Introduction

The Court of Rome was recently asked to address the resolution no. 437 of October 27, 2016 ("Resolution") by the Italian Autorità Garante per la Protezione dei Dati Personali ("DPA") regarding the sending of text messages in order to gather the data subjects' consent to processing for marketing purposes.

Contrary to the DPA's position, the Court of Rome with its ruling n. 10789 of August 1, 2019 ("Court Ruling") that such an activity is not a form of marketing. Although both the Resolution and the Court Ruling are based on the pre-GDPR legal framework", i.e. the Legislative Decree no. 196 of 2003, implementing Directive 95/46/EC ("Pre-GDPR Privacy Code"), the Ruling will probably have important implications, given that the concept of direct marketing has not yet been accurately defined by the current data protection legal framework (i.e. the GDPR and the Italian Privacy Code as amended by Legislative Decree no. 101 of 2018 implementing the GDPR – "Current Privacy Code"). 

The Resolution: a restrictive interpretation of the nature of "opt-in" communications

The Resolution was issued following complaints by clients of a telecommunication company.

In particular, the clients complained of receiving an SMS inviting them to provide their consent in order to receive "EXCLUSIVE" promotions by the same phone company. The clients also complained that the receipt of the SMS occurred despite their having previously denied their consent to the processing of their personal data for promotional purposes.

As a result of the DPA's investigations, it was found that in the previous year (2015) the company had realized several campaigns (18) aimed at gathering the consent for marketing activities of both clients already present in the company's customer base and newly acquired clients.

The DPA found that the company had implemented certain organizational measures in order to ensure to data subjects the rights pursuant to the Pre-GDPR Privacy Code.
With particular reference to the right to object to the processing for marketing purposes of the Pre-GDPR Privacy Code, the DPA found that the company provided users with several communication channels, such as the customer service (e.g. call centers and in-store personnel), the company website and the possibility to send requests to the privacy department of the company.

However, despite the implementation of these measures, the DPA affirmed that the sending of such SMS messages was in violation of the Pre-GDPR Privacy Code. In particular, the company performed various processing of personal data in the absence of the necessary preliminary consent of the data subjects to the processing of their personal data for promotional purposes (with particular reference to receipt of promotional communications through text messages or further electronic channels).

Therefore, the DPA qualified the so-called "opt-in messages" ̶ i.e. the sending of text messages aimed at obtaining the consent of data subjects to carry out promotional activities and services ̶ as the performance of a direct promotional activity itself: such activity could not be carried out, if the data controller had not obtained prior consent to processing personal data for marketing purposes.

The Court Ruling: a different approach

The company appealed the Resolution, primarily contesting that, according to the DPA's reasoning, any kind of contact aimed at obtaining an update of users' preferences with regard to the processing of their personal data should be qualified as promotional activity. This would imply an absolute ban on the use of automated systems for contacting users for the purpose of updating customer databases.

The Court of Rome annulled the Resolution and established that the relevant provisions of the Pre-GDPR Privacy Code did not forbid the delivery to data subjects of opt-in messages, subject to their consent to receive future commercial offers and promotional initiatives by the company.

The Court's approach is completely different from the DPA: according to the Court the sending of text messages asking users to give their consent to receive advertising or promotional materials showed the intention of the company to fully comply with the Italian Privacy Code; the opt-in message had accordingly to be considered not as a marketing communication itself, but as a preliminary request of consent to receive future marketing communications.

The Court also said that the delivery of such text messages per se is not a promotional activity for a commercial product or service or advertising activity.

Final remarks: the main takeaways from the Ruling

Despite the present case required the Court of Rome to apply the Pre-GDPR Privacy Code, the Court interpretation of marketing activities could have an important impact on future decisions of the DPA and, generally, on the interpretation of the nature of both "opt-in communications" and "marketing communications". This is also due to the fact that the provisions of the Current Privacy Code, when regulating the processing of personal data pertaining to electronic communications, substantially mirror the Pre-GDPR Privacy Code.
Therefore, theoretically, the same interpretations and reasoning of the Rome Court still appear to be valid.

The Ruling may in principle also clarify the requirements for carrying out direct marketing activities, considering that both the GDPR and the Italian Privacy Code do not provide a clear and unambiguous definitions of "direct marketing".

The "E-privacy Regulation", which will repeal the "E-privacy Directive" (Directive 2002/58/EC) will most likely provide a clearer legal framework.
In the meantime, whilst there are no further clarification from the DPA, marketing and consent will remains one of the main concerns, also considering the potential sanctions. In this respect, see also this article.

Do you have more questions, or do you want to share your thoughts on this article? Contact our Dentons Italy TMT Team at tmtbites.italy@dentons.com, and do not forget to sign up to our TMT Bites Newsletter!

This article has been co-authored by Ilaria Boschi.

Dentons is the world's first polycentric global law firm. A top 20 firm on the Acritas 2015 Global Elite Brand Index, the Firm is committed to challenging the status quo in delivering consistent and uncompromising quality and value in new and inventive ways. Driven to provide clients a competitive edge, and connected to the communities where its clients want to do business, Dentons knows that understanding local cultures is crucial to successfully completing a deal, resolving a dispute or solving a business challenge. Now the world's largest law firm, Dentons' global team builds agile, tailored solutions to meet the local, national and global needs of private and public clients of any size in more than 125 locations serving 50-plus countries. www.dentons.com.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.