Recent changes to Italian law applicable to call centres
New provisions recently came into force in Italy regulating the activities of call
centres pursuant to the 2017 Italian budget law (L. 232/2016) which amended
sect. 24-bis of decree law 83/2012 (“DL 83/2012”), setting out various provisions
applicable to call centres in Italy.
Following the change introduced by the budget law, the Ministry for Economic
Development (“MED”): (i) issued on January 31st, 2017 some clarifications
concerning the various formalities to be carried out by call centres as towards the
MED and other competent authorities and (ii) on February 24th 2017 published
an update of the Frequently Asked Questions (FAQ) available on its website, in
an effort to provide call centre operators with some initial directions in the face of
the rather fragmentary and ambiguous provisions applicable to their business.
For its part, on February 13th, 2017, the Communications Authority (“AGCOM”),
which is responsible for keeping a Register of Operators in Communications
(“ROC”) set up pursuant to previous legislation, published some FAQ concerning
the “Obligation of economic operators conducting activities as call centres and
third parties to whom call centre services are outsourced to enrol in the Register
of Operators in Communications”.
Shortly afterwards, the Italian Data Protection Authority (“DPA”), which had
already issued two orders containing detailed directions relating to call centres in
2013, published on February 28th, 2017 an information note concerning the new
provisions regulating the activities of call centres. This note contained
clarifications intended to avoid the duplication of notifications to the DPA itself
and other competent authorities (see below) and specified that its two 2013
orders on the subject of call centres should be deemed to have lapsed.
In fact, it is essential to bear in mind that the activities of call centres should at all
times be in compliance with the Italian data protection law, contained in
Legislative Decree196/2003 (so-called “Privacy Code”), with particular reference
- but not only - to its provisions relating to “Unsolicited Communications”, and
those relating to the transfer of personal data to countries outside the European
Union and, finally, insofar as applicable, such activities should also comply with
Legislative Decree 70/2003, the so-called “E-commerce Code”.
Obligations of economic operators conducting call centre activities
The provisions referred to above impose a number of obligations on call centre
operators, with stiff penalties for non-compliance.
1. Information to be given to the user
From January 1st, 2017, call centre workers must immediately inform
users of where they are physically located. Non-compliance may result
in a fine of € 50,000 per day (in addition to any fines that might result from
failure to comply with the Privacy Code).
From April 1st, 2017, call centre workers located outside the European
Union must also immediately offer users the possibility of their call
being immediately transferred to another call centre worker
physically located in Italy or another country of the EU. The fine for
non-compliance is again € 50,000 per day in addition to any fines that
might result from failure to comply with the Privacy Code).
The amendments to DL 83/2012 also make a fundamental change to the
position from the data protection point of view of third party service
providers to whom call centre services are outsourced. In fact, it states
that the service provider, as well as the customer, should be deemed to
be the data controller for the purposes of the Privacy Code, which is in
complete contrast to the direction of the DPA in one of its 2013 orders as
mentioned above, which indicated that the service provider should be
appointed as data processor by the customer on whose behalf it would be
processing any personal data in the course of the call centre activity. Third
party call centres are therefore also obliged to give an information notice
of their own pursuant to sect. 13 of the Privacy Code and failure to
provide to all users of the call centre the information referred to in the first
two paragraphs of this section will also be a violation of sect. 13 of the
Privacy Code as such. The customer and the service provider are jointly
and severally liable for such violation.
By way of comment, it may be pointed out that, while this change to the
position of a (non-EU) service provider (from data processor to data
controller) was clearly intended to make it easier for the Italian authorities
to make them directly liable for violations of the Privacy Code, it could in
some cases and until the General Data Protection Regulation (“GDPR”)
comes into force of May 25th, 2018, have the paradoxical effect of
transferring non-EU service providers outside the sphere of application of
Italian law. In fact, sect. 5 of the Privacy Code provides that its provisions
will apply to data controllers established in Italy and those established
outside the EU which use means/equipment for the processing situated
in Italy. So call centres outside the EU which do not use means/equipment
for the processing of personal data in the course of their activities will not
be subject to Italian law. This will change when the GDPR becomes
applicable because under its art. 3, the GDPR applies to the processing
of personal data of persons situated in the EU, for, inter alia, the purpose
of providing services to them, irrespective of where the processing is
carried out; at the same time, the GDPR makes data processors as well
as controllers liable for violations for which they are responsible (art. 82),
so the new provision of DL 83/2012, defining service providers as data
controllers in order to make them directly liable for privacy violations, will
no longer be necessary.
2. Notification obligations
Economic operators who offer – or use – call centre services must inform
the Ministry for Employment, the MED or the DPA, within 10 days of any
request thereby, of the location of their call centres used for either
inbound or outbound calls. Failure to do so will result in a fine of € 50,000
per each violation.
Where an economic operator decides to locate call centre activities
in a non-EU State – whether directly or outsourced to a service
provider – it must notify such transfer at least 30 days in advance, to
the Ministry for Employment, the MED and the DPA, according to the
procedure set out by DL 83/2012 (as amended) and in accordance with
the instructions published by each of the said authorities. Failure to do so
may result in a fine of € 150,000 for each failure or delay to notify.
Economic operators which on January 1st, 2017 already conducted call
centre activities (whether directly or outsourced) located outside the EU,
had to file the said notification by March 2nd, 2017, the penalty for failure
to notify or delay being € 10,000 for each day of delay.
It should be noted, in particular, that the notification to the DPA must
describe the measures adopted to ensure compliance with Italian law,
including - but not limited to – the rules contained in the Privacy Code
relating to the transfer of personal data outside the EU and the provisions
concerning the public register of subscribers not wishing to receive
3. Enrolling in the ROC
All economic operators conducting call center activities using Italian
numbers, irrespective of the number of people employed in such activities
(which, prior to the amendment to DL 83/2012 was determinative), must
enrol with the ROC, and supplì AGCOM with all the telephone numbers
made available to the public and used for call centre services. Failure to
comply may result in a fine of € 50,000.
In the FAQ published on its website on February 13th, 2017, as mentioned
above, AGCOM specified that, where a call centre is outsourced to third
parties, only the third parties are under an obligation to enrol with the ROC.
Where, on the other hand, the call centre activities are carried out both
directly and via a third party, both the economic operator and the third
party must enrol.
1 was set up pursuant to Presidential
Decree 178/2010, allows subscribers listed in public telephone directories to be listed in the register, which
makes it illegal to contact them for promotional purposes.
What comes within the definition of “call centre activities”?
Unfortunately, the Decree does not define "economic operators conducting call
centre activities"; in view of the significant obligations referred to above, this is
To find out, it is useful (as suggested by the MED in the FAQ referred to above)
to refer to other resolutions issued by AGCOM. In particular, resolution
79/09/CSP (which referred to call centres run or used by telecommunications
companies) defines a call centre as a '"a combination of human resources and
specialised infrastructures allowing multichannel contacts and communications
with users (by different means, such as telephone, internet, mail) ".
The definition of a call centre used by AGCOM in practice seems to be even
broader, since it has informally indicated that it applies the following criterion:
there is a “call centre activity” wherever an economic operator dedicates a
company function to dealing with inbound and/or outbound telephone calls
irrespective of the specific purpose of such calls.
According to this interpretation, even economic operators which, for example,
dedicate even minor corporate resources to dealing with telephone calls for
customer or post-sales assistance will be subject to the new rules.
The vast number of companies thus caught within the sphere of these provisions
casts doubts as to their usefulness and the legal logic behind them. Such doubts
increase in the light of the very title of the article of the Decree in question, which
reads “Measures to support personal data protection, national security,
competition and employment in activities carried out by call centres” and, on
the other, that the same article of the Decree had the original purpose of avoiding
dips in employment. The Employment Ministry, with reference to the 2012 version,
specified in circular no. 14 of April 2nd, 2013, that the provisions affected “…only
those companies which carry out call centre activities as their core business and
which, therefore, operate as call centre service providers, while they do not apply
to resources which simply support or integrate a company’s business, being in
effect a mere front office contact”.
Furthermore, the 2016 amendment to the Decree provides that “…pending a
redefinition of the system of incentives to boost employment in the call centre
sector …”, no benefits of any kind, including of a tax and contributory nature,
which may be available for the activities in question can be made to call centre
operators which relocate such activities outside the EU, thus reinforcing the
impression that the provision in question was intended to cover call centres as
defined in the circular of the Ministry of Employment referred to above.
Nevertheless, it should be borne in mind that the AGCOM officials contacted,
while sharing the doubts concerning its extremely broad definition of call centre
for the purposes of the Decree, confirmed that at the moment they can’t diverge
from it, at least until further clarifications are given either by the legislator or by
the competent ministerial authorities – hopefully in the not too distant future.