[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fnA45MLnHihiGq00DSCu5jisbtJgJhZb3Kw6C27OPuVI":3},{"article":4,"iocs":43,"watch_terms":44,"solutions":45,"lesson":104},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":20,"category":21,"article_tags":25},"2048ed1f-ca9d-441e-ad55-3a0e7ec342a8","Garante per la protezione dei dati personali (Italy) - 351\u002F2026","garante-per-la-protezione-dei-dati-personali-italy-351-2026-dc0860","Comment: forgot about the comment ← Older revision Revision as of 14:58, 28 August 2026 (4 intermediate revisions by the same user not shown) Line 110: Line 110: An individual (the data subject) filed a complaint after receiving one of said emails. An individual (the data subject) filed a complaint after receiving one of said emails. === Holding === === Holding === Overall, the DPA found violations of Articles 5(1)(a) and 14 GDPR as well as Art. 130 c.1. d. lgs. 196\u002F2003 (i.e.: the Italian implementation of Article 13 of the ePrivacy Directive). Overall, the DPA found violations of Articles 5(1)(a) and 14 GDPR as well as Art. 130 c.1. d. lgs. 196\u002F2003 (i.e.: the Italian implementation of Article 13 of the ePrivacy Directive). The DPA issued a E1,500 fine. In quantifying the fine, the DPA took into account that the controller had taken steps to fix its violations before the decision. The DPA issued a €1,500 fine. In quantifying the fine, the DPA took into account that the controller had taken steps to fix its violations before the decision. Additionally, the DPA ordered the controller to bring its processing of personal data into compliance – which included, among others, erasing the data and providing the addressees of its marketing campaign with all the information required by Article 14. Additionally, the DPA ordered the controller to bring its processing of personal data into compliance – which included, among others, erasing the data and providing the addressees of its marketing campaign with all the information required by Article 14. On the applicable legal regime ==== On the applicable legal regime ==== First, the DPA clarified that the case fell within the scope of both the GDPR and the Article 13 of the ePrivacy Directive (as well as its implementation in Italian law). First, the DPA clarified that the case fell within the scope of both the GDPR and the Article 13 of the ePrivacy Directive (as well as its implementation in Italian law Art. 130 d. lgs. 196\u002F2003. ). The DPA pointed out that the data set, which the controller bought and processed, contained at least some personal data. On these grounds, the DPA held that the case fell within the scope of the GDPR even though the controller’s campaign was B2B in nature. The DPA pointed out that the data set, which the controller bought and processed, contained at least some personal data. On these grounds, the DPA held that the case fell within the scope of the GDPR even though the controller’s campaign was B2B in nature. With regards to the ePrivacy Directive, the DPA observed that Article 13 covers marketing carried out towards subscribers or users!!! of an electronic communications network, and clarified that the notions of “subscriber” or “users” may also cover legal persons. On these grounds, the DPA held that the Article applied to the case at hand regardless of the personal or non-personal nature of the data processed. With regards to the ePrivacy Directive, the DPA observed that Article 13 covers marketing carried out towards subscribers or users The Italian implementation closely follows the wording of the Directive (''\"contraente o utente\"''). of an electronic communications network, and clarified that the notions of “subscriber” or “users” may also cover legal persons. On these grounds, the DPA held that the Article applied to the case at hand regardless of the personal or non-personal nature of the data processed. Lawfulness ==== On lawfulness ==== Article 13 of the ePrivacy Directive requires consent for sending unsolicited marketing emails. In the DPA’s view, this made it unlawful for the controller to rely on legitimate interest as its legal basis. On these grounds, the DPA held that the controller unlawfully processed personal data for marketing purposes. Article 13 of the ePrivacy Directive requires consent for sending unsolicited marketing emails. In the DPA’s view, this made it unlawful for the controller to rely on legitimate interest as its legal basis. On these grounds, the DPA held that the controller unlawfully processed personal data for marketing purposes. ==== On transparency ==== The DPA acknowledged that the controller’s marketing emails contained a privacy notice but found it to be severely lacking. On these grounds, the DPA held that the controller violated [[Article 14 GDPR]] as well as the transparency principle. Transparency ==== On the controller's accountability ==== The DPA acknowledged that the controller’s marketing emails contained a privacy notice but found it to be severely lacking. On these grounds, the DPA held that the controller violated [[Article 14 GDPR|Article 14 GDPR]] as well as the transparency principle. On the controller’s accountability In its defence, the controller pointed out that Apollo had put forward claims that its processing complied with applicable laws and that the data set it sold, could lawfully be used for marketing. The DPA, however, applied the principle of accountability ([[Article 5 GDPR|Article 5(2) GDPR]]) and concluded that the documental or contractual guarantees provided a third-party, did not exempt the controller from assessing the lawfulness of its processing and did not shield the controller from liability. In its defence, the controller pointed out that Apollo had put forward claims that its processing complied with applicable laws and that the data set it sold, could lawfully be used for marketing. The DPA, however, applied the principle of accountability ([[Article 5 GDPR|Article 5(2) GDPR]]) and concluded that the documental or contractual guarantees provided a third-party, did not exempt the controller from assessing the lawfulness of its processing and did not shield the controller from liability. == Comment == == Comment == ''Share your comments here!'' The case is a reminder that in the view of the Garante, Article 13 of the ePrivacy Directive (and its implementation in Italian legislation) may also cover marketing campaigns that do not involve the processing of personal data under the GDPR. == Further Resources == == Further Resources ==","Italy's Garante per la protezione dei dati personali (DPA) has fined a company €1,500 for violating GDPR and the ePrivacy Directive. The violations stemmed from an unsolicited marketing email campaign, where the company unlawfully relied on legitimate interest instead of consent and failed to provide adequate transparency information. The DPA clarified that the ePrivacy Directive's marketing provisions can apply even to B2B campaigns and when personal data is not processed under GDPR.","Italy's DPA fines a company €1,500 for GDPR and ePrivacy violations in B2B marketing.","https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=Garante_per_la_protezione_dei_dati_personali_(Italy)_-_351\u002F2026&diff=52825&oldid=52820","https:\u002F\u002Fgdprhub.eu\u002Fimages\u002Fe\u002Fec\u002FLogoIT.png","2026-08-28T14:58:08+00:00","2026-08-28T16:00:09.824764+00:00",7,[17],{"name":18,"type":19},"Apollo","vendor","c5c77cdb-f7d7-4990-9436-c81dcbff1163",{"id":20,"icon":22,"name":23,"slug":24},null,"Policy","policy",[26,31,36,38],{"category":27},{"id":28,"icon":22,"name":29,"slug":30},"3f0f8451-91df-4b6c-9a73-ef3b2509b7f1","GDPR","gdpr",{"category":32},{"id":33,"icon":22,"name":34,"slug":35},"53f9c4b6-8bc6-4964-9169-d09e5cd41d72","Compliance","compliance",{"category":37},{"id":20,"icon":22,"name":23,"slug":24},{"category":39},{"id":40,"icon":22,"name":41,"slug":42},"d95477d7-eb04-4fad-a2dc-be1428040ce7","Privacy Fines","privacy-fines",[],[18],{"controls":46,"vendors":103},[47,74],{"slug":48,"name":49,"problem":50,"products":51},"email-authentication","Email authentication (DMARC)","Nobody can send email that pretends to come from your domain.",[52,58,66],{"vendor_slug":53,"vendor_name":53,"vendor_logo":54,"product_slug":55,"product_name":53,"url":56,"description":57},"dmarcian","\u002Fvendor-logos\u002Fdmarcian.png","dmarcian-platform","https:\u002F\u002Fdmarcian.com\u002F","DMARC report processing and guidance for moving domains to enforcement.",{"vendor_slug":59,"vendor_name":60,"vendor_logo":61,"product_slug":62,"product_name":63,"url":64,"description":65},"red-sift","Red Sift","\u002Fvendor-logos\u002Fred-sift.png","ondmarc","Red Sift OnDMARC","https:\u002F\u002Fredsift.com\u002Fpulse-platform\u002Fondmarc","Guided DMARC deployment and monitoring, with support for BIMI and MTA-STS.",{"vendor_slug":67,"vendor_name":68,"vendor_logo":69,"product_slug":70,"product_name":71,"url":72,"description":73},"valimail","Valimail","\u002Fvendor-logos\u002Fvalimail.png","valimail-enforce","Valimail Enforce","https:\u002F\u002Fwww.valimail.com\u002Fproducts\u002Fenforce\u002F","Automated DMARC enforcement with discovery of every service that sends mail as your domain.",{"slug":75,"name":76,"problem":77,"products":78},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",[79,87,95],{"vendor_slug":80,"vendor_name":81,"vendor_logo":82,"product_slug":83,"product_name":84,"url":85,"description":86},"proofpoint","Proofpoint","\u002Fvendor-logos\u002Fproofpoint.png","core-email-protection","Proofpoint Core Email Protection","https:\u002F\u002Fwww.proofpoint.com\u002Fus\u002Fproducts\u002Femail-protection","Email filtering for phishing, malware and business email compromise.",{"vendor_slug":88,"vendor_name":89,"vendor_logo":90,"product_slug":91,"product_name":92,"url":93,"description":94},"mimecast","Mimecast","\u002Fvendor-logos\u002Fmimecast.png","mimecast-email-security","Mimecast Email Security","https:\u002F\u002Fwww.mimecast.com\u002Fproducts\u002Femail-security\u002F","Email filtering, impersonation protection and continuity.",{"vendor_slug":96,"vendor_name":97,"vendor_logo":98,"product_slug":99,"product_name":100,"url":101,"description":102},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-office-365","Microsoft Defender for Office 365","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fsiem-and-xdr\u002Fmicrosoft-defender-office-365","Protection for Exchange Online, Teams and SharePoint against phishing, malicious links and attachments.",[],{"slug":105,"title":106,"body":107,"framework_refs":108,"framework_notes":119},"italian-dpa-fines-company-for-unlawful-email-marketing-under-gdpr-and-eprivacy","Italian DPA Fines Company for Unlawful Email Marketing Under GDPR and ePrivacy","A company was fined €1,500 by Italy's Garante after conducting an unsolicited email marketing campaign that improperly relied on 'legitimate interest' as its legal basis rather than obtaining explicit consent from recipients. The DPA also found the company failed to provide adequate transparency information, a fundamental GDPR requirement. Critically, the ruling reinforced that the ePrivacy Directive's marketing rules apply to B2B communications and can be enforced even when GDPR's personal data thresholds are not fully met. This case highlights that organizations often underestimate the legal complexity of digital marketing, assuming B2B outreach is exempt from strict privacy rules. Misclassifying the legal basis for processing is a common and costly compliance failure.",[109,110,111,112,113,114,115,116,117,118],"GDPR Article 6 – Lawfulness of processing (legal basis)","GDPR Article 7 – Conditions for consent","GDPR Article 13 & 14 – Transparency and information obligations","GDPR Article 58 – Corrective powers of supervisory authorities","ePrivacy Directive 2002\u002F58\u002FEC Article 13 – Unsolicited communications","NIST Privacy Framework PR.CP-1 – Data processing policies","NIST SP 800-53 PT-2 – Authority to Process","CIS Control 3 – Data Protection","ISO\u002FIEC 27701:2019 – Privacy Information Management (PIMS)","ITIL Service Design – Compliance and legal requirements management",{}]