[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fxYqF5-ymKOqJLzHD6rPaFi0zmKcrtmnQuR4WDuPbYjc":3},{"article":4,"iocs":46},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"full_text":11,"url":12,"image_url":13,"published_at":14,"ingested_at":15,"relevance_score":16,"entities":17,"category_id":25,"category":26,"article_tags":30},"63cf5e6e-b547-4ecd-b22c-c2c80c25a0ac","Garante per la protezione dei dati personali (Italy) - 10266250","garante-per-la-protezione-dei-dati-personali-italy-10266250-c79171","← Older revision Revision as of 15:43, 18 August 2026 Line 28: Line 28: |Date_Published= |Date_Published= |Year= |Year= |Fine=15300.0 |Fine=15,300 |Currency=EUR |Currency=EUR Line 112: Line 112: }} }} The DPA imposed a €15,300.00 administrative fine on a processor after a promotional contact by the company revealed a lack of appropriate legal basis, non-compliance with their processor duties, and a restriction of data subject rights, violating Articles 5-7, 12-15, 22 and 28 GDPR. The DPA fined a company €15,300 for making unsolicited promotional contact. The DPA considered the company to be a processor even though the contractual relationship was contradictory, in violation of Article 28 GDPR. == English Summary == == English Summary == Line 118: Line 118: === Facts === === Facts === The data subject received unsolicited promotional phone calls and a email containing contractual information from Green Partner (the processor), despite the data subject's phone number being registered with the Public-Opt-Out Registry. The data subject received unsolicited promotional phone calls and a email containing contractual information from Green Partner (the processor), despite the data subject's phone number being registered with the Public-Opt-Out Registry. The processor failed to respond to the data subjects request to exercise his rights. The data subject had also sought compensation from the processor. The Processor dismissed the request with regard to its content and origin due to being subject to repeated fraudulent emails which aimed at soliciting undue payments. The processor failed to respond to the data subjects request to exercise his rights. The data subject had also sought compensation from the processor. The Processor dismissed the request with regard to its content and origin due to being subject to repeated fraudulent emails which aimed at soliciting undue payments. On 13 October 2025 the data subject submitted a complaint with the Italian DPA. On 13 October 2025 the data subject submitted a complaint with the Italian DPA. In the course of the procedure by the DPA, the Processor first denied responsibility for the promotional contact made to the data subject, the DPA found that the caller ID number was not registered in the Register of Communications and Postal Operators (‘ROC’). In the course of the procedure by the DPA, the Processor first denied responsibility for the promotional contact made to the data subject, the DPA found that the caller ID number was not registered in the Register of Communications and Postal Operators (‘ROC’). After further questions by the DPA, the Processor claimed that the phone call was a mere clerical error made by an agent of the sub-processor (Vanille Service S.r.l.s.) it had engaged in the entry of the phone number. The Processor claimed to process data on behalf of Sorgenia (the controller). After further questions by the DPA, the Processor claimed that the phone call was a mere clerical error made by an agent of the sub-processor (Vanille Service S.r.l.s.) it had engaged in the entry of the phone number. The Processor claimed to process data on behalf of Sorgenia (the controller). The Controller emphasised that the Processor was never authorised to use telemarketing to conduct sales, violating their contractual agreement. The Controller denied having any contractual relationship with the sub-processor as they never authorised the use of a sub-processor pursuant to [[Article 28 GDPR|Article 28 GDPR]]. The Controller emphasised that the Processor was never authorised to use telemarketing to conduct sales, violating their contractual agreement. The Controller denied having any contractual relationship with the sub-processor as they never authorised the use of a sub-processor pursuant to [[Article 28 GDPR]]. === Holding === The DPA identified a contradictory classification of the controller and the processor, and thus subsequent obligations. The contract presented by the Processor declared the parties as independent controllers. Nonetheless, in 2018, the Processor accepted to be a processor under [[Article 28 GDPR]]. According to the DPA, the contractual relationship was not properly understood by the Processor, and correspondingly the GDPR obligations which follow. === Holding === The DPA identified a contradictory classification of the controller and the processor, and thus subsequent obligations. The contract presented by the Processor declared the parties as independent controllers. Nonetheless, in 2018, the Processor accepted to be a processor under [[Article 28 GDPR|Article 28 GDPR]]. According to the DPA, the contractual relationship was not properly understood by the Processor, and correspondingly the GDPR obligations which follow. Firstly, the DPA held that in absence of demonstrating an appropriate legal basis, the promotional contact made by the Processor violated Articles 5, 6 and 7 GDPR. Firstly, the DPA held that in absence of demonstrating an appropriate legal basis, the promotional contact made by the Processor violated Articles 5, 6 and 7 GDPR. Furthermore, the DPA held that the failure by the Processor to adopt adequate measures to handle data subject requests concerning the exercise of their rights, and the inadequate response to the request submitted by the data subject, violated Articles 12, 13, 14, 15 and 22 GDPR. Furthermore, the DPA held that the failure by the Processor to adopt adequate measures to handle data subject requests concerning the exercise of their rights, and the inadequate response to the request submitted by the data subject, violated Articles 12, 13, 14, 15 and 22 GDPR. Lastly, the DPA found the Processor to be in violation of its processor duties in light of its appointment in 2018 under [[Article 28 GDPR|Article 28 GDPR]], as it did not diligently assess the arrangement with the Controller, and lacked the prior written authorisation for engaging a sub-processor. The DPA imposed an administrative fine of €15,300.00 on the Processor, and ordered it to adopt appropriate measures to ensure that any further engagement of sub-processors complies with the GDPR. Lastly, the DPA found the Processor to be in violation of its processor duties in light of its appointment in 2018 under [[Article 28 GDPR]], as it did not diligently assess the arrangement with the Controller, and lacked the prior written authorisation for engaging a sub-processor. The DPA imposed an administrative fine of €15,300 on the Processor, and ordered it to adopt appropriate measures to ensure that any further engagement of sub-processors complies with the GDPR. == Comment == == Comment ==","The Italian Data Protection Authority (Garante) has fined Green Partner, a data processor, €15,300 for violating GDPR. The violations stemmed from unsolicited promotional calls and emails sent to a data subject whose number was on the Public-Opt-Out Registry. The processor also failed to properly handle data subject rights requests and engaged a sub-processor without authorization, contradicting its contractual agreement with the controller.","Italian DPA fines processor €15,300 for GDPR violations related to unsolicited marketing.","Help Garante per la protezione dei dati personali (Italy) - 10266250: Difference between revisions From GDPRhub Jump to:navigation, search VisualWikitext Revision as of 16:09, 14 August 2026 view sourceSf (talk | contribs)Bureaucrats, Interface administrators, noContributionReport, Administrators5 edits Tag: Decisions [1.0] Latest revision as of 15:43, 18 August 2026 view source Sf (talk | contribs)Bureaucrats, Interface administrators, noContributionReport, Administrators5 editsmTag: Visual edit Line 28: Line 28: |Date_Published=|Date_Published= |Year=|Year= |Fine=15300.0|Fine=15,300 |Currency=EUR|Currency=EUR Line 112: Line 112: }}}} The DPA imposed a €15,300.00 administrative fine on a processor after a promotional contact by the company revealed a lack of appropriate legal basis, non-compliance with their processor duties, and a restriction of data subject rights, violating Articles 5-7, 12-15, 22 and 28 GDPR.The DPA fined a company €15,300 for making unsolicited promotional contact. The DPA considered the company to be a processor even though the contractual relationship was contradictory, in violation of Article 28 GDPR. == English Summary ==== English Summary == Line 118: Line 118: === Facts ====== Facts === The data subject received unsolicited promotional phone calls and a email containing contractual information from Green Partner (the processor), despite the data subject's phone number being registered with the Public-Opt-Out Registry. The data subject received unsolicited promotional phone calls and a email containing contractual information from Green Partner (the processor), despite the data subject's phone number being registered with the Public-Opt-Out Registry. The processor failed to respond to the data subjects request to exercise his rights. The data subject had also sought compensation from the processor. The Processor dismissed the request with regard to its content and origin due to being subject to repeated fraudulent emails which aimed at soliciting undue payments.The processor failed to respond to the data subjects request to exercise his rights. The data subject had also sought compensation from the processor. The Processor dismissed the request with regard to its content and origin due to being subject to repeated fraudulent emails which aimed at soliciting undue payments. On 13 October 2025 the data subject submitted a complaint with the Italian DPA.On 13 October 2025 the data subject submitted a complaint with the Italian DPA. In the course of the procedure by the DPA, the Processor first denied responsibility for the promotional contact made to the data subject, the DPA found that the caller ID number was not registered in the Register of Communications and Postal Operators (‘ROC’).In the course of the procedure by the DPA, the Processor first denied responsibility for the promotional contact made to the data subject, the DPA found that the caller ID number was not registered in the Register of Communications and Postal Operators (‘ROC’). After further questions by the DPA, the Processor claimed that the phone call was a mere clerical error made by an agent of the sub-processor (Vanille Service S.r.l.s.) it had engaged in the entry of the phone number. The Processor claimed to process data on behalf of Sorgenia (the controller).After further questions by the DPA, the Processor claimed that the phone call was a mere clerical error made by an agent of the sub-processor (Vanille Service S.r.l.s.) it had engaged in the entry of the phone number. The Processor claimed to process data on behalf of Sorgenia (the controller). The Controller emphasised that the Processor was never authorised to use telemarketing to conduct sales, violating their contractual agreement. The Controller denied having any contractual relationship with the sub-processor as they never authorised the use of a sub-processor pursuant to [[Article 28 GDPR|Article 28 GDPR]]. The Controller emphasised that the Processor was never authorised to use telemarketing to conduct sales, violating their contractual agreement. The Controller denied having any contractual relationship with the sub-processor as they never authorised the use of a sub-processor pursuant to [[Article 28 GDPR]]. === Holding === The DPA identified a contradictory classification of the controller and the processor, and thus subsequent obligations. The contract presented by the Processor declared the parties as independent controllers. Nonetheless, in 2018, the Processor accepted to be a processor under [[Article 28 GDPR]]. According to the DPA, the contractual relationship was not properly understood by the Processor, and correspondingly the GDPR obligations which follow. === Holding === The DPA identified a contradictory classification of the controller and the processor, and thus subsequent obligations. The contract presented by the Processor declared the parties as independent controllers. Nonetheless, in 2018, the Processor accepted to be a processor under [[Article 28 GDPR|Article 28 GDPR]]. According to the DPA, the contractual relationship was not properly understood by the Processor, and correspondingly the GDPR obligations which follow. Firstly, the DPA held that in absence of demonstrating an appropriate legal basis, the promotional contact made by the Processor violated Articles 5, 6 and 7 GDPR. Firstly, the DPA held that in absence of demonstrating an appropriate legal basis, the promotional contact made by the Processor violated Articles 5, 6 and 7 GDPR. Furthermore, the DPA held that the failure by the Processor to adopt adequate measures to handle data subject requests concerning the exercise of their rights, and the inadequate response to the request submitted by the data subject, violated Articles 12, 13, 14, 15 and 22 GDPR.Furthermore, the DPA held that the failure by the Processor to adopt adequate measures to handle data subject requests concerning the exercise of their rights, and the inadequate response to the request submitted by the data subject, violated Articles 12, 13, 14, 15 and 22 GDPR. Lastly, the DPA found the Processor to be in violation of its processor duties in light of its appointment in 2018 under [[Article 28 GDPR|Article 28 GDPR]], as it did not diligently assess the arrangement with the Controller, and lacked the prior written authorisation for engaging a sub-processor. The DPA imposed an administrative fine of €15,300.00 on the Processor, and ordered it to adopt appropriate measures to ensure that any further engagement of sub-processors complies with the GDPR.Lastly, the DPA found the Processor to be in violation of its processor duties in light of its appointment in 2018 under [[Article 28 GDPR]], as it did not diligently assess the arrangement with the Controller, and lacked the prior written authorisation for engaging a sub-processor. The DPA imposed an administrative fine of €15,300 on the Processor, and ordered it to adopt appropriate measures to ensure that any further engagement of sub-processors complies with the GDPR. == Comment ==== Comment == Latest revision as of 15:43, 18 August 2026 Garante per la protezione dei dati personali - 10266250 Authority: Garante per la protezione dei dati personali (Italy) Jurisdiction: Italy Relevant Law: Article 5 GDPR Article 6 GDPR Article 7 GDPR Article 12 GDPR Article 13 GDPR Article 14 GDPR Article 15 GDPR Article 22 GDPR Article 28 GDPR Type: Complaint Outcome: n\u002Fa Started: Decided: Published: Fine: 15,300 EUR Parties: n\u002Fa National Case Number\u002FName: 10266250 European Case Law Identifier: n\u002Fa Appeal: n\u002Fa Original Language(s): Italian Original Source: GPDP (in IT) Initial Contributor: sf The DPA fined a company €15,300 for making unsolicited promotional contact. The DPA considered the company to be a processor even though the contractual relationship was contradictory, in violation of Article 28 GDPR. Contents 1 English Summary 1.1 Facts 1.2 Holding 2 Comment 3 Further Resources 4 English Machine Trans","https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=Garante_per_la_protezione_dei_dati_personali_(Italy)_-_10266250&diff=52723&oldid=52697","https:\u002F\u002Fgdprhub.eu\u002Fimages\u002Fe\u002Fec\u002FLogoIT.png","2026-08-18T15:43:55+00:00","2026-08-18T16:00:30.324613+00:00",7,[18,21,23],{"name":19,"type":20},"Green Partner","vendor",{"name":22,"type":20},"Vanille Service S.r.l.s.",{"name":24,"type":20},"Sorgenia","c5c77cdb-f7d7-4990-9436-c81dcbff1163",{"id":25,"icon":27,"name":28,"slug":29},null,"Policy","policy",[31,36,41],{"category":32},{"id":33,"icon":27,"name":34,"slug":35},"3f0f8451-91df-4b6c-9a73-ef3b2509b7f1","GDPR","gdpr",{"category":37},{"id":38,"icon":27,"name":39,"slug":40},"53f9c4b6-8bc6-4964-9169-d09e5cd41d72","Compliance","compliance",{"category":42},{"id":43,"icon":27,"name":44,"slug":45},"d95477d7-eb04-4fad-a2dc-be1428040ce7","Privacy Fines","privacy-fines",[]]