DATA PROTECTION | Italian DPA rules against “omnibus” consent

On 27 February 2025, the Italian Data Protection Authority (“the DPA”) issued a €300,000 fine on an energy provider for unlawful telemarketing and teleselling practices.

The investigation revealed that the company had relied on contact databases acquired from third-party data brokers, which in turn had collected personal data through their websites, to perform the unsolicited marketing calls.

Although the third-party websites included consent forms allowing data processing for third party marketing activities, the Italian DPA found that the consent mechanism was flawed. In particular, the forms did not allow users to express a granular preference regarding the types of products or services they were interested in. Instead, the consent applied broadly to a wide range of sectors — including energy, telecommunications, finance, fashion, and entertainment — without giving individuals the option to select specific categories. Furthermore, the DPA noted that several of the individuals contacted had registered with the Public Opt-Out Register (“RPO”), thereby expressing their explicit objection to receiving telemarketing calls. The Italian DPA emphasised that a general, non-specific consent cannot override a valid entry in the RPO.

Newsletter n. 106 – April 2025