The Italian supervisory authority, the Garante per la Protezione dei Dati Personali, In a decision dated April 11, 2019, imposed a fine of more than EUR 2 million on a companywhich had carried out telemarketing measures in violation of the GDPR on behalf of an energy service provider and via a commissioned Albanian call center.
An investigation by the financial police, special department for data protection (!), had revealed that the advertising measures were carried out on the basis of address lists from the Albanian service provider, whereby no one – neither the customer (the energy company) nor its sales representative nor the telemarketing company – had checked these address lists. If the calls were successful, the call center transmitted the details of the new customers willing to sign the contract to the sales representative of the energy company. The telemarketing company then prepared the paper contracts and called the customers in question again, whereupon the customers confirmed their willingness to sign on the phone. An employee of the telemarketing company then signed the contract.
The financial police saw several violations of the GDPR in this, in particular a Violation of transparency requirements and of the Principle of legality: Since customers were not presented with the contracts, it was clear that the required information was not provided. The telemarketing company was also unable to prove that this information was transmitted by telephone were. In addition, there was a lack of Effective and documented consent in the data processing.
In the process, the telemarketing company was named Responsible because there was no clear designation and integration as a processor.
The Sizing of the buses was based on the Italian transposition law, with fines for individual violations being cumulated according to the number of customers affected. The fine was increased due to the company’s apparent disregard for data privacy:
un marcato disinteresse per la normativa in materia di protezione dei dati e una netta sottovalutazione delle gravi implicazioni che possono derivare dall’utilizzo di forme di acquisizione della clientela improntate all’informalità e alla unilaterale semplificazione degli adempimenti prescritti