This decision by the Italian data protection authority sanctions a company for using the contact details of a professional, obtained via LinkedIn's "Sales Navigator" tool, to send unsolicited commercial prospecting emails without consent.

Facts and context

The Italian data protection authority (Garante per la protezione dei dati personali - GPDP) published a sanction decision against the company Codia Europe S.r.l. for breaches related to sending unsolicited commercial communications and failure to cooperate with the authority.

The case originated from a complaint filed by a lawyer on 29 July 2024, who received several unsolicited promotional emails on different addresses and received no response to his subsequent access request.

Grounds for the decision

The authority found two main breaches against the company:

• Failure to cooperate obligation (Article 157 of the Italian Data Protection Code): The company did not respond to the authority's initial information request dated 21 October 2024. The late justification, related to a suspension of activity due to internal changes, was deemed insufficient. The authority noted that promotional emails were sent during and after the alleged suspension period, demonstrating a resumption of activity that should have been accompanied by monitoring of correspondence. This failure to respond caused additional administrative burden for the authority.
• Lack of legal basis for commercial prospecting (Article 6 and Article 7 of the GDPR, and Article 130 of the Italian Code): The company sent promotional emails without a valid legal basis. The authority first dismissed the argument that the communications were not promotional, as their content explicitly aimed to offer commercial services. Then, it rejected the reliance on legitimate interest, recalling that Article 130 of the Italian Code requires prior consent for sending commercial communications by email. The fact that the data were obtained via LinkedIn's "Sales Navigator" tool does not change this requirement, as registration on a social network does not constitute consent to receive prospecting and does not correspond to users' legitimate expectations.

Authority's decision

Consequently, the authority imposed a fine on Codia Europe S.r.l.

Lessons learned

This decision reminds that:

• Publishing data on a professional social network like LinkedIn does not make them freely usable for commercial email prospecting; the initial purpose of publication and the legitimate expectations of the data subjects must be respected.
• The use of specialized tools such as LinkedIn's "Sales Navigator" to identify prospects does not exempt the data controller from obtaining a valid legal basis which, for email prospecting, remains the prior consent of the data subject.
• Failure to respond to an information request from a supervisory authority constitutes a separate violation from the substantive breach, which may be sanctioned as such.