the Italian data privacy authority has forbidden the use of e-mail addresses for marketing without prior consent and confirmed Italy’s “opt-in” approach to unsolicited commercial e-mail.
Topic: Selling on-line
Who: Italian Privacy Authority
When: January 2001
Where: Italy
What happened:
By scanning Italian web pages and news groups an Italian political party compiled a mailing list of over 400,000 e-mail addresses. In January 2001, however, the Italian Privacy Authority branded the practice a violation of the recipients’ privacy. It prohibited the party from collecting e-mail addresses in this way and using them for sending unsolicited "spam" messages for political purposes. In future the party was required to obtain express prior consent before continuing with the practice.
Why this matters:
There is nothing new in the decision that e-mail addresses constituted "personal data" and were therefore caught by the Data Protection Directive. This is the position taken by the Information Commission (formerly the Data Protection Commission) and most other commentators in the UK. The finding also confirms the position taken some time ago by the Italian authorities that the regime in respect of spam should be "opt in"(i.e. no spamming without express prior written consent) rather than "opt out (i.e. individuals can be spammed provided they have not previously opted out, and all other legal requirements (such as fair collection of the data in the first place) have been met ) as in the UK. Italy has been in the vanguard of EU states taking a strict view of unsolicited commercial e-mail or "spam".
Regardless of the differences between the Italian and UK legal regimes, however, it is highly likely that a UK political party doing the same thing would have suffered the same fate. "Processing" includes collection of personal data and collection must therefore be "fair." In the UK this means an individual being informed of who is collecting and processing the data and made aware of the purposes to which the data is going to be put. This must be stated explicitly unless the purposes should have been obvious from the circumstances in which the data were collected (e.g. processing a name and address for delivery purposes when goods are ordered on-line.) So with an election apparently imminent, politicos should take note, as well as marketers, to whom the same rules apply.
