ITALY Trends and Developments Contributed by: Paolo Balboni, Luca Bolognini, Davide Baldini and Nicolò Maria Salvi, ICT Legal Consulting
followed multiple complaints from individuals who reported receiving unsolicited promotional or com - mercial telephone calls allegedly made using contact details obtained through Lusha’s services. According to the GPDP, preliminary information suggested that Lusha was selling contact details, including telephone numbers, some of which appeared to be of uncertain or problematic origin in light of the GDPR. The author - ity also highlighted that Lusha’s database included data relating to Italian residents, and that the platform was being used by companies to carry out marketing activities targeting individuals in Italy. In light of the above, the GPDP issued a formal request for information to Lusha, requiring the company to respond within 20 days from receipt thereof. The request was broad in scope and aimed at clarifying the fundamental aspects of Lusha’s data processing activities in so far as they affect individuals in Italy. In particular, the authority asked Lusha to provide: • details on the quantity of personal data relating to individuals residing in Italy that is collected or processed; • a clear description of the means used to collect such data; • comprehensive information on each source con - tributing to the database; • clarification as to whether personal data of individ - uals who are not platform users is processed; and • specific information, with regard to email address - es and telephone numbers, on the relevant sourc - es, consent mechanisms and purposes of data- sharing with platform users. Moreover, the GPDP recalled that similar business models had already been under scrutiny in the past. In earlier cases, the authority had sanctioned real estate agencies for carrying out promotional activities using telephone numbers purchased from third-party pro - viders that were offering services comparable to those provided by Lusha. On 5 December 2025, the GPDP issued a further com - munication, clarifying that the proceedings which had been promptly opened in April 2025 were still fully ongoing. The GPDP confirmed that its investigation
had been triggered in light of the receipt of formal complaints from data subjects who lamented having received unwanted promotional or commercial calls based on data included in Lusha’s database. From the authority’s preliminary findings, it emerged that Lusha collects and processes personal data of EU residents, building its services around the col - lection and further sharing of this data with potential clients, while maintaining that compliance with data protection rules rests primarily with the latter, as data controllers. The GPDP also highlighted that Lusha includes in its services the contact details of public figures, including individuals holding public and institutional positions. This element raises additional concerns in light of the principles of lawfulness, purpose limitation and data minimisation, as well as in light of the data subjects’ increased expectations of privacy and transparency applicable when processing personal data at scale. It is worth noting that, although Lusha operates across all EU member states, the GPDP is, at present, the only supervisory authority to have formally launched an in-depth investigation into the platform. This con - firms the proactive stance traditionally adopted by the Italian authority in sectors perceived as high-risk, including telemarketing, the commercial trading of personal data and – as seen above – AI. At the same time, the GPDP has made it clear that its enforcement focus is not limited to Lusha alone. The authority is monitoring other major platforms active in the personal contact data market, and is also assess - ing the position of companies that have relied on such databases to carry out marketing activities without an adequate legal basis. The outcome of the Lusha investigation may therefore have significant implications, not only for the com - pany and its clients themselves but also for the wider ecosystem of data brokers, and for businesses that source contact data from third-party providers and/ or publicly available sources (such as social networks and public databases).
219 CHAMBERS.COM
Powered by FlippingBook