DATA PROTECTION
Italian Data Protection Authority: consent to the communication of data to third parties does not cover further transfers by third parties.
Consent must be acquired for each passage of data between multiple owners and if initially issued by a customer to a company also for third party promotional activities, it cannot extend its effectiveness to subsequent transfers by such third parties to further owners. In fact, such transfers would not be supported by the necessary specific and informed consent of the interested party.
On the basis of this principle, the Italian Data Protection Authority has imposed a fine of approximately 3 million euros on Iren Mercato SpA, a company operating in the energy sector, for not having verified that all the passages of the data of the recipients of the promotions were covered by consent. Following various complaints and reports, the Italian Data Protection Authority ascertained that the company had in fact processed personal data for telemarketing activities, which it had not collected directly, but which it had acquired from other sources.
In fact, Iren had obtained lists of personal data from a limited company (S.r.l.), which in turn had acquired them, as an independent data controller, from two other companies. These latter companies had obtained the consent of potential customers for telemarketing carried out both by them and by third parties, but this consent did not also cover the passage of customer data from the S.r.l. to the Iren.
The amount of the sanction applied by the Italian Data Protection Authority was also motivated by the fact that the registry lists, lacking all the necessary consents and of which the Italian Data Protection Authority prohibited any further use for promotional purposes, concerned several million people. The Authority finally issued a warning to the company for having provided an incomplete and unsuitable representation and evidence during the investigation.
(Source: Web site garanteprivacy.it – Author and Ownership of the contents: Italian Data Protection Authority).
On the basis of this principle, the Italian Data Protection Authority has imposed a fine of approximately 3 million euros on Iren Mercato SpA, a company operating in the energy sector, for not having verified that all the passages of the data of the recipients of the promotions were covered by consent. Following various complaints and reports, the Italian Data Protection Authority ascertained that the company had in fact processed personal data for telemarketing activities, which it had not collected directly, but which it had acquired from other sources.
In fact, Iren had obtained lists of personal data from a limited company (S.r.l.), which in turn had acquired them, as an independent data controller, from two other companies. These latter companies had obtained the consent of potential customers for telemarketing carried out both by them and by third parties, but this consent did not also cover the passage of customer data from the S.r.l. to the Iren.
The amount of the sanction applied by the Italian Data Protection Authority was also motivated by the fact that the registry lists, lacking all the necessary consents and of which the Italian Data Protection Authority prohibited any further use for promotional purposes, concerned several million people. The Authority finally issued a warning to the company for having provided an incomplete and unsuitable representation and evidence during the investigation.
(Source: Web site garanteprivacy.it – Author and Ownership of the contents: Italian Data Protection Authority).
