The Italian data protection authority has imposed a fine of €2,000,000 on an American data broker for illegally collecting and selling data of individuals in Italy, asserting its jurisdiction based on the behavioral tracking criterion provided by the GDPR.

Facts and context

The Italian data protection authority (GPDP) today published a sanction decision against Lusha Systems Inc. (including the imposition of a €2,000,000 fine) for breaches related to the collection and marketing of personal data without an appropriate legal basis.

The case originated from an investigation by the authority into the company's activities, an American data broker that provides, via its paid platform, "enriched" professional information (such as job titles, email addresses, and phone numbers) on a large number of individuals, including institutional figures and law enforcement members.

Reasons for the decision

The authority found several GDPR violations, developing reasoning on its territorial jurisdiction and on the substance of the processing:

• Territorial jurisdiction of the authority (Article 3 of the GDPR): The authority asserted its jurisdiction over the American company, although it lacks an establishment in the Union. It considered that the processing fell under the behavioral tracking criterion, as the company not only collects professional information but also updates and monitors it over time, constituting genuine tracking of data subjects on the internet, qualified as "tracing" by the authority.
• Violation of fundamental processing principles (Article 5 of the GDPR): The authority concluded that the company's activities violated the principles of lawfulness, fairness, transparency, and data minimization. The massive collection of information from multiple sources, including scraping social networks and purchasing from other brokers, was deemed contrary to these fundamental requirements.
• Lack of appropriate legal basis (Article 6 of the GDPR): The authority judged that the legitimate interest claimed by the company did not constitute a valid legal basis for the collection and marketing of data. The processing, which concerned a large number of individuals on Italian territory, was therefore considered unlawful from its origin.
• Failure to comply with transparency obligation (Article 12 of the GDPR): The information provided to data subjects about the processing of their data was neither clear nor easily accessible. This failure prevented individuals from understanding and controlling the use made of their personal information.

Authority's decision

Consequently, the authority imposed a fine of €2,000,000 on Lusha Systems Inc.

Furthermore, the authority ordered the company to prohibit any processing of personal data of individuals present on Italian territory and to proceed with their deletion.

Lessons learned

This decision reminds that:

• behavioral tracking within the meaning of the GDPR is not limited to real-time tracking but may include continuous collection, updating, and monitoring of information about individuals, even if this information is professional in nature.
• a data broker's legitimate interest generally cannot constitute a valid legal basis for the massive collection and marketing of personal data, especially when data is obtained through techniques like data scraping.
• a company established outside the European Union that collects and enriches data relating to individuals in the Union is subject to the GDPR as soon as its activities constitute tracking of their behavior.
• the transparency obligation requires providing clear and accessible information to data subjects, including when their data is collected from third-party sources, so that they can exercise effective control over their information.