ITALY Law and Practice Contributed by: Paolo Balboni, Luca Bolognini, Nicolò Maria Salvi and Davide Baldini, ICT Legal Consulting
4. Sectoral Topics 4.1 Use of Cookies
subject has been adequately informed and does not refuse such use, either initially or on the occasion of subsequent communications. With specific regard to telephone marketing activities, Article 130 (3-bis) provides that data controllers may lawfully contact all users who have not objected to receiving commercial communications by telephone by registering in the Register of Opposition. In this sense, pursuant to Law No 5/2018, users may enlist in the register in order to prevent subsequent communi - cations and, at the same time, withdraw any consent previously given to the processing of their personal data for telephone marketing purposes. In fact, the data controller who intends to carry out telemarket - ing activities is required to consult the register at least every 15 days or, in any event, before the start of a new campaign. On the other hand, online marketing may consist primarily of an activity carried out through the use of profiling and advertising cookies (see 4.1 Use of Cookies ), or of behavioural advertising and target - ing activities carried out through the use of external databases (especially those of social networks). In this second case, the jurisprudence of the CJEU and the interpretation provided by the European Data Protec - tion Board (EDPB) in Guidelines 8/2020 clarify the need to carry out the activity on the basis of the prior consent of the data subject and, as a general rule, to reconstruct the privacy roles between the company and the social network as joint controllers of the pro - cessing to be regulated under Article 26 of the GDPR. 4.3 Employment Privacy Law Processing carried out in the employment context is one of the sectors to which the GDPR defers to its regulation under national law, without prejudice to cer - tain common guidelines and orientations first shared by WP29 and then by the EDPB, specifically regarding the vulnerable position of the data subject employee vis-à-vis the data controller employer (a situation that results in the presumption of the invalidity of any con - sents requested from the employee due to a lack of freedom).
In Italy, the general rule is set out by Article 122 of the Privacy Code (which transposes Directive 2002/58/ EC), under which all cookies – and other similar track - ing tools – other than those strictly necessary for the functioning of the website may be installed on the users’ devices only with their consent. In this regard, as clarified by the Guidelines adopt - ed by the Italian Supervisory Authority in 2021, it is essential that consent for the use of cookies is col - lected in compliance with the principles established by the GDPR. Accordingly, it must be preceded by a multi-layered notice (cookie banner) that provides information about the cookies and the related per - sonal data processing, and that allows the user to freely accept or refuse the use of cookies as well as to change their decision at any time. A specific consideration applies to analytical cook - ies, which may be treated as necessary cookies (and therefore not require consent) only when: • IP anonymisation features are enabled; • the use of analytical cookies is strictly limited to the production of aggregated statistics; and • they are used solely in connection with a single website or mobile application, such that they do not allow the tracking of users’ navigation across different websites or applications. 4.2 Personalised Advertising and Other Online Marketing Practices In Italy, the general rule is set out by Article 130 (1;2) of the Privacy Code (which transposes Directive 2002/58/EC), under which commercial and promo - tional communications by email, fax, telephone and similar means of communication require the prior consent of the user (natural or legal person). How - ever, Article 130 (4) provides for an exception to the requirement of consent, allowing for the processing of the email address provided by the data subject in the context of the sale of a product or a service for the purpose of sending commercial communications aimed at the direct sale of products or services similar to those already purchased, provided that the data
209 CHAMBERS.COM
Powered by FlippingBook