Diritti interna

Doveri interna

ricerca avanzata

Measures Imposed on the Controllers of Databases Set up from Telephone Subscriber Directories Compiled Prior to 1 August 2005 Following the Deroga...

[doc. web n. 1613568]
versione italiana

Measures Imposed on the Controllers of Databases Set up from Telephone Subscriber Directories Compiled Prior to 1 August 2005 Following the Derogations Introduced by Section 44 of Decree no. 207/2008 – 12 March 2009
(As published in Italy´s Official Journal no. 66 dated 20 March 2009)

THE ITALIAN DATA PROTECTION AUTHORITY

Having convened today in the presence of Prof. Francesco Pizzetti, President, Mr. Giuseppe Chiaravalloti, Vice-President, Mr. Mauro Paissan and Mr. Giuseppe Fortunato, Members, and Mr. Filippo Patroni Griffi, Secretary General;

Having regard to the personal data protection Code (legislative decree no. 196 dated 30 June 2003, hereinafter the "Code");

Having regard to section 129(2) of the Code, whereby telephone subscriber directories, whatever their features, shall be only intended "to allow searching the contact details of a subscriber" in pursuance of Community law, in particular directive 2002/58/EC;

Whereas the above provision reiterates that the data included in such directories may be processed lawfully for further purposes, including advertising, promotional and/or commercial purposes, exclusively with the data subjects´ informed, free, and specific consent, which must be documented in writing;

Having regard to the decision dated 15 July 2004 (web doc. No. 1032381), whereby the Italian DPA set forth the mechanisms to include and use the personal data related to both subscribers and purchasers of pre-paid cards into universal service "alphabetical" directories, whatever their format, by having regard to the various purposes mentioned above and taking also account of information obligations;

Having regard to the decision dated 14 July 2004 (web doc. No. 1151640), whereby the Italian DPA set forth simplified procedures to compile and use the so-called "yellow pages" (business listings);

Noting that the legislation on personal data protection allows using certain data categories for promotional, advertising and/or commercial purposes, with particular regard to a. the data contained in so-called "alphabetical" listings, which may be used with the data subjects´ consent (decision dated 15 July 2004 above); b. the data contained in "business" listings (decision dated 14 July 2004 above); and c. the data that are contained in databases created also from telephone subscriber directories compiled prior to 1 August 2005, on condition the data controller can prove that he had actually provided data subjects with the information required under section 13 of the Code;

Noting that section 130 of the Code is left unprejudiced as for the promotional activities performed via automated calling systems without human intervention, which still require the data subject´s express consent;

Having regard to section 44(1-bis) of decree no. 207 dated 30 December 2008 as converted, with amendments, into Act no. 14 dated 27 February 2009 (published in the Official Journal no. 28L dated 28 February 2009), whereby the personal data contained in databases created from public telephone subscriber directories compiled prior to 1 August 2009 can be used lawfully for promotional purposes until 31 December 2009, also by way of derogation from sections 13 and 23 of the Code, on condition the relevant data controllers had set up the said databases prior to 1 August 2005;

Whereas the foregoing provision introduced a temporary derogation from the general principles enshrined in the legislation in force, and the said derogation will cease accordingly to be enforceable as of 31 December 2009 without giving rise to any special regime that is also applicable thereafter;

Whereas the said derogation is conditional upon the fulfilment of two conditions – namely, that the databases were created prior to 1 August 2005 and that the data they contain are used for promotional purposes by the same data controllers as created those  databases;

Whereas the said derogation has accordingly placed purpose- and time-related constraints on the use of the databases in question, whereby promotional activities may only be carried out until 31 December 2009; whereas the personal data contained in the databases at issue may not be used for further purposes, pending validity of the derogation, and without complying with the timeframe  applying to enforceability of the said derogation;

Whereas providing information notices and obtaining data subjects´ consent during the aforementioned period in order to set up a database to be used for promotional purposes after the 31st of December 2009 goes beyond the purpose- and time-related constraints set forth in the transitional derogation referred to above;

Whereas, additionally, the information notices provided to data subjects in the aforementioned period would not make it lawful to set up a database for promotional purposes, which was the case prior to 1 August 2005;

Whereas, furthermore, the aforementioned purpose limitation applying to the transitional period entails that the data subjects´ consent, where obtained pending enforceability of the said derogation, would be irrelevant with a view to carrying out promotional activities and/or any other consent-based activities after the 31st of December, 2009;

Whereas accordingly a database might be used for promotional purposes after the 31st of December, 2009 only if it were set up in pursuance of the standard regulations, given that the transitional derogation in question will no longer apply as of the said date and – as already pointed out – it derogates transitionally from the standard legislation and does not give rise to a special regime that is also applicable after the said deadline;

Whereas additionally, based on the above premises, the personal data contained in the databases addressed by the transitional derogation in question may not be transferred to third parties on whatever grounds;

Whereas the general rules set forth in the Code are left unprejudiced as for the current use of the aforementioned databases for promotional purposes, with particular regard to the provisions on data subjects´ rights; whereas accordingly, the databases in question may not contain information related to any data subjects that have exercised their right to object to the processing of their data in pursuance of section 7 of the Code;

Considering that it is necessary to set forth the measures data controllers are required to take, under section 143(1)b. and section 154(1)c. of the Code, in order to bring their processing operations into line with the laws in force, by also taking account of recent amendments to legislation;

Taking account that, under section 162(2-ter) of the Code, failure to comply with this decision entails levying of a fine ranging from thirty thousand to one hundred and eighty thousand Euro;

Taking account additionally that, under section 164-bis of the Code, an administrative sanction consisting in payment of a fine ranging from fifty thousand to three hundred thousand Euro applies if several breaches are committed of one or more administrative provisions in connection with especially important and/or large databases, irrespective of whether the breaches in question have been committed at different times;

Taking account finally that, under section 168 of the Code, whoever declares or certifies untrue information or circumstances, or else submits forged records or documents, in connection with communications, records, documents or statements that are submitted or made, as the case may be, in a proceeding before the Garante and/or in the course of inquiries, shall be punished by imprisonment for between six months and three years, unless the offence is more serious;

Having regard to the records on file;

Having regard to the considerations made by the Office as submitted by the Secretary General in pursuance of section 15 of the Garante´s Rules of Procedure no. 1/2000 dated 28 June 2000;

Acting on the report submitted by Prof. Francesco Pizzetti;

NOW, THEREFORE, BASED ON THE ABOVE PREMISES,

Under section 143(1)b. and section 154(1)c. of the Code, orders all the controllers of databases set up from public telephone directories that had been compiled prior to 1 August 2005 to take the following measures which are necessary to bring the processing operations into line with the legislation in force, where they plan to use the said databases for promotional purposes by relying on the derogation introduced by Act no. 14 dated 27 February 2009:

a. They should provide suitable proof that the database at issue was set up prior to 1 August 2005 and keep the relevant documents at the data controller´s registered office;

b. They should directly process the personal data contained in the databases addressed by this decision, it being prohibited to transfer them to third parties on whatever grounds;

c. They should specify, for each contract they stipulate with a data subject, who the data controller is, regardless of whether the data controller acts on third parties´ behalf, and inform data subjects that they are entitled to object to the processing under section 7 of the Code;

d. They should immediately record the circumstance that a data subject objects, also by phone,  to processing of his/her personal data by the data controller (under section 7(4) of the Code), whereby this should produce effects also vis-à-vis any third party on whose behalf the data controller is acting, and they should provide the data subject in question with information identifying either the given operator or the specific operation performed;

e. They should only use the personal data contained in the databases mentioned under a. above for promotional purposes until 31 December 2009, since they may not provide information to data subjects and obtain their consent in order to use their data for promotional activities after 31 December 2009;

f. They should inform the Italian data protection authority, within fifteen days from publication of this decision in the Official Journal, that they own databases set up prior to 1 August 2005 and plan to use the said databases for promotional purposes until 31 December 2009; they should clarify whether they also process the personal data in question on third parties´ behalf.

It is ordered hereby that a copy of this decision be sent to the Publishing Office at the Ministry of Justice in order for it to be published in the Official Journal of the Italian Republic.

Done in Rome, this 12th day of March 2009

THE PRESIDENT
Pizzetti

THE RAPPORTEUR
Pizzetti

THE SECRETARY GENERAL
Patroni Griffi