g-docweb-display Portlet

Requirements Applying to the Processing of Personal Data for Marketing Purposes as Performed by Relying on Operator-Assisted Telephone Calls, Foll...

Stampa Stampa Stampa
PDF Trasforma contenuto in PDF

[doc. web n. 1791330]

Versione italiana 

Requirements Applying to the Processing of Personal Data for Marketing Purposes as Performed by Relying on Operator-Assisted Telephone Calls, Following the Creation of the Public Opt-Out Register
19 January 2011 – As published in Italy´s Official Journal no. 24 dated 31 January 2011

THE ITALIAN DATA PROTECTION AUTHORITY

Having convened today in the presence of Prof. Francesco Pizzetti, President, Mr. Giuseppe Chiaravalloti, Vice-President, Mr. Mauro Paissan and Mr. Giuseppe Fortunato, Members, and Mr. Daniele De Paoli, Secretary General;

Having regard to the Personal Data Protection Code (decree no. 196 dated 30 June 2003, hereinafter "the Code");

(…)

Having regard to Section 44(1-bis) of decree no. 207 dated 31 December 2008 as converted, with amendments, into Act no. 14 dated 27 February 2009, whereby any personal data that was contained in databases set up from public subscriber directories that had been compiled prior to 1 August 2005 could be lawfully used for promotional purposes until 31 December 2009, also by derogating from Sections 13 and 23 of the Code, exclusively by the data controller(s) that had set up the said databases prior to 1 August 2005;

(…)

Having regard to Section 20-bis of Act no. 166 dated 20 November 2009, which amended Section 130 of the Code further to allow personal data to be processed by relying on telephone calls for the purposes of sending advertising materials and/or for direct selling, or to carry out market or commercial communication surveys, subject to the data subject´s objection; whereas the said Act no. 166/2009 provided for setting up a "public opt-out register" (hereinafter, the "Register") within six months as from its entry into force, whilst "until then, the provisions adopted by the Italian data protection authority (…) shall continue to be applicable in pursuance of section 129 thereof";

Having regard to the circumstance that, in the light of the above premises, the aforementioned transitional derogation – which was due to expire on 31 December 2009 pursuant to Act no. 14/2009 – was accordingly extended "to the six months following the date of entry into force of Act no. 166/2009" (…) i.e. until 24 May 2010;

(…)

Having regard to the "Regulations on setting up and management of the public register of subscribers opting out of the use of their phone numbers for the purposes of commercial selling and/or promotions" as per Presidential Decree no. 178 dated 7 September 2010 (hereinafter, the "Regulations"), whereby implementation and operation of the Register shall have to be ensured factually within ninety days as from publication of the Regulations, i.e. by 31 January 2011, and any data subject may exercise their right to object via the telephone operator they have entered into a contract with if the latter term expires to no avail;

Whereas one may not object to the use of their telephone number for commercial sales and/or promotions by having the relevant preference recorded in the Register if the phone call is made for personal purposes and/or in order to carry out commercial activities other than the sending of advertising materials and/or direct selling and/or the performance or market or commercial communications surveys;

Whereas an "operator" is any data controller that plans to process personal data for marketing purposes by using telephones – as per the Article 1(1)c. of the Regulations;

Whereas the new provisions in question only apply to the processing of personal data contained in subscriber directories as performed by relying on operator-assisted telephone calls in order to send advertising materials, perform direct selling activities and/or carry out market surveys or promotional communications; whereas such provisions are without prejudice to the specific requirements set forth in Section 130(1) and (2) of the Code, whereby the data subject´s explicit consent is necessary with regard to electronic communications performed for marketing purposes by way of automated tools such as electronic mail, facsimile, MMS- or SMS-messaging as well as by way of automated non-operator-assisted phone calls;

(…)

Whereas the amendments made to Section 130 of the Code by Act no. 166/2009 are without prejudice to the provisions on promotional activities performed via standard (paper-based) mail, which are regulated further in accordance with the provisions laid down by the Italian DPA in a decision of 15 July 2004 concerning "alphabetical" subscribers´ directories; whereas any off-directory phone numbers such as those relating to mobile phones – which are mostly not listed in such directories – may only be used for promotional purposes with the data subject´s prior informed consent as per Sections 13 and 23 of the Code;

Whereas the Regulations apply to any subscriber "whose phone numbers are contained in subscriber directories as per Section 129 of the Code" (including mobile phone numbers, if any); whereas they apply accordingly to information contained in both alphabetical subscriber directories and business listings directories (see Article 1(1)b. of the Regulations);

Noting, accordingly, that any data subject whose data is listed in either type of subscriber directory (alphabetical and/or business) and has the respective preferences recorded in the aforementioned Register may not be contacted for the purposes mentioned in Section 7(4)b. of the Code, i.e. for sending advertising materials and/or for direct selling purposes and/or to perform market or commercial communications surveys;

Whereas the Regulations do not apply to the processing of data from sources other than publicly available subscriber directories if such data has been lawfully collected by data controllers from a data subject and/or a third party in compliance – among others – with Section 7(4)b. and Section 23 of the Code (see Article 2 of the Regulations);

Noting that any data subject that had been informed appropriately by and had given their specific consent to a specific data controller for the aforementioned purposes prior to entry into force of the new regime – whereby the data controller should be in a position to provide written proof of the said consent as per Section 23 of the Code – may be contacted by the said data controller for those purposes also if they have their preferences recorded in the Register, whilst this is without prejudice to their being empowered to subsequently object to such processing in line with Section 7 of the Code;

Noting additionally that any data subject that had objected to the processing of their data by a specific data controller for the aforementioned purposes under Section 7 of the Code, prior to entry into force of the new regime, may not be contacted by the said data controller regardless of their failing to have their preferences recorded in the Register;

Noting that this is in any case without prejudice to the prohibition against using the phone number whose processing has been barred by a data subject upon having it recorded in the Register;

Noting that Section 24(1)c. of the Code allows operators to use, without the data subject´s consent, phone numbers taken from public registers, lists, records and/or publicly available documents also for sending advertising materials and/or for direct selling and/or to carry out market or commercial communications surveys, whereby such limitations and arrangements are left unprejudiced as are laid down in laws, regulations and/or Community instruments regarding data availability and publicity;

Noting that the limitations and arrangements set forth in Section 24(1)c. of the Code include compliance with purpose limitation, whereby data should be collected and stored for specific, explicit, and legitimate purposes and used in other processing operations in a manner that is compatible with such purposes (see Section 11(1)b. of the code); noting accordingly that the processing in question may only be permitted if the relevant laws and/or regulations expressly envisage the telephone-based communications mentioned in Section 7(4)b. of the Code, or if such communications are directly instrumental to the activities performed by the data subject and the latter activities account for inclusion of the data subject´s phone number in the publicly available registers, lists, records and/or documents mentioned in Section 24 of the Code – providing no objection has been or is raised against the processing in question;

Noting that if the above conditions are not fulfilled – i.e. if the data are not taken from telephone subscriber directories or else from public registers, lists, records and publicly available documents – any data that is contained in a database set up in whatever manner, including the databases created by relying on data from telephone subscriber directories that had been compiled prior to 1 August 2005, may only be processed for the purposes mentioned in Section 7(4)b. of the Code in compliance with the general principles set forth in the Code, which means that the data subject must be informed beforehand as appropriate and his/her specific consent obtained as per Sections 13 and 23 of the Code;

Whereas under Section 143(1)b. and Section 154(1)c. of the Code it is necessary to lay down the requirements "operators" are to abide by in order to bring their processing into line with the legislation in force, by having also regard to the recently amended laws and regulations;

Whereas under Section 162(2-ter) of the Code any breach of these requirements results into imposition of an administrative sanction consisting in payment of a fine ranging from Euro thirty thousand to Euro one hundred and eighty thousand;

Whereas under Section 164-bis(2) of the Code an administrative sanction consisting in payment of a fine ranging from Euro fifty thousand to Euro three hundred thousand is applied in case several breaches are committed of one or more administrative requirements, even on separate occasions, in connection with  especially important and/or large-sized databases;

Whereas the Italian data protection Authority reserves the right to step in at a later stage in order to supplement and/or amend these requirements if this proves necessary on account of the experience gathered in the initial implementing period hereof;

Having regard to the records on file;

Having regard to the considerations by the Office as submitted by the Secretary General in pursuance of Article 15 of the Italian DPA´s Rules of Procedure no. 1/2000 dated 28 June 2000;

Acting on the report submitted by Prof. Francesco Pizzetti;

BASED ON THE ABOVE PREMISES,
THE ITALIAN DATA PROTECTION AUTHORITY

Under Section 143(1)b. and Section 154(1)c. of the Code, orders the following measures to be taken by all "operators" in their capacity as data controllers using personal data by means of operator-assisted phone calls with a view to sending advertising materials and/or for direct selling and/or in order to carry out market or commercial communication surveys:

1. Regarding phone numbers listed in subscriber directories, such measures and arrangements should be taken as are suitable for ensuring respect of the preferences expressed by data subjects

a. That had provided their specific consent to the data controller for the purposes mentioned in Section 7(4)b. of the Code prior to entry into force of the new regime, whereupon written proof of such consent shall have to kept at the Italian DPA´s disposal as per Section 23 of the Code;

b. That provide their specific consent to the data controller for the purposes mentioned in Section 7(4)b. of the Code following entry into force of the new regime, whereupon written proof of such consent shall have to kept at the Italian DPA´s disposal as per Section 23 of the Code;

c. That had objected to processing of their data by the said operators for the purposes mentioned in Section 7(4)b. of the Code prior to entry into force of the new regime;

d. That object to processing of their data by the said operators for the purposes mentioned in Section 7(4)b. of the Code following entry into force of the new regime;

2. Regarding phone numbers taken from public registers, lists, records and/or publicly available documents, the processing in question should only be performed without the data subject´s consent if the specific, relevant legislation expressly envisages telephone-based communications for the purposes mentioned in Section 7(4)b. of the Code, or if the telephone-based communications as performed for the said purposes are found to be directly instrumental to the activities carried out by the data subject – providing the latter has not objected or does not object to the processing;

3. Regarding phone numbers contained in databases set up in whatever manner – except for the cases mentioned under 1. and 2. above – the processing in question may only be performed for the purposes mentioned in Section 7(4)b. of the Code if the generally applicable principles are complied with, i.e. if the data subject is informed appropriately beforehand and his/her specific consent is obtained as per Sections 13 and 23 of the Code.

A copy of this decision shall be forwarded to the Ministry of Justice – Legislation Publishing Department in order for it to be published in the Official Journal of the Italian Republic.

Done in Rome, this 19th day of the month of January 2011

The President
Pizzetti

The Rapporteur
Pizzetti

The Secretary General
De Paoli