Enforcement · Italian Data Protection Authority (Garante) EN LLM context A cited markdown file you can paste into your AI assistant (ChatGPT, Claude, a RAG or project knowledge base) to ground it in this document. Contains: this document’s text, its sections with their topics, and the full text of every law provision it applies. Everything links back to its source on overview.legal — legal information, not advice.

La Prima S.r.l.: Insufficient legal basis for data processing

€5,000 Fine
La Prima S.r.l.
ITALY
Art. 5 GDPR Art. 6 GDPR Art. 24 GDPR Art. 25 GDPR
Social Media IP Address Personal Data Controllers Processing Agreement Consent Data Controller Processing
Sep 16, 2021 Source

How it connects

Related across sources

Guidance Guidelines 07/2022 on certification as a tool for transfers EDPB News Danish SA Declares Use of Google Analytics Unlawful Without Supplementary Measures Datatilsynet Guidance Guidelines 07/2020 on the concepts of controller and processor in the GDPR EDPB Case Law Data Protection Commissioner v Facebook Ireland and Maximillian Schrems CJEU Case Law HvJ EU: Privacy Shield ongeldig verklaard (Schrems II) Hof van Justitie EU Case Law Fashion ID GmbH & Co. KG v Verbraucherzentrale NRW eV CJEU

Full text

The Italian DPA (Garante) has imposed a fine of EUR 5,000 on the real estate portal La Prima S.r.l.. A data subject had filed a complaint against the controller with the DPA. She complained about receiving a contact request on Linkedin by an employee of La Prima, which aimed to offer real estate services related to a specific property owned by the data subject. The controller had obtained the information regarding the data subject's ownership of the property from an openly accessible public register. At no time had the data subject consented to such a contact request. The controller had argued during the DPA's investigation that consent for others to contact her could be inferred from the fact that she had a public profile. However, the DPA noted that the exchange of information via a social network should only allow for what is specified in the relevant terms of use. The DPA clarified that the platform is intended to enable the exchange of contact information in order to make job offers. In contrast, it is not intended that users use the platform to send messages to other users in order to sell services. Moreover, it is irrelevant whether a user profile is public or not. Consequently, the DPA concluded that the controller had processed the data unlawfully.

Industry: Real Estate

Original document at the source www.gpdp.it

Similar Content