Italian SME Fined for Unlawful B2B Marketing Using Purchased Contact Data
Ditta individuale Francesco Gagliardi was fined €1,500 by Italy's Garante after sending unsolicited marketing emails to approximately 2,500 contacts sourced from Apollo.io, incorrectly relying on 'legitimate interest' as the legal basis under GDPR. The Garante ruled that direct marketing communications require explicit consent, not merely a claimed legitimate interest, violating GDPR Articles 5(1)(a) and 14 as well as Italy's ePrivacy implementing legislation. This case highlights how even small businesses are subject to GDPR enforcement and that purchasing third-party contact lists does not transfer lawful processing rights. Misunderstanding the legal bases for marketing is a common and costly compliance error, particularly for organisations without dedicated legal or privacy counsel.
Tactical Insight
Immediate actions
- Audit all active marketing campaigns to verify a valid, documented legal basis (consent or legitimate interest with a proper balancing test) exists for every contact list in use.
- Cease use of any purchased or third-party contact datasets until their provenance and compliance with GDPR lawful-basis requirements have been independently verified.
Long-term improvements
- Implement a formal data-acquisition policy requiring privacy and legal review before purchasing or ingesting any external contact database.
- Train marketing and sales staff on the distinction between consent and legitimate interest, including when each applies under GDPR and the ePrivacy Directive.
- Establish a consent management and records-of-processing inventory so that the legal basis for every marketing list is documented and auditable at all times.
Compliance & governance measures
- Conduct an annual GDPR compliance review covering all marketing channels, legal bases, and third-party data suppliers.
- Include contractual GDPR compliance obligations and data-provenance warranties in any agreement with data brokers or contact-list vendors.