2 million euros fine for telemarketing and teleselling companies: they failed to provide an adequate privacy statement and for an unlawful processing of data for marketing purposes.

​The Data Protection Authority, by decision of April 11, 2019, issued an injunction to pay an administrative fine of 2 million and 18 thousand euros for Vincall S.r.l.s, an Italian company that carries out telemarketing and teleselling activities through call centers on behalf of several clients. 

The investigations have begun thanks to the reports of some data subjects carried out by the Guardia di Finanza through inspections. Vincall had appointed Tele IT, an Albanian company, to contact potential customers by telephone to sign energy supply contracts on behalf of Edison Energia s.p.A. using numbers collected by the Albanian company itself.

If the potential customer wished to sign the contract, the data collected were included in Edison Energia's management system and forwarded to Vincall. In order to proceed with contract definition process, Vincall was in charge of the compilation and signing of the contract on behalf the customer, contacting him only by telephone to request confirmation regarding service purchase confirmation. Vincall then forwarded the signed contract directly to Edison Energia.

At the end of the inspection, the Data Protection Authority held that Vincall, as Data controller, should have ensured that the data subjects should have received adequate privacy statement , that they should have given their consent for personal data processing, and that they should had formally agreed to proceed with the conclusion of the energy supply contract.

For these reasons, the Authority fined Vincall for an amount of 468,000 euros because they fail in providing the adequate information regarding data processing activities (pursuant to Articles 13 and 161 of the old Privacy Code) plus another fine for an amount of 1.5 million euros for an unlawful processing of personal data without appropriate request of consent regarding data processing for marketing purposes (pursuant to Articles 23 and 162, Section 2-bis, of the old Code).