Cybersecurity Policy Report, Sky Italia Fined Over Telemarketing Violations, (Dec 9, 2024)
The Italian privacy authority, Garante, has sanctioned Sky Italia Srl, a provider of satellite TV service, after finding numerous violations of the European Union’s General Data Protection Regulation (GDPR) in the company’s telemarketing activities and commercial communications. Garante imposed a fine of 842,062 euros ($888,207) and ordered Sky Italia to take specific steps to ensure its marketing activities were conducted lawfully.
Garante intervened after receiving 275 reports between April 2022 and March 2023 and found Sky Italia carried out telephone and SMS marketing activities in the absence of adequate checks on the obligations regarding information and consent. Sky Italia also failed to consult Italy’s do-not-call registry before each promotional campaign, Garante said. Garante found Sky Italia contacted some users based on consent acquired long ago—in some cases, before the GDPR came into full effect—without verifying whether the consent was still valid in light of the changed regulatory framework.
Documentation of consents Sky Italia acquired from third parties appeared unsuitable to unequivocally demonstrate the will of the interested parties, as the consent data was stored in editable Excel files, Garante noted. In violation of the GDPR, Sky Italia considered valid consents that were limited to the distinct purposes of marketing and communication of data to third parties for promotional activities or that were provided by users of Sky Italia’s “NOW TV!” service automatically upon registration and as a condition to use of the service.
Garante, in addition to imposing a fine, ordered Sky Italia to verify the lawfulness of its marketing activities with respect to consumer consents and to adopt measures to contextualize interested parties’ desire to receive promotional telephone calls, recording in its systems the methods and times of acquisition of personal data.
In the absence of specific consent from interested parties, Garante prohibited any further processing of consumers’ personal data for promotional purposes, emphasizing that having an account for an on-demand platform does not equate to express consent to receive promotional communications.
News: InternationalLegislation DataPrivacy