Enforcement · Italian Data Protection Authority (Garante) EN LLM context A cited markdown file you can paste into your AI assistant (ChatGPT, Claude, a RAG or project knowledge base) to ground it in this document. Contains: this document’s text, its sections with their topics, and the full text of every law provision it applies. Everything links back to its source on overview.legal — legal information, not advice.

La Prima S.r.l.: Insufficient legal basis for data processing

The Italian DPA (Garante) has imposed a fine of EUR 5,000 on the real estate portal La Prima S.r.l..

€5,000 Fine
La Prima S.r.l.
ITALY
Art. 5 GDPR Art. 6 GDPR Art. 24 GDPR Art. 25 GDPR
Personal Data Controllers Consent Processing Social Media
Sep 16, 2021 Source gpdp.it

Full text 2 findings

Paragraphs carrying a topic or an applied provision show those connections inline
§

The Italian DPA (Garante) has imposed a fine of EUR 5,000 on the real estate portal La Prima S.r.l.. A data subject had filed a complaint against the controller with the DPA. She complained about receiving a contact request on Linkedin by an employee of La Prima, which aimed to offer real estate services related to a specific property owned by the data subject. The controller had obtained the information regarding the data subject's ownership of the property from an openly accessible public register. At no time had the data subject consented to such a contact request. The controller had argued during the DPA's investigation that consent for others to contact her could be inferred from the fact that she had a public profile. However, the DPA noted that the exchange of information via a social network should only allow for what is specified in the relevant terms of use. The DPA clarified that the platform is intended to enable the exchange of contact information in order to make job offers.

Social Media Personal Data Controllers
§

In contrast, it is not intended that users use the platform to send messages to other users in order to sell services. Moreover, it is irrelevant whether a user profile is public or not. Consequently, the DPA concluded that the controller had processed the data unlawfully. GDPR Articles: Art. 5 GDPR, Art. 6 GDPR, Art. 24 GDPR, Art. 25 GDPR Industry: Real Estate

Controllers Supervisory Authorities applies Art. 5Art. 6Art. 24Art. 25

How it connects

2 of 2 paragraphs apply legislation or carry a topic — see them in the full text ↓

References

Related across sources

C-645/19 Facebook Ireland Ltd and Others v Gegevensbeschermingsautoriteit In Case C-645/19, the Court of Justice of the European Union (Grand Chamber) addressed a preliminary ruling from the Brussels Court of Appeal concerning Facebook Ireland Ltd and… Grand Chamber Jun 15, 2021 Supervision Supervisory Authorities Controllers
C-654/23 Inteligo Media SA v Autoritatea Naţională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP) Het Hof van Justitie van de EU (Eerste Kamer) beantwoordt een prejudiciële vraag over de uitleg van artikel 13 van Richtlijn 2002/58/EC (ePrivacy) en de verhouding tot de GDPR,… Mar 27, 2025 Telecommunications Personal Data Marketing
C-40/17 Fashion ID GmbH & Co. KG v Verbraucherzentrale NRW eV C-40/17 (Fashion ID) Jul 29, 2019 Controllers Legitimate Interest Processors
C-210/16 Unabhängiges Landeszentrum für Datenschutz v Wirtschaftsakademie Schleswig-Holstein C-210/16 (Wirtschaftsakademie) Jun 5, 2018 IP Address Controllers Processors
C-46/23 Budapest Főváros IV. Kerület Újpest Önkormányzat Polgármesteri Hivatala v Nemzeti Adatvédelmi és Információszabadság Hatóság In a preliminary ruling requested by the Budapest High Court, the Court of Justice interpreted whether Article 58(2)(d) and (g) of the GDPR permits a national supervisory… Fifth Chamber Mar 14, 2024 Right to be Forgotten Personal Data Right to Restriction
C-311/18 Data Protection Commissioner v Facebook Ireland and Maximillian Schrems C-311/18 (Schrems II) Jul 16, 2020 Privacy Shield Processing Agreement International Transfer
Related documents