” and the certifications and attestations regarding information security pertain to aspects other than the lawfulness of processing, are limited to specific areas, and are in any case insufficient to prove essential elements such as the source of the data, the proper notification of data subjects, and the collection of their prior consent.

The Data Controller has acknowledged that Italian law requires prior consent for sending promotional communications via eemail and telephone, but has also argued that relying on a legitimate interest seemed appropriate given the B2B nature of the campaigns, based on Apollo’s stated—though not documented—compliance with the Regulation, as well as on other factors such as: a privacy notice that, while incomplete, was nonetheless deemed clear; the provision of an opt-out mechanism; the use of “mere” identification and contact data; and the absence of aggressive or mass campaigns.

These elements are not sufficient to rule out the existence of unlawful conduct. This is because, as the Data Controller itself acknowledged, promotional activities carried out through electronic communication channels (such as sending text messages or making phone calls) are subject to the aforementioned special provisions set forth in Directive 2002/58/EC and, in particular, Art. 130 of the Code.

Paragraphs 1 and 2 of Art 130 of the Code provide that the sending of communications by automated means is permitted only with the consent of the contracting party or User, and an exception may be granted only if the email address—and only the email address — has been provided by the data subject in the context of a sale of similar goods or services (Art. 130, paragraph 4, of the Code). 

Similar considerations apply to marketing activities conducted via telephone (telemarketing), which may be carried out only on the basis of appropriate consent or—as the sole permitted exception—by using telephone numbers listed in telephone directories and not registered in the Public Opt-Out Registry (Article 130, paragraph 3-bis, of the Code). 

It follows that, in the absence of consent from the contracting party or User, promotional communications may not be sent even if the personal data are derived from public records, directories, websites, digital platforms, or acts or documents known or knowable to anyone (see, in this regard, the Guidelines on Promotional Activities and Combating Spam, July 4, 2013, adopted by Provincial Decree No. 330, web doc. No. 2542348). 

Furthermore, relying on contractual and/or formal guarantees offered by third-party providers of lists and contact information does not, in accordance with the principle of accountability (Art. 5, para. 2 of the Regulation), relieve the controller of the need to exercise due diligence regarding the data acquired or the lawfulness of the contacts provided, as well as to verify whether the acquired contacts are listed in the Public Opt-Out Registry (“RPO”). In this regard, it should be noted that verification in the aforementioned RPO must be considered a prerequisite for conducting telemarketing activities correctly, and failure to consult it inevitably renders it impossible to launch any promotional campaign that involves the use of the telephone.

Monitoring the data chain during promotional activities is the area where the controller is required to devote the greatest effort, as this is one of the most vulnerable aspects of data processing in marketing activities.

The documentation on file does not indicate that the Data Controller has exercised any control over the reusability of the acquired data or over the data chain from which it was obtained. 

At the same time, given a clear and well-established regulatory framework—including under the Code in effect prior to the Regulation’s entry into force—as well as the availability of guidelines and numerous clarifications, even through mainstream media and communication channels, regarding the legal grounds for conducting promotional activities pursuant to Art. 130 of the Code, simply relying on an online platform’s mere declaration of compliance with the Regulation cannot be considered a sufficient basis for reliance consistent with the level of professional diligence required of an operator active in the online marketing sector. 

The Data Controller himself has, moreover, acknowledged that he should have exercised his independent duty of oversight more effectively.

Therefore, the error committed by the Data Controller is not sufficient to negate his accountability, at least on the grounds of negligence. According to case law, in fact, the defense of good faith referred to in Art. 3 of Law No. 689 of 1981 serves as a basis for excluding administrative accountability only if there are positive elements sufficient to lead the violator to believe that their conduct was lawful, and it is established that the violator did everything possible to comply with the legal requirement, such that no blame can be attributed to them. In this regard, see Civil Cassation, Section II, November 29, 2023, No. 33121, which held that, with respect to administrative violations, since, pursuant to Article 3 of Law No. 689 of 1981, simple negligence is sufficient to establish the subjective element of the offense, a mistake regarding the lawfulness of the relevant conduct—commonly referred to as “good faith”—can preclude administrative accountability only when it is unavoidable, requiring, for this purpose, a positive element—independent of the offender—capable of giving rise to the offender’s belief in the aforementioned lawfulness, in addition to the condition that the offender has done everything possible to comply with the law and that no blame can be attributed to him, so that the error was blameless—that is, not one that could have been prevented by the data subject through ordinary diligence (see, among others, Civil Cassation, Section II, June 11, 2007, No. 13610).

In the present case, on the one hand, the provisions set forth in the relevant regulatory framework—and, in particular, the plain language of Article 130 of the Code clearly highlight the need for prior consent from the recipients of commercial communications; on the other hand, there is no evidence that the Data Controller took any action or conducted a critical assessment of the contractual and documentary representations provided by the platform from which the data was obtained. It follows that there is insufficient evidence to conclude that the Data Controller did everything possible to comply with the legal requirement.

Given the foregoing, it can be established that in at least one case—the one reported—the Data Controller sent a commercial communication to the complainant without the consent required by law. 

Furthermore, from another perspective and in more general terms, one cannot fail to take into account the fact that the inherent seriousness of the conduct is amplified by the specific source of the data. The Authority is, in fact, observing an increase in services offered by digital platforms that, in exchange for payment, make personal data available (in particular contact information such as phone numbers and email addresses), without providing adequate and substantial guarantees or documentation regarding the lawfulness of the collection, subsequent processing operations, and, in particular, the transfer and potential further processing of such data by the purchasers. 

The purchasers, in turn, uncritically rely on the merely formal assurances of regulatory compliance offered by these digital platforms, sometimes relying solely on the platforms’ reputation in the sector or on the semblance of professionalism with which they present their services. This results in them being directly liable for any violations of the Regulation’s provisions—violations that cannot be excused on the grounds of alleged “good faith” and, indeed, are indicative of a lack of adequate professional diligence—as well as posing concrete risks to the fundamental rights and freedoms of the data subjects.

Therefore, a violation of the principles of lawfulness and fairness set forth in Article 5(1)(a) of the Regulation and Article 130, paragraphs 2, 3, and 3-bis of the Code must be deemed to have occurred. Sending Commercial Communications Without Prior Notice

The documentation on file also shows that the Data Controller purchased an “information package” containing a total of 2,500 contacts, which were reused for commercial purposes by sending the relevant data subjects a brief notice regarding the characteristics of the ongoing processing.

With regard to the obligations to provide information, Art 5(1)(a) of the Regulation provides that personal data must be processed fairly and with transparency in relation to the data subject (principle of fairness and transparency) and, more specifically, with regard to the information to be provided when the data has not been obtained from the data subject, Article 14 of the Regulation provides that the controller shall provide the data subject with all the information referred to in paragraphs 1 and 2 (including, for example, the data storage period, the possibility of exercising the rights referred to in Articles 15–22 of the Regulation, and the right to lodge a complaint with the supervisory authority). This information regarding the processing must be provided to the data subject within a reasonable period of time after the data are obtained, no later than one month, or, if the data are intended for communication with the data subject, no later than the time of the first communication to the data subject (Art. 14, para. 3, Reg.).

In the present case, and with regard to the whistleblower—as also acknowledged by the Data Controller—it appears that the Data Controller provided brief information in the footer of the communication sent. However, in the absence of, at the very least, a reference to a comprehensive privacy notice containing all the elements required by law, it cannot be considered that the information provided complied with the requirements set forth in Art. 14 of the Regulation.

It must therefore be concluded that inadequate information was provided regarding the processing activities in progress and, consequently, that there was a violation of the principle of transparency set forth in Articles 5(1)(a) and 14 of the Regulation.

4. CONCLUSIONS

Based on the foregoing, the unlawfulness of the processing operations under review is established, as is the accountability of the sole proprietorship Francesco Gagliardi, with registered office at XX, with respect to the following violations:

a) Article 5(1)(a) of the Regulation and Article 130, paragraphs 2, 3, and 3-bis of the Code, as the Data Controller processed personal data for commercial purposes without the prior consent required by law. With regard to such processing, pursuant to Article 58(2)(f) and (g) of the Regulation, it is necessary to impose a prohibition on the processing of personal data and, consequently, to order the erasure of the data, except for those necessary for other lawful processing activities. It is also necessary to impose a monetary penalty under the terms set forth below;

b) Articles 5(1)(a) and 14 of the Regulation, because the Data Controller collected personal data from third parties and processed it without providing adequate information. Although this violation is acknowledged, the nature of the violation and the Data Controller’s commitment to provide comprehensive privacy notices, broken down by channel and type of processing (DEM, telemarketing), make it possible to waive the imposition of an administrative fine, as the requirements of necessity, proportionality, and deterrence for such a measure are not met. It is therefore deemed appropriate, with regard to the inadequate information provided to data subjects, to issue a warning to the controller, pursuant to Article 58, para 2, subparagraph b) of the Regulation, as well as to order, pursuant to Art 58, para 2, subparagraph d) of the Regulation, that the controller bring the processing operations into compliance with the relevant provisions.

5. ORDER IMPOSING AN ADMINISTRATIVE FINE

Based on the foregoing, various provisions of the Regulation have been violated, specifically Articles 5, para 1, subparagraph (a), and 14 of the Regulation, as well as Article 130, paragraphs 2, 3, and 3-bis of the Code, in connection with processing activities carried out by the sole proprietorship Francesco Gagliardi, with registered office at XX.

With regard to the violation of Article 5, para 1, subparagraph a) of the Regulation and Article 130, paragraphs 2, 3, and 3-bis of the Code, an injunction must be issued pursuant to Articles 166, paragraph 7 of the Code and Article 18 of Law No. 689/1981, it is necessary to apply Article 83, para 3, of the Regulation, pursuant to which, if, in relation to the same processing operation or related processing operations, a controller violates, intentionally or through negligence, various provisions of the Regulation, the total amount of the administrative fine shall not exceed the amount specified for the most serious violation, with the result that only the fine provided for in Article 83, para 5, of the Regulation shall be applied.

For the purposes of determining the amount of the administrative fine, the aforementioned Article 83(5)—in setting the maximum fine at 20 million euros or, for enterprises, 4% of the annual worldwide turnover of the preceding fiscal year, whichever is higher, specifies the methods for determining the aforementioned fine, which must “in any event [be] effective, proportionate, and dissuasive” (Article 83(1) of the Regulation), identifying, for this purpose, a series of factors—listed in para 2—to be assessed when determining the relevant amount.

In determining the amount of the fine, the factors set forth in Article 83(2) of the Regulation must be taken into account.

In the case at hand, the following factors are relevant:

a) the gravity of the violations (Article 83(2), subparagraph (a) of the Regulation), taking into account the subject matter and processing purposes, which relate to marketing activities carried out without a valid degree of lawfulness, as well as the fact that the conduct was repeated with respect to hundreds of data subjects;

b) as an aggravating factor, the grossly negligent nature of the Data Controller’s conduct (Art. 83(2), para.), subparagraph (b) of the Regulation), which, despite the fact that the rules governing commercial communications remained unchanged after the Regulation entered into force and have been the subject of guidelines and clarifications since 2013, failed to take the necessary measures to ensure the fairness and lawfulness of the processing carried out, and further failed to subject the documentation provided by the platform from which the data were collected to adequate scrutiny in order to verify the lawfulness of the collection; 

(c) as a mitigating factor, the fact that the Data Controller has not previously been a recipient of a corrective or sanctioning measure by the Data Protection Authority (Article 83(2)(e) of the Regulation);

d) as a mitigating factor, the cooperation with the supervisory authority to remedy the violation and the corrective measures adopted, which also manifested itself in the full acknowledgment of the allegations made (Article 83(2)(f) of the Regulation);

e) as a mitigating factor, the fact that the processing did not involve special categories of personal data or data relating to criminal convictions and offenses (Article 83(2)(g) of the Regulation);

f) as a mitigating factor, the small economic scale of the Data Controller, as well as the amount of its turnover (Art. 83(2)(k) of the Regulation). 

Based on all of the factors set forth above and on the principles of effectiveness, proportionality, and deterrence provided for in Art 83, para 1, of the Regulation, and taking into account the necessary balance between the data subject rights and the freedom of enterprise—including to limit the economic impact of the penalty on the Company’s organizational and operational needs—it is deemed appropriate to set the monetary penalty at a minimum threshold; therefore, that the administrative penalty of 1,500 euros (one thousand five hundred/00) should be imposed, equal to 0.01% of the maximum penalty. 

In the case at hand, it is deemed that the additional penalty of publishing this injunction order on the Data Protection Authority’s website—as provided for in Article 166, paragraph 7, of the Code and Article 16 of the Data Protection Authority’s Regulation No. 1/2019—should also be applied, given the particularly reprehensible nature of the conduct in question, linked to the seriousness of the violations, which involve the core principles of the relevant legislation, with regard to the conduct of marketing activities targeting a large number of data subjects as well as the specific source of the personal data being processed.

Finally, the conditions set forth in Art. 17 of Regulation No. 1/2019 regarding internal procedures with external relevance, aimed at carrying out the tasks and exercising the powers entrusted to the Data Protection Authority, are met.

NOW THEREFORE, THE DATA PROTECTION AUTHORITY

a) pursuant to Article 57(1)(a) of the Regulation, declares the processing carried out by the sole proprietorship Francesco Gagliardi, with registered office at XX, in its capacity as controller, to be unlawful, under the terms set forth in the reasoning;

b) issues a warning, pursuant to Article 58(2)(b) of the Regulation, for the violation of Articles 5(1)(a) and 14 of the Regulation;

c) orders, pursuant to Article 58(2)(d) of the Regulation, that the processing be brought into compliance with the provisions regarding the proper provision of information to data subjects;

d) imposes, pursuant to Article 58(2)(f) of the Regulation, a prohibition on the processing of personal data processed without valid consent and information;

e) orders, pursuant to Article 58(2)(g) of the Regulation, the erasure of such data, except for data necessary for other lawful processing activities;

ORDERS

the sole proprietorship Francesco Gagliardi, with registered office at XX, in its capacity as controller, to pay the sum of 1,500 (one thousand five hundred/00) euros as an administrative fine for the violation of Article 5, para 1, subparagraph (a) of the Regulation and Article 130, paragraphs 2, 3, and 3-bis of the Code, noting that the offender, pursuant to Article 166, paragraph 8, of the Code, has the right to settle the dispute within thirty days by complying with the requirements imposed (the completion of which must be communicated to the Authority within the same period) and by paying an amount equal to half of the penalty imposed.

ORDERS

the aforementioned Company, in the event of failure to resolve the dispute pursuant to Article 166, paragraph 8, of the Code, to pay the sum of 1,500 euros (one thousand five hundred/00), in accordance with the procedures set forth in the attachment, within 30 days of the service of this order, failing which the Authority will take the necessary enforcement measures pursuant to Art. 27 of Law No. 689/1981.

a) the publication of this order on its institutional website, pursuant to Articles 154-bis, paragraph 3, of the Code and Article 37 of Regulation No. 1/2019, as well as the imposition of the additional penalty of publishing this injunction on the Data Protection Authority’s website, as provided for in Article 166, paragraph 7, of the Code and Article 16 of the Authority’s Regulation No. 1/2019;

b) the entry of this order in the Authority’s internal register—as required by Article 57, para 1, subparagraph u), of the Regulation, as well as by Article 17 of the Authority’s Regulation No. 1/2019 concerning internal procedures with external relevance, aimed at carrying out the tasks and exercising the powers entrusted to the Data Protection Authority—regarding violations and the measures adopted in accordance with Art. 58, para. 2, of the Regulation itself.

Pursuant to Article 78 of the Regulation, as well as Articles 152 of the Code and 10 of Legislative Decree No. 150 of September 1, 2011, an appeal against this decision may be filed with thethe ordinary courts by filing an appeal with the ordinary court of the place where the controller resides or, alternatively, with the court of the place of residence of the data subject, within thirty days from the date of notification of the decision or within sixty days if the appellant resides abroad.

Rome, May 14, 2026

THE CHAIRMAN
Stanzione

THE RAPPORTEUR
Stanzione

THE SECRETARY GENERAL
Montuori
 

[Web Doc. No. 10263918]

Decision of May 14, 2026

Register of Decisions
No. 351 of May 14, 2026

THE DATA PROTECTION AUTHORITY

AT today’s meeting, attended by Prof. Pasquale Stanzione, Chair; Prof. Ginevra Cerrina Feroni, Vice Chair; Dr. Agostino Ghiglia, Member; and Dr. Luigi Montuori, Secretary General;

HAVING REGARD TO Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016, on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation, hereinafter “Regulation” or “GDPR”);

HAVING REGARD TO the Code on Data Protection (Legislative Decree No. 196 of June 30, 2003), as amended by Legislative Decree No. 101 of August 10, 2018, containing provisions for the adaptation of national law to the aforementioned Regulation (hereinafter the “Code”);

HAVING REGARD TO the documentation on file;

HAVING REGARD TO the observations made by the Secretary General pursuant to Art. 15 of the Data Protection Authority’s Regulation No. 1/2000, adopted by resolution of June 28, 2000;

RAPPORTEUR: Prof. Pasquale Stanzione;

1. THE PRELIMINARY INVESTIGATION CONDUCTED

1.1. Introduction

By communication ref. no. 177444 dated December 22, 2025 (served on the same date via certified email), which is hereby deemed to be incorporated in its entirety, the Office initiated, pursuant to Article 166, paragraph 5, of the Code, a proceeding to adopt the measures referred to in Article 58, para 2, of the Regulation against the sole proprietorship Francesco Gagliardi (hereinafter also referred to as the “Business” or the “Owner”).

The proceedings stem from a report dated May 5, 2025 (registered under ref. no. 60002 on May 6, 2025), in which the complainant informed the Authority that he had received a promotional email from the Firm, which had obtained his email address through the Apollo.io platform (hereinafter also “Apollo”). This information was disclosed to the complainant by the Company, and the complainant thus learned that, although he had never registered with or given consent to the collection or processing of his personal data by the Apollo platform, nor had he received any privacy notice from it, his personal email address and other information pertaining to him were nonetheless available on the platform.

The complainant therefore exercised his right to erasure of his data, a request that was subsequently granted by the Company. 

1.2. The Authority’s Request for Information

On September 18, 2025 (Ref. No. 122622 of the same date), the Office issued a request for information to the Company, pursuant to Article 157 of the Code, regarding the matters raised in the complaint, and also asked the Company to explain the measures taken to ensure that marketing activities are conducted in compliance with applicable law and, in particular, with specific reference to the use of the Apollo platform, to provide information regarding: the origin of the personal data; the grounds justifying its collection and subsequent processing; whether and how the data subjects were provided with the privacy notice regarding the processing of personal data; and whether and how the data subjects’ consent to the processing of their data for promotional purposes was obtained.

By certified email dated October 23, 2025 (registered under ref. no. 140790 on the same date) the Company responded to the Office’s request for information, stating first and foremost that it carries out “B2B Lead Generation” activities, primarily through Direct Email Marketing (DEM) campaigns, and therefore, with regard to the report, maintaining that it had acted in full compliance with the regulations governing personal data.

The Company’s business is based on the selection of target companies, i.e., those aligned with its clients’ products and services. The data of the target individuals is then collected via the Apollo platform—which claims to be compliant with the Regulation—after which the Company sends promotional communications. 

Each communication sent includes information in the email footer such as the data controller’s name and contact information, the legal basis, the source of the data, the right to unsubscribe, and compliance with the Regulation.

The text in the email footer is as follows: “This email was sent pursuant to Art. 6, para. 1, subparagraph f) of EU Regulation 2016/679 (GDPR) because we believe it may be of interest to your business. Your contact information was obtained from Apollo.io and is used exclusively for informational and commercial purposes related to our services. If you no longer wish to receive communications from us, you may reply to this email by writing “REMOVE,” and your address will be immediately deleted from our filing system.” 

In confirming the acquisition of the data from Apollo, the Company stated that on January 24, 2025, and upon payment of $224.00 (two hundred twenty-four dollars), it purchased 2,500 contacts, including email addresses, phone numbers, and the job titles of the respective contacts at the target company. The Data Controller further added that it considers this data to be “exclusively business-related.” 

Finally, the erasure of the whistleblower’s data was confirmed.

2. OBJECTION TO THE VIOLATIONS AND DEFENSE BRIEF

Following the preliminary investigation, the Office adopted the aforementioned Decision No. 177444 of December 22, 2025, charging the Company, in its capacity as controller, with possible violations of the law as set forth below.

2.1. Sending commercial communications without an appropriate legal basis or adequate information to the data subjects

The statements provided revealed that the Data Controller had obtained personal data from third parties without verifying the source of the data or the possibility of its lawful reuse, and had processed such data for its own commercial or marketing purposes based on the legitimate interest referred to in Article 5, para 1, subparagraph (f) of the Regulation and without providing adequate information. 

The Data Controller stated that it had made further contacts based on both the phone numbers and email addresses acquired, as its business activity consisted precisely of contacting the target companies whose data had been acquired through Apollo. To that end, the Data Controller stated that it had collected approximately 2,500 contacts relating to “the point of contact within the company […] where the individual works.”

Finally, the Data Controller provided the individuals contacted—along with the promotional message in the email footer—with a brief notice regarding the ongoing processing, indicating the legal basis for the processing, the source of the data, and the option to exercise the right to object.

The identification of legitimate interest as the legal basis for the processing of personal data for marketing purposes was likely to conflict with the principle of lawfulness and fairness of processing and, in particular, with the provisions requiring prior consent for the sending of commercial communications; thus potentially violating Article 5(1)(a) of the Regulation and Article 130, paragraphs 2, 3, and 3-bis of the Code.

Similarly, the absence of adequate and complete information regarding the processing activities in progress was likely to constitute a potential violation of the principle of transparency set forth in Articles 5(1)(a) and 14 of the Regulation.

In light of the foregoing, the Office alleged, in summary, a possible violation of: Article 5(1)(a) and Article 14 of the Regulation, as well as Article 130 of the Code, on the grounds that the Company conducted personal data processing for commercial purposes without a suitable level of lawfulness and without providing adequate information to the data subjects.

2.2. Defense Brief

The Data Controller, pursuant to Article 166, paragraph 6, of the Code and Article 13 of the Data Protection Authority’s Internal Regulation No. 1/2019, submitted its defense brief via a letter dated January 29, 2026, which was entered into the record on the same date (Ref. No. 12983).

In that submission, the Data Controller first confirmed the methods by which it carried out “B2B Lead Generation” activities through direct email marketing (DEM), an activity suspended following the Authority’s initial written notice. The Data Controller also added that it had always limited the number of emails sent to each contact to a maximum of three, spaced three days apart.

I then reiterated that I had considered the contact data used—first name, last name, and work email address—to have come from legitimate sources because they were collected via the Apollo platform, which declared its compliance with the Regulation. In particular, in addition to declaring compliance with the Regulation, Apollo states that it adheres to the “EU-U.S. Data Privacy Framework” and adopts other security standards (such as ISO 27001 certification, encryption, and audits regarding access control, risk, information security, and IT infrastructure). 

Consequently, the Data Controller concluded that Apollo had, first and foremost, collected the data lawfully and that the Company could, in turn, base the sending of promotional emails on the legitimate interest pursuant to Art. 6(1)(f) of of the Regulation, further supported by the fact that it was operating within a B2B context and considering the activity to be non-intrusive, likely to cause only a minor inconvenience to the recipients.

That said, while acknowledging “that the contacts acquired, although used in a professional context, remain personal data pertaining to natural persons and that, under Italian law, promotional communications via email and telephone are subject to the special provisions of Art. 130 of the Code, which establishes prior consent as the general rule for lawfulness,” the Data Controller justified its conduct by relying on the contractual and documentary representations provided by Apollo as an entity operating internationally in the B2B data sector, believing in good faith that this was sufficient to ensure the lawfulness of the transferred contacts.

With regard to the privacy notice, while emphasizing that it had communicated, in the footer of the emails sent to data subjects, crucial information regarding the processing (such as the origin of the data), it acknowledged that the privacy notice sent “did not in fact include all the content required by Art. 14 of the Regulation and did not even refer to another, more detailed privacy notice.” 

The Data Controller thus outlined the corrective measures adopted to address the issues identified by the Authority. Specifically: it ceased using the contacts collected by Apollo; suspended all sending of promotional communications based on legitimate interest; and committed to conducting marketing activities only with the prior consent of the data subjects; it began preparing comprehensive and up-to-date privacy notices, drafting the record of processing activities, and establishing procedures for a prior assessment of database providers, including checks such as the provider’s location, the presence of an EU representative, privacy notices, and the necessary consents.

3. THE AUTHORITY’S ASSESSMENTS

As a preliminary matter, it should be noted that anyone who, in proceedings before the Data Protection Authority, falsely declares or attests to facts or circumstances, or produces false documents or records, is criminally liable pursuant to Art. 168 of the Code.

On the merits, following the conclusion of the preliminary investigation and after evaluating the arguments put forward by the Company, it is considered that these arguments are not sufficient to exclude the Company’s accountability.

First, it should be noted that, even though the Data Controller initially believed that the contacts acquired were exclusively of a business/professional nature—since they pertained to individuals acting within the scope of their enterprise or professional activities—it is readily apparent from the type of data collected (first name, last name, business email address, phone number, and the data subject’s position/role within the target company), it is readily apparent that the use of the data in a business context does not preclude its classification as “personal data” pursuant to Art. 4(1) of the Regulation. Such data is uncontroversially, as acknowledged by the Data Controller in its defense brief, information concerning identified or identifiable natural persons. 

Furthermore, in this specific case, promotional activities carried out through electronic communication channels (such as sending text messages or emails, but also making phone calls) is subject to the special provisions set forth in Directive 2002/58/EC, transposed into Italian law by Title X of the Code. In particular, pursuant to this legislation, the protected party is not the natural person who may qualify as a “data subject,” but rather the “contracting party” or “User,” as defined, respectively, in Art. 121, paragraph 1-bis, letter f) and (g) of the Code as: “any natural person, legal entity, body, or association that is a party to a contract with a provider of publicly available electronic communications services for the provision of such services, or otherwise a recipient of such services via prepaid cards” and “any natural person who uses a publicly available electronic communications service, for private or commercial purposes, without necessarily being a subscriber.” Thus, the “business” or “professional” nature of the information processed would not, in any case, have been sufficient to fall outside the scope of application of the special legislation.

However, this point is not contested by the Data Controller; therefore, it can be confirmed that the Data Controller processed, for commercial purposes, information relevant both under the Regulation and under Title X of the Code.

The documentation on file therefore shows that the Data Controller processed personal data for commercial or marketing purposes by acquiring the contact information of the data subjects from a third party without having verified: whether prior consent had been obtained pursuant to Article 130 of the Code, and whether the third-party source had obtained valid consent for the processing of personal data for third-party marketing purposes.

Specifically, it is noted that, for a cost of $224.00, the Data Controller purchased a package of 2,500 data records—including information such as the data subject’s name, professional email address, phone number, and job title/position—which were then reused to send commercial communications.

The Data Controller maintained that it acted in good faith and relied on the guarantees offered by the Apollo platform.

While it is not possible at this time to ascertain the lawfulness of the data collection and processing carried out by that platform, it should be noted that the Data Controller has not provided or documented any evidence on the basis of which it could be considered not only that thethe original collection of data by Apollo was based on a lawful basis permitting its reuse for commercial purposes by third parties, but also that the Data Controller itself possessed the consent required by law for sending commercial communications. 

In particular, the elements on which the Data Controller claims to have relied are, on the one hand, extremely general—such as the alleged and abstract declaration of compliance with the Regulation—and, on the other hand, irrelevant and insufficient to demonstrate the conditions for the proper reuse of the data. In this regard, both the reference to the “EU-U.S. Data Privacy Framework” and the certifications and attestations regarding information security pertain to aspects other than the lawfulness of processing, are limited to specific areas, and are in any case insufficient to prove essential elements such as the source of the data, the proper notification of data subjects, and the obtaining of their prior consent.

The Data Controller has acknowledged that Italian law requires prior consent for sending promotional communications via eemail and telephone, but has also argued that relying on a legitimate interest appeared adequate given the B2B nature of the campaigns, based on Apollo’s stated—though not documented—compliance with the Regulation, as well as on other factors such as: a privacy notice that, while incomplete, was nonetheless deemed clear; the provision of an opt-out mechanism; the use of “mere” identification and contact data; and the absence of aggressive or mass campaigns.

These elements are not sufficient to rule out the existence of unlawful conduct. This is because, as the Data Controller itself admitted, promotional activities carried out through electronic communication channels (such as sending text messages or making phone calls) are subject to the aforementioned special provisions set forth in Directive 2002/58/EC and, in particular, Art. 130 of the Code.

Paragraphs 1 and 2 of Art 130 of the Code provide that the sending of automated communications is permitted only with the consent of the contracting party or User, and an exception may be granted only if the email address—and only the email address — has been provided by the data subject in the context of a sale of similar goods or services (Art. 130, paragraph 4, of the Code). 

Similar considerations apply to marketing activities conducted via telephone (telemarketing), which may be carried out only on the basis of appropriate consent or—as the sole permitted exception—by using telephone numbers listed in telephone directories and not registered in the Public Opt-Out Registry (Article 130, paragraph 3-bis, of the Code). 

It follows that, in the absence of consent from the contracting party or User, promotional communications may not be sent even if the personal data are obtained from public records, directories, websites, digital platforms, or records or documents known or accessible to anyone (see, in this regard, the Guidelines on Promotional Activities and Combating Spam, July 4, 2013, adopted by Provision No. 330, Web Doc. No. 2542348). 

Furthermore, relying on contractual and/or formal guarantees offered by third-party providers of lists and contact information does not, in accordance with the principle of accountability (Art. 5, para. 2 of the Regulation), relieve the controller of the need to exercise due diligence regarding the data acquired or the lawfulness of the contacts provided, as well as to verify whether the acquired contacts are listed in the Public Opt-Out Registry (“RPO”). In this regard, it should be noted that verification in the aforementioned RPO must be considered a prerequisite for conducting telemarketing activities properly, and failure to consult the RPO will inevitably result in the inability to launch any promotional campaign that involves the use of the telephone.

Monitoring the data chain in the conduct of promotional activities is the area where the controller is required to devote the greatest effort, as this is one of the most vulnerable aspects of data processing in marketing activities.

The documentation on file does not indicate that the Data Controller carried out any checks on the reusability of the collected data or on the data collection chain from which it was obtained. 

At the same time, given a clear and well-established regulatory framework—including under the Code in effect prior to the Regulation’s entry into force—as well as the availability of guidelines and numerous clarifications, even in mainstream media and communications, regarding the lawfulness of conducting promotional activities pursuant to Art. 130 of the Code, simply relying on an online platform’s mere declaration of compliance with the Regulation cannot be considered a relevant basis for reliance that meets the level of professional diligence required of an operator active in the online marketing sector.

The Data Controller itself has, moreover, acknowledged that it should have exercised its own independent duty of oversight more effectively.

Therefore, the error committed by the Data Controller is not sufficient to negate its accountability, at least on the grounds of negligence. According to case law, in fact, the defense of good faith referred to in Art. 3 of Law No. 689 of 1981, serves as a basis for excluding administrative accountability only if there are positive elements sufficient to lead the violator to believe that their conduct was lawful, and it is shown that the violator did everything possible to comply with the law, such that no blame can be attributed to them. In this regard, see Civil Cassation, Section II, November 29, 2023, No. 33121, which held that, with respect to administrative violations, since, pursuant to Article 3 of Law No. 689 of 1981, simple negligence is sufficient to establish the subjective element of the offense, a mistake regarding the lawfulness of the relevant conduct—commonly referred to as “good faith”—can serve to exclude administrative accountability only when it is unavoidable, requiring, for this purpose, a positive factor—unrelated to the perpetrator of the violation—capable of giving rise to the conviction of the aforementioned lawfulness, in addition to the condition that the perpetrator has done everything possible to comply with the law and that no blame can be attached to him or her, so that the error was blameless—that is, not something the data subject could have prevented through ordinary diligence (see, among others, Civil Cassation, Section II, June 11, 2007, No. 13610).

In the present case, on the one hand, the provisions set forth in the relevant regulatory framework—and, in particular, the plain language of Article 130 of the Code, clearly highlight the need for prior consent from the recipients of commercial communications; on the other hand, there is no evidence that the Data Controller took any action or conducted a critical assessment of the contractual and documentary representations provided by the platform from which the data was obtained. It follows that there is insufficient evidence to conclude that the Data Controller did everything possible to comply with the legal requirement.

Given the foregoing, it can be established that in at least one case—the one reported—the Data Controller sent a commercial communication to the complainant without the consent required by law. 

Furthermore, from another perspective and in more general terms, one cannot fail to take into account the fact that the inherent seriousness of the conduct is amplified by the specific source of the data. The Authority is, in fact, observing an increase in services offered by digital platforms that, in exchange for payment, make personal data available (in particular contact information such as phone numbers and email addresses), without providing adequate and substantial guarantees or documentation regarding the lawfulness of the collection, subsequent processing operations, and, in particular, the transfer and potential for further processing of such data by the purchasers. 

The purchasers, in turn, uncritically rely on the merely formal assurances of regulatory compliance offered by these digital platforms, sometimes relying solely on the platforms’ reputation in the sector or on the semblance of professionalism with which they present their services. This results in them being directly liable for any violations of the Regulation’s provisions—violations that cannot be excused on the grounds of alleged “good faith” and, indeed, are indicative of a lack of adequate professional diligence—as well as posing concrete risks to the fundamental rights and freedoms of the data subjects.

Therefore, a violation of the principles of lawfulness and fairness set forth in Article 5(1)(a) of the Regulation and Article 130, paragraphs 2, 3, and 3-bis of the Code must be deemed to have occurred. Sending Commercial Communications Without Prior Notice

The documentation on file also shows that the Data Controller purchased an “information package” containing a total of 2,500 contacts, which were reused for commercial purposes by sending the data subjects brief information regarding the characteristics of the processing being carried out.

With regard to the obligations to provide information, Art 5(1)(a) of the Regulation stipulates that personal data must be processed fairly and with transparency in relation to the data subject (principle of fairness and transparency) and, more specifically, with regard to the information to be provided when the data has not been obtained from the data subject, Art 14 of the Regulation stipulates that the controller must provide the data subject with all the information referred to in paragraphs 1 and 2 (including, for example, the data storage period, the possibility of exercising the rights referred to in Articles 15–22 of the Regulation, and the right to lodge a complaint with the supervisory authority). This information regarding the processing must be provided to the data subject within a reasonable period of time after the data is obtained, no later than one month, or, if the data is intended for communication with the data subject, no later than the time of the first communication to the data subject (Art. 14, para. 3, Reg.). 

In the case at hand, and with regard to the reporting party—as also acknowledged by the Data Controller—it appears that the reporting party provided brief information in the footer of the communication sent. However, in the absence of, at the very least, a reference to a comprehensive privacy notice containing all the elements required by law, it cannot be concluded that the information provided complied with the requirements set forth in Art. 14 of the Regulation.

It must therefore be concluded that inadequate information was provided regarding the processing activities in progress and, consequently, that there was a violation of the principle of transparency set forth in Articles 5(1)(a) and 14 of the Regulation.

4. CONCLUSIONS

Based on the foregoing, the unlawfulness of the processing operations under review is deemed established, as is the accountability of the sole proprietorship Francesco Gagliardi, with registered office at XX, with respect to the following violations:

a) Article 5(1)(a) of the Regulation and Article 130, paragraphs 2, 3, and 3-bis of the Code, as the Data Controller processed personal data for commercial purposes without the prior consent required by law. With regard to such processing, pursuant to Article 58(2)(f) and (g) of the Regulation, it is necessary to prohibit the processing of personal data and, consequently, to order the erasure of the data, except for those necessary for other lawful processing activities. It is also necessary to impose a monetary penalty under the terms set forth below;

b) Articles 5(1)(a) and 14 of the Regulation, as the Data Controller collected personal data from third parties and processed such data without providing adequate information. Although this violation is recognized, the nature of the violation and the Data Controller’s commitment to providing comprehensive privacy notices, broken down by channel and type of processing (DEM, telemarketing) make it possible to waive the imposition of an administrative fine, as the requirements of necessity, proportionality, and deterrence for such a measure are not met. It is therefore deemed appropriate, with regard to the inadequate information provided to data subjects, to issue a warning to the controller pursuant to Article 58, para 2, subparagraph b) of the Regulation, and to order, pursuant to Art 58, para 2, subparagraph d) of the Regulation, that the controller bring the processing operations into compliance with the relevant provisions.

5. ORDER IMPOSING AN ADMINISTRATIVE FINE

Based on the foregoing, various provisions of the Regulation have been violated, specifically Articles 5, para 1, subparagraph (a), and 14 of the Regulation, and Article 130, paragraphs 2, 3, and 3-bis of the Code, in relation to processing activities carried out by the sole proprietorship Francesco Gagliardi, with registered office at XX.

With regard to the violation of Article 5, para. 1, subparagraph a) of the Regulation and Article 130, paragraphs 2, 3, and 3-bis of the Code, an injunction must be issued pursuant to Articles 166, paragraph 7 of the Code and Article 18 of Law No. 689/1981. Consequently, Article 83, para 3, of the Regulation must be applied, pursuant to which, if, in relation to the same processing operation or related processing operations, a controller violates, intentionally or through negligence, various provisions of the Regulation, the total amount of the administrative fine shall not exceed the amount specified for the most serious violation, with the result that only the fine provided for in Article 83, para 5, of the Regulation shall be imposed.

For the purposes of determining the amount of the administrative fine, the aforementioned Art 83(5), in setting the maximum penalty at 20 million euros or, for enterprises, 4% of the annual worldwide turnover of the preceding fiscal year, whichever is higher, specifies the methods for determining the aforementioned fine, which must “in any event [be] effective, proportionate, and dissuasive” (Article 83(1) of the Regulation), identifying, for this purpose, a series of factors—listed in para 2—to be assessed when determining the relevant amount.

In determining the amount of the fine, the factors set forth in Article 83(2) of the Regulation must be taken into account.

In the case at hand, the following factors are relevant:

a) the gravity of the violations (Article 83(2), subparagraph (a) of the Regulation), taking into account the subject matter and processing purposes, which relate to marketing activities carried out without a valid degree of lawfulness, as well as the fact that the conduct was repeated with respect to hundreds of data subjects;

b) as an aggravating factor, the grossly negligent nature of the Data Controller’s conduct (Art. 83(2), para. subparagraph (b) of the Regulation), which, despite the fact that the rules governing commercial communications remained unchanged after the Regulation entered into force and have been the subject of guidelines and clarifications since 2013, failed to take the necessary measures to ensure the fairness and lawfulness of the processing carried out, and further failed to subject the documentation provided by the platform from which the data were collected to adequate scrutiny in order to verify the lawfulness of the collection; 

(c) as a mitigating factor, the fact that the Data Controller has not previously been a recipient of a corrective or punitive measure by the Data Protection Authority (Article 83(2)(e) of the Regulation);

d) as a mitigating factor, the cooperation with the supervisory authority to remedy the violation and the corrective measures adopted, which also manifested itself in the full acknowledgment of the allegations made (Article 83(2)(f) of the Regulation);

e) as a mitigating factor, the fact that the processing did not involve special categories of personal data or data relating to criminal convictions and offenses (Article 83(2)(g) of the Regulation);

f) as a mitigating factor, the small economic scale of the Data Controller, as well as the amount of its revenue (Art. 83(2)(k) of the Regulation).

Based on all of the above factors and the principles of effectiveness, proportionality, and dissuasiveness set forth in Art. 83, para 1, of the Regulation, and taking into account the necessary balance between the data subject rights and the freedom of enterprise—including to limit the economic impact of the penalty on the Company’s organizational and operational needs—it is deemed appropriate to set the monetary penalty at a minimum threshold; therefore, that the administrative penalty of 1,500 (one thousand five hundred/00) euros should be imposed, equal to 0.01% of the maximum statutory amount. 

In the case at hand, it is deemed that the ancillary sanction of publishing this injunction on the Data Protection Authority’s website, as provided for in Art. 166, paragraph 7, of the Code and Art. 16 of the Data Protection Authority’s Regulation No. 1/2019, should also be applied, given the particularly reprehensible nature of the conduct in question, which is linked to the severity of the violations—involving the core principles of the relevant legislation—with regard to the conduct of marketing activities targeting a large number of data subjects as well as the specific source of the personal data being processed.

Finally, the conditions set forth in Art. 17 of Regulation No. 1/2019 regarding internal procedures with external relevance, aimed at carrying out the tasks and exercising the powers entrusted to the Data Protection Authority, are met.

NOW THEREFORE, THE DATA PROTECTION AUTHORITY

a) pursuant to Article 57(1)(a) of the Regulation, declares unlawful, under the terms set forth in the reasoning, the processing carried out by the sole proprietorship Francesco Gagliardi, with registered office at XX, in its capacity as controller;

b) issues a warning, pursuant to Article 58(2)(b) of the Regulation, for the violation of Articles 5(1)(a) and 14 of the Regulation;

c) orders, pursuant to Article 58(2)(d) of the Regulation, that the processing be brought into compliance with the provisions regarding the proper provision of information to data subjects;

d) imposes, pursuant to Article 58(2)(f) of the Regulation, a prohibition on the processing of personal data processed without valid consent and information;

e) orders, pursuant to Article 58(2)(g) of the Regulation, the erasure of such data, without prejudice to data necessary for other lawful processing activities;

ORDERS

the sole proprietorship Francesco Gagliardi, with registered office at XX, in its capacity as controller, to pay the sum of 1,500 (one thousand five hundred/00) euros as an administrative fine for the violation of Article 5, para 1, subparagraph (a) of the Regulation and Article 130, paragraphs 2, 3, and 3-bis of the Code, noting that the offender, pursuant to Article 166, paragraph 8, of the Code, has the right to settle the dispute within thirty days by complying with the requirements imposed (the completion of which must be notified to the Authority within the same period) and by paying an amount equal to half of the penalty imposed.

ORDERS

the aforementioned Company, in the event of failure to settle the dispute pursuant to Article 166, paragraph 8, of the Code, to pay the sum of 1,500 euros (one thousand five hundred/00), in accordance with the procedures set forth in the attachment, within 30 days of the service of this order, failing which the Authority will take the necessary enforcement measures pursuant to Art. 27 of Law No. 689/1981.

a) the publication of this order on its institutional website, pursuant to Articles 154-bis, paragraph 3, of the Code and Article 37 of Regulation No. 1/2019, as well as the imposition of the ancillary penalty of publishing this injunction on the Data Protection Authority’s website, as provided for in Article 166, paragraph 7, of the Code and Article 16 of the Authority’s Regulation No. 1/2019;

b) the recording of this order in the Authority’s internal register—as required by Article 57, para 1, subparagraph (u), of the Regulation, as well as by Article 17 of the Authority’s Regulation No. 1/2019 concerning internal procedures with external relevance, aimed at carrying out the tasks and exercising the powers entrusted to the Data Protection Authority—regarding violations and the measures adopted in accordance with Art. 58, para. 2, of the Regulation itself.

Pursuant to Article 78 of the Regulation, as well as Article 152 of the Code and Article 10 of Legislative Decree No. 150 of September 1, 2011, an appeal against this decision may be filed with thethe ordinary courts by filing an appeal with the ordinary court of the place where the controller is domiciled or, alternatively, with the court of the place of residence of the data subject, within thirty days from the date of notification of the decision or within sixty days if the appellant resides abroad.

Rome, May 14, 2026

THE PRESIDENT
Stanzione

THE RAPPORTEUR
Stanzione

THE SECRETARY GENERAL
Montuori