As a result of two inquiries into the data collection and usage practices of Google Ireland and Apple Distribution International Ltd, the Antitrust Authority (AGCM) has identified violations, by both of the two big tech companies, of the rules of the Consumer Code pertaining to the lack of information (Articles. 21-22) and aggressive practices (Articles 24-25). The resulting sanction of €10 million, which is the maximum amount allowed under the current legislation, was particularly strict for the companies.
Referring to the first violation, Google – a leading US company in the IT sector – failed to provide the users with the information needed to give an informed consent, to the use of their personal data, during the creation of accounts and using services. In particular, the consumer was not informed by the company that the registration and use of the services offered implies the use of his data for commercial purposes.
Additionally it was uncovered that Apple, since January 2016, does not provide any indication to users regarding their personal data collection for commercial purposes, instead simply highlighting how this activity is important to allow a better use of the services. The only reference to the commercial use of the data is made through a linking activity that leads to a page on Apple’s website. Consultation of this link is not compulsory, and the information provided was,determined by the Authority to be unclear and not exhaustive.
In relation to the second infringement, the AGCM considered that the two foreign companies had implemented aggressive practices.
Google, already in the process of account creation, preselect the user’s acceptance to the transfer of its data for commercial purposes, without any further steps. In the privacy control area, the settings for granting authorisation are already ticked, resulting in the automatic transfer of data for commercial purposes. In addition, if the consumer does not want to authorise the processing, he would have to carry out a complex and not immediate deactivation procedure.
For Apple the promotional activity is based on an ‘opt out’, a method that does not allow consumers any possibility of prior and express choice regarding the transfer of his data. In this way, the user is affected in his choice and suffers the transfer of personal information, which Apple may use for its own promotional purposes.
These latest actions of the Italian Data Protection Authority (AGCM) underline once again the great attention that the Authority turns to data protection and their lawful use.
Milan 15/12/2021