Sending promotional communications to certified email addresses extracted from public professional registers constitutes unlawful data processing in the absence of prior consent from the data subjects, as the purpose of these registers is not commercial.

Facts and context

The Italian data protection authority, the Garantor for the Protection of Personal Data (GPDP), published a sanction decision against Mesprofessionnels.it S.r.l. for breaches related to sending unsolicited promotional communications.

The case originated from six separate complaints and reports concerning the receipt of unsolicited promotional emails to certified email addresses.

Grounds for the decision

• Obligation to have a valid legal basis for commercial prospecting (Articles 6 and 7 of the GDPR, and Article 130 of the Italian Data Protection Code): The authority found that the company sent unsolicited communications to professionals using their certified email addresses, manually collected from public professional registers. It rejected the company's argument that these messages were purely informative, emphasizing that their content, which included an invitation to register on a platform with a voucher offer and a limited-time promotion, was unequivocally commercial in nature. The GPDP recalled that the public availability of personal data does not make it freely usable for purposes incompatible with those for which it was published; in this case, professional registers aim to facilitate institutional communications and not commercial prospecting. The authority relied on its Guidelines of 4 July 2013 on promotional activity and anti-spam, which specify that using certified email addresses from the national index for promotional purposes is unlawful without prior consent.
• Obligation to respond to requests to exercise rights (Articles 12 and 15 of the GDPR): The authority also confirmed that the company did not respond to an access request made by one of the complainants. The company provided no justification for this omission during the procedure, leading to a finding of violation of obligations related to the management of data subjects' rights.

Authority's decision

Consequently, the authority found the processing carried out by Mesprofessionnels.it S.r.l. unlawful and, in addition to imposing a fine of 1000 euros, determined corrective measures to be imposed, taking into account mitigating circumstances such as the absence of demonstrated concrete harm and no prior violations.

Lessons learned

This decision reminds that:

• The public availability of personal data, such as an email address in a professional register, does not authorize its reuse for incompatible purposes, such as commercial prospecting, without an appropriate legal basis.
• The classification of a communication (informative or promotional) depends on its objective content and not on the sender's declared intention; the offer of financial incentives or limited-time promotions characterizes a commercial communication.
• The immediate deletion of data after unlawful processing, such as sending an email without consent, does not negate the initially committed violation.