On 22 June 2021, the Italian Data Protection Authority (DPA) announced that a month earlier, it had issued a major decision for the data sharing economy concerning the interpretation of third-party marketing consent. A company active in the energy sector (Company A) was fined EUR 3 million for unlawful data processing activities which involved the use of acquired marketing contact lists. This is not the first time that we see such a fine from the Italian DPA, among other Supervisory Authorities, underlining the importance of taking special care when dealing with such lists!

In this case, Company A had obtained lists of personal details from another company, Company B, “which in turn had acquired them, in the capacity of independent data controller, from two other companies [Companies C and D]. These latter companies [Companies C and D] had obtained the consent of potential clients for telemarketing carried out both by themselves and by third parties, but this consent did not cover the transfer of client data from [Company B to Company A]”.

This decision is particularly noteworthy because it reflects a strict interpretation of data subject consent for third-party marketing activities. More precisely, the DPA underlined that the validity of consent which is provided by an individual to an organization for third-party marketing activities cannot be extended to other data controllers as such consent would not be specific nor informed. Consent must be obtained for each communication of data from one controller to another, something which the company failed to ensure. Therefore, following several complaints, the Authority issued the sanction, which was also motivated by the significant number of individuals concerned, and ordered the company to cease any further use of the data for promotional purposes. 

In conclusion, we can appreciate that according to the interpretation of the DPA in this case, there is a need for “point-to-point” consent to be obtained from the data subject each time the data is communicated to third parties in the context of marketing activities. 

Read the decision here and the short description of the decision in the Italian DPA’s newsletter here.