Newsletters and advertising emails: two different activities, according to the Italian Data Protection Authority

With decision no. 427 of 25 September, the Italian Data Protection Authority specified some important principles on the processing of personal data, clarifying some useful aspects for companies that deal with direct marketing activities.

The decision is directed at a company that sent advertising emails to users who had signed up to receive the newsletter service, without obtaining their specific and separate consent to process their personal data for marketing purposes. The company only asked the subscribers to fill in an online form to register and to provide generic consent for the data process, presented as necessary to receive the newsletter service. For this reason, not only have the two different uses of the data (one for information and one for marketing) not been required separately, but giving consent to both forms of communication was a necessary condition for users to benefit from the service.

According to the Authority, this behaviour infringes the rules of the Data Protection Code, which requires the informed, conscious and free consent of the data subject. This is essential, especially when an automated communication system is involved, like in the case of promotional emails (Art. 130 of the Personal Data Protection Code).

According to the Authority’s interpretation, all the additional processes offered by the company to the actual or potential client—for example, advertising communications, user profiling, the transmission of data to third parties (and, in general, all kinds of processes that go beyond the primary service offered)—must be specified at the moment of registration. The user also needs the option to decide whether or not to give their consent to each of them. In a few words, the user has to be able to access the information service offered without necessarily consenting to the transmission of advertising messages to their email account.

Therefore, the Authority banned the subject company from using the collected personal data to send advertising ema ils to its clients and, if the company wants to continue its advertising activity using email, the Authority required that it modify the online registration form making it possible for users to express prior “ad hoc” consent to receive advertising emails. The company might also now be fined for the offence committed.