Monthly Archives: January 2020

Italy’s First Multi-Million GDPR Sanctions

Before last week, the Italian Data Protection Authority (“DPA”) only applied one (modest) GDPR sanction, which placed Italy at the bottom of the lists of EU Countries per number and value of GDPR sanctions applied.

In addition to the great differences in numbers and figures – for example, of soon-to-leave UK (sanctions’ amounts in Euro: Italy 30k vs. UK 315mln+) or Spain (number of sanctions: Italy 1 vs. Spain 43) – it is interesting noting that, until last Friday, the most active European DPAs (UK, France, Germany, Spain) tended to target big players in the private sector (i.e. British Airways, Marriot International, Google), as opposed to Italy’s attention to websites affiliated to a political party and run through the platform named Rousseau.

Last Friday, however, a significant change in such scenario occurred. The Italian DPA issued a press release announcing two GDPR sanctions applied to Eni Gas e Luce, a fully-owned subsidiary of Italy’s State-controlled multinational oil and gas company, Eni S.p.A., for Euro 8.5 and 3 million.

The first sanction of Euro 8.5 million has been imposed for unlawful processing in connection with telemarketing and tele-selling activities. The inspections and inquiries had been carried out by the authorities as a response to several alerts and complaints that followed GDPR D-Day.

Violations included: advertising calls made without consent or despite data subjects’ refusal, absence of technical and organisational measures to take into account the instructions provided by data subjects, excessive data retention periods, obtainment of personal data of possible future customers from third parties which did not obtain consent.

The second sanction of Euro 3 million relates to unsolicited contracts for the supply of electricity and gas. Many individuals complained that they have learned about their new contracts only upon receipt of the termination letter from the previous supplier or of the first electricity bill from Eni Gas e Luce. Complaints included alleged incorrect data and false signatures.

About 7200 consumers have been affected. The Italian DPA also underlined the role of third-party contractors, acting on behalf of Eni Gas e Luce, in perpetrating the violations.

Both decisions are quite significant as, for the very first time, the Italian DPA provides its indications and illustrates its approach in dealing with data processing and violations by large-sized companies operating in the private sector, within the GDPR regulatory framework.

Clinical Trials Seminar at Gitti and Partners

On January 16 our firm Gitti and Partners will be hosting a seminar on clinical trials legislation and its related opportunities and risks. The seminar will look at drug trials and medical devices investigations from various angles, including regulatory, data processing and criminal law perspectives.

Ms. Alice Cabrio and Ms. Giulia Corti, Corporate & Compliance Managers at Roche S.p.A., will focus on the challenges of reconciling GDPR and trials.

Dr. Eleonora Ferretti will bring the perspective of the trial unit of a large public hospital that is also a research center.

Ms. Elisa Tacconi and Ms. Elisa Corleto of Medtronic Italia S.p.A. will dive into real world evidence and will explore the limits of trials’ regulations.

Our Fabrizio Sardella and Ms. Castagno and Mr. Stigliano of Orrick will highlight criminal risks linked to clinical trials.

The seminar promises to be very interesting and you are welcome to join us.

The full program can be found here: http://grplex.com/en/conferences/download/765/clinical-trials–risks-and-opportunities-in-a-new-regulatory-environment