The Italian data protection authority (Garante) issued a new set of guidelines on spam and marketing activities in April 2015 entitled "Vademecum - Viva commercial suggestions, down with the spam. From the telephone to the supermarket: marketing that is privacy proof"1 (Vademecum).
The Vademecum provides a general overview of marketing activities, and the privacy roles within a company, including the roles of a data controller, third party service providers, and data processors, or the persons in charge of the processing of data, usually employees of the data controller.
The Vademecum focuses on the obligation of companies to inform customers of the purposes and conditions of the data processing and of the obligation to obtain their free and express consent. It is once again clarified that pre-checked boxes cannot be used to justify the collection of data since the consent envisioned must be freely given by individuals. Consent as a pre-condition to delivery of a service is considered unlawful.
The Garante reaffirms the need for consent to be specific; hence, a general catch-all consent is considered not in line with the law. If a company then intends to carry out marketing and profiling activities, it will have to collect two separate and independent consents.
Specific attention is devoted to profiling activities, which may deeply encroach into the private life of individuals. Specific precautions must therefore be undertaken, especially with regard to the kind of data processed and the means used for the collection of data - e.g., individuals' profiles based on preferences relating to the use of interactive TV functionalities, telephone data and location data.
The Vademecum considers a wide range of means through which companies may perform marketing activities, including the use of social networks. As such, the Garante warns that a company should take into consideration the specific peculiarities of online communities in order to avoid 'social spam'. Consent is usually necessary for marketing activities through social networking channels.
It is worth noting that the Garante acknowledges the key role that marketing activities play for a company in relation to both existing and prospective customers. In fact, the Garante states that the manner by which a company sets out its marketing strategy may provide a competitive advantage over other players in the market. Indeed, bombarding customers with marketing communications may turn out to be more detrimental than advantageous to companies as it does not always translate to gaining customer loyalty. A proper marketing strategy that integrates the privacy laws and regulations will help build and foster a positive relationship between a company and its existing and prospective customers.
Lastly, the Garante provides guidelines for individuals on how they can seek protection in case of infringement of their privacy rights and in particular, in case of unsolicited marketing telephone calls, that represent the majority of claims filed with the Garante.
For more information, please contact Francesca Gaudino.
 The Vademecum is available in Italian language on the website of the Garante at: http://184.108.40.206/documents/10160/3844886/Vademecum+ marketing+e+privacy+2015.pdf.