[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fxYqF5-ymKOqJLzHD6rPaFi0zmKcrtmnQuR4WDuPbYjc":3},{"article":4,"iocs":45,"watch_terms":46,"solutions":47,"lesson":50},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":24,"category":25,"article_tags":29},"63cf5e6e-b547-4ecd-b22c-c2c80c25a0ac","Garante per la protezione dei dati personali (Italy) - 10266250","garante-per-la-protezione-dei-dati-personali-italy-10266250-c79171","← Older revision Revision as of 15:43, 18 August 2026 Line 28: Line 28: |Date_Published= |Date_Published= |Year= |Year= |Fine=15300.0 |Fine=15,300 |Currency=EUR |Currency=EUR Line 112: Line 112: }} }} The DPA imposed a €15,300.00 administrative fine on a processor after a promotional contact by the company revealed a lack of appropriate legal basis, non-compliance with their processor duties, and a restriction of data subject rights, violating Articles 5-7, 12-15, 22 and 28 GDPR. The DPA fined a company €15,300 for making unsolicited promotional contact. The DPA considered the company to be a processor even though the contractual relationship was contradictory, in violation of Article 28 GDPR. == English Summary == == English Summary == Line 118: Line 118: === Facts === === Facts === The data subject received unsolicited promotional phone calls and a email containing contractual information from Green Partner (the processor), despite the data subject's phone number being registered with the Public-Opt-Out Registry. The data subject received unsolicited promotional phone calls and a email containing contractual information from Green Partner (the processor), despite the data subject's phone number being registered with the Public-Opt-Out Registry. The processor failed to respond to the data subjects request to exercise his rights. The data subject had also sought compensation from the processor. The Processor dismissed the request with regard to its content and origin due to being subject to repeated fraudulent emails which aimed at soliciting undue payments. The processor failed to respond to the data subjects request to exercise his rights. The data subject had also sought compensation from the processor. The Processor dismissed the request with regard to its content and origin due to being subject to repeated fraudulent emails which aimed at soliciting undue payments. On 13 October 2025 the data subject submitted a complaint with the Italian DPA. On 13 October 2025 the data subject submitted a complaint with the Italian DPA. In the course of the procedure by the DPA, the Processor first denied responsibility for the promotional contact made to the data subject, the DPA found that the caller ID number was not registered in the Register of Communications and Postal Operators (‘ROC’). In the course of the procedure by the DPA, the Processor first denied responsibility for the promotional contact made to the data subject, the DPA found that the caller ID number was not registered in the Register of Communications and Postal Operators (‘ROC’). After further questions by the DPA, the Processor claimed that the phone call was a mere clerical error made by an agent of the sub-processor (Vanille Service S.r.l.s.) it had engaged in the entry of the phone number. The Processor claimed to process data on behalf of Sorgenia (the controller). After further questions by the DPA, the Processor claimed that the phone call was a mere clerical error made by an agent of the sub-processor (Vanille Service S.r.l.s.) it had engaged in the entry of the phone number. The Processor claimed to process data on behalf of Sorgenia (the controller). The Controller emphasised that the Processor was never authorised to use telemarketing to conduct sales, violating their contractual agreement. The Controller denied having any contractual relationship with the sub-processor as they never authorised the use of a sub-processor pursuant to [[Article 28 GDPR|Article 28 GDPR]]. The Controller emphasised that the Processor was never authorised to use telemarketing to conduct sales, violating their contractual agreement. The Controller denied having any contractual relationship with the sub-processor as they never authorised the use of a sub-processor pursuant to [[Article 28 GDPR]]. === Holding === The DPA identified a contradictory classification of the controller and the processor, and thus subsequent obligations. The contract presented by the Processor declared the parties as independent controllers. Nonetheless, in 2018, the Processor accepted to be a processor under [[Article 28 GDPR]]. According to the DPA, the contractual relationship was not properly understood by the Processor, and correspondingly the GDPR obligations which follow. === Holding === The DPA identified a contradictory classification of the controller and the processor, and thus subsequent obligations. The contract presented by the Processor declared the parties as independent controllers. Nonetheless, in 2018, the Processor accepted to be a processor under [[Article 28 GDPR|Article 28 GDPR]]. According to the DPA, the contractual relationship was not properly understood by the Processor, and correspondingly the GDPR obligations which follow. Firstly, the DPA held that in absence of demonstrating an appropriate legal basis, the promotional contact made by the Processor violated Articles 5, 6 and 7 GDPR. Firstly, the DPA held that in absence of demonstrating an appropriate legal basis, the promotional contact made by the Processor violated Articles 5, 6 and 7 GDPR. Furthermore, the DPA held that the failure by the Processor to adopt adequate measures to handle data subject requests concerning the exercise of their rights, and the inadequate response to the request submitted by the data subject, violated Articles 12, 13, 14, 15 and 22 GDPR. Furthermore, the DPA held that the failure by the Processor to adopt adequate measures to handle data subject requests concerning the exercise of their rights, and the inadequate response to the request submitted by the data subject, violated Articles 12, 13, 14, 15 and 22 GDPR. Lastly, the DPA found the Processor to be in violation of its processor duties in light of its appointment in 2018 under [[Article 28 GDPR|Article 28 GDPR]], as it did not diligently assess the arrangement with the Controller, and lacked the prior written authorisation for engaging a sub-processor. The DPA imposed an administrative fine of €15,300.00 on the Processor, and ordered it to adopt appropriate measures to ensure that any further engagement of sub-processors complies with the GDPR. Lastly, the DPA found the Processor to be in violation of its processor duties in light of its appointment in 2018 under [[Article 28 GDPR]], as it did not diligently assess the arrangement with the Controller, and lacked the prior written authorisation for engaging a sub-processor. The DPA imposed an administrative fine of €15,300 on the Processor, and ordered it to adopt appropriate measures to ensure that any further engagement of sub-processors complies with the GDPR. == Comment == == Comment ==","The Italian Data Protection Authority (Garante) has fined Green Partner, a data processor, €15,300 for violating GDPR. The violations stemmed from unsolicited promotional calls and emails sent to a data subject whose number was on the Public-Opt-Out Registry. The processor also failed to properly handle data subject rights requests and engaged a sub-processor without authorization, contradicting its contractual agreement with the controller.","Italian DPA fines processor €15,300 for GDPR violations related to unsolicited marketing.","https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=Garante_per_la_protezione_dei_dati_personali_(Italy)_-_10266250&diff=52723&oldid=52697","https:\u002F\u002Fgdprhub.eu\u002Fimages\u002Fe\u002Fec\u002FLogoIT.png","2026-08-18T15:43:55+00:00","2026-08-18T16:00:30.324613+00:00",7,[17,20,22],{"name":18,"type":19},"Green Partner","vendor",{"name":21,"type":19},"Vanille Service S.r.l.s.",{"name":23,"type":19},"Sorgenia","c5c77cdb-f7d7-4990-9436-c81dcbff1163",{"id":24,"icon":26,"name":27,"slug":28},null,"Policy","policy",[30,35,40],{"category":31},{"id":32,"icon":26,"name":33,"slug":34},"3f0f8451-91df-4b6c-9a73-ef3b2509b7f1","GDPR","gdpr",{"category":36},{"id":37,"icon":26,"name":38,"slug":39},"53f9c4b6-8bc6-4964-9169-d09e5cd41d72","Compliance","compliance",{"category":41},{"id":42,"icon":26,"name":43,"slug":44},"d95477d7-eb04-4fad-a2dc-be1428040ce7","Privacy Fines","privacy-fines",[],[18,21,23],{"controls":48,"vendors":49},[],[],{"slug":51,"title":52,"body":53,"framework_refs":54,"framework_notes":65},"italian-dpa-fines-processor-15300-for-unsolicited-marketing-rights-failures-and-unauthorized-sub-pro","Italian DPA Fines Processor €15,300 for Unsolicited Marketing, Rights Failures, and Unauthorized Sub-Processing","Green Partner violated GDPR by sending promotional communications to an individual registered on Italy's Public Opt-Out Registry, demonstrating a failure to screen contact lists against do-not-contact databases before launching marketing campaigns. Compounding this, the company failed to adequately respond to data subject rights requests, a fundamental GDPR obligation. Most critically, Green Partner engaged a sub-processor without authorization from the data controller, breaching both contractual terms and Article 28 GDPR, which strictly governs processor-to-sub-processor relationships. This case illustrates how GDPR liability can cascade when processors operate beyond their sanctioned boundaries and neglect core compliance controls. Organizations acting as data processors must treat their contractual and regulatory obligations as non-negotiable operational constraints, not administrative formalities.",[55,56,57,58,59,60,61,62,63,64],"GDPR Article 6 – Lawfulness of processing","GDPR Article 17 – Right to erasure","GDPR Article 21 – Right to object (including direct marketing)","GDPR Article 28 – Processor obligations and sub-processor authorization","GDPR Article 12 & 13 – Transparency and data subject rights response timelines","NIST SP 800-53 PT-5 – Privacy Notice","NIST SP 800-53 SA-9 – External Information System Services (supply chain oversight)","CIS Control 3 – Data Protection","CIS Control 14 – Security Awareness and Skills Training","ITIL Service Design – Supplier Management",{}]