Privacy: the Milan Court on the unlawfulness of two-step marketing campaigns without consent

By decision no. 5022 published on 5 May 2017, the Milan Court entirely rejected a leading Italian telephone provider’s opposition to an Italian DPA decision, which had considered unlawful and thus had enjoined, a marketing campaign consisting of contacting around five million former customers by phone, asking their consent to successively receive marketing information.

The telephone provider had appealed the DPA decision claiming that the communication at issue could not be considered marketing activity, given that, in its opinion, this it was a mere consent request for subsequent campaigns (i.e. a two-step campaign). In addition, it had alleged to have only contacted former customers whose consent to receive advertising communications had already been obtained.

The DPA, appearing before the Court, had reaffirmed the unlawfulness of the data processing, deeming the communication at issue an effective marketing activity and arguing that this was directed, most of all, to former customers who had previously expressed their refusal or had not consented to receive marketing information.

The Court, firstly, highlighted that data processing for purposes further to those linked to the execution of the agreement of which the individual is part (in the case at issue, the telephone services agreement) requires specific and different consent under Article 24 of the Italian Privacy Code.

It also noted, on one hand, that the communication at issue was to be considered promotional although it was not directly directed at an agreement. In fact, the script, including the request for consent, had a marketing purpose, even if mediated: in that first contact the telephone provider, in fact, declared its intention to provide agreement proposals more interesting than the previous ones. This circumstance led the Judge to state that the campaign aimed at obtaining consent was to be considered “ontologically inseparable” from the marketing purpose for which it was intended.

On the other hand, the Judge granted the DPA defences, noting that most of the recipients of the campaign had refused to consent to the processing of their own data for marketing purposes. In this context, it noted that the data controller who received this refusal cannot frustrate the individual’s will on how their data will be processed by means of a two-step marketing campaign. In fact, the individual is free to change their mind about such consent, but it should be the option for the former customers to spontaneously communicate this to the provider.

In light of all the above, it follows that any consent given by former customers following the communication at issue has to be considered unlawfully granted because it has been obtained in the context of an equally unlawful procedure.

The Court therefore confirmed the appealed injunction and condemned the opponent to pay legal fees of € 7,000.