Italian DPA Fines Processor €15,300 for Unsolicited Marketing, Rights Failures, and Unauthorized Sub-Processing
Written by AI from the linked story. Not reviewed by an editor. How this works
Green Partner violated GDPR by sending promotional communications to an individual registered on Italy's Public Opt-Out Registry, demonstrating a failure to screen contact lists against do-not-contact databases before launching marketing campaigns. Compounding this, the company failed to adequately respond to data subject rights requests, a fundamental GDPR obligation. Most critically, Green Partner engaged a sub-processor without authorization from the data controller, breaching both contractual terms and Article 28 GDPR, which strictly governs processor-to-sub-processor relationships. This case illustrates how GDPR liability can cascade when processors operate beyond their sanctioned boundaries and neglect core compliance controls. Organizations acting as data processors must treat their contractual and regulatory obligations as non-negotiable operational constraints, not administrative formalities.
Tactical Insight
Immediate actions
- Scrub all marketing contact lists against the Public Opt-Out Registry (Registro delle Opposizioni) before every campaign launch.
- Establish a formal data subject rights request (DSAR) intake and response process with tracked SLAs to ensure timely compliance.
- Audit all current sub-processors to verify each has explicit written authorization from the relevant data controller.
Long-term improvements
- Embed sub-processor approval workflows into vendor and contract management systems so no engagement can proceed without documented controller consent.
- Implement a GDPR roles and responsibilities training program specifically for staff handling marketing data and data subject requests.
- Maintain a continuously updated Record of Processing Activities (RoPA) that maps all processors, sub-processors, and their authorized purposes.
Detection & monitoring measures
- Deploy automated checks that cross-reference campaign recipient lists against opt-out registries prior to send.
- Schedule quarterly internal audits of processor-controller contracts to identify unauthorized sub-processing arrangements or scope creep.
- Log and monitor all data subject rights requests end-to-end to detect response failures before regulatory deadlines are breached.