The new edition of the "Privacy and debt collection" handbook is online, a practical guide to guide companies specializing in debt collection, banks, financial companies, telephone or energy companies towards full respect for the fundamental rights of citizens, preventing unlawful processing or treatment that is detrimental to the dignity of the person. The document of the Italian Data Protection Authority reiterates – in line with the provisions of the GDPR – the need to balance the creditor's legitimate interest in recovering the sums owed to him and the protection of the debtor's confidentiality.

But let's see in more detail the main clarifications contained in the vademecum.

The legal basis and limits of competence of the Guarantor

The processing of personal data for debt collection purposes is lawful even without the debtor's consent, as it is based on the legitimate interest of the data controller. The Authority specifies, however, that the Authority does not have jurisdiction over disputes relating to the existence or amount of the credit, for which citizens must contact the relevant authorities (e.g., ordinary judicial authorities, Antitrust, Arera).

Illegal and lawful practices

The Authority's investigations have highlighted the persistence of invasive behaviour. In this regard, the Authority recalls that it is forbidden to exert undue pressure or communicate the state of non-compliance to third parties. Visits to the home or at work that expose the debtor's condition, pre-recorded reminder phone calls without an operator (which risk being listened to by third parties), the posting of notices of default on the door of the house or in the condominium hallway, and the sending of mail with visible external writings such as "debt collection" are unlawful.

On the other hand, it is allowed to search for the debtor (even in the workplace), as long as no reference is made to the debt. Postal communications must be in closed envelopes and without writings regarding credit recovery.

The data that the persons in charge may process

The persons in charge may process personal data, tax code, the amount of the credit and the contact details provided in the contract. But also data acquired from public databases, registers or authorized third-party sources.

Accountability and disclosure obligation

Creditors are obliged to carry out periodic checks on the work of external agencies and must provide the debtor with a clear and detailed privacy policy.