Background information/scenario

Do marketing purposes need specific consent and does such consent apply even when targeting professionals and companies whose contacts are publicly available on Internet? In one of its first decisions dated 2017, the Italian Data Protection Authority  (“Garante”) restated that all data controllers must collect a freely given and specific consent in order to use personal data (i.e. e-mails, mobile numbers) for marketing purposes.

Main issue

This principle also applies to the contact details of professional and companies collected from publicly available sources (i.e. the Internet). Despite the fact that these subjects are not “data subjects” in the sense of data protection law, they still may be deemed as “contracting parties” pursuant to Section 130 of the Italian Personal Data Protection Code. As a consequence, they may not receive marketing communications without a prior consent.

Practical actions to be taken

Practical advice: data controllers must be sure that marketing departments collect a prior consent even when using the data of professionals and companies for promotional activities. “Publicly available on Internet” does not justify the use of the contact information for marketing purposes.  

Read the article in Lexology