www.lexology.com Open in urlscan Pro
2606:4700::6812:d66  Public Scan

Form analysis
2 forms found in the DOM

Name: SearchForm — GET /search/

<form action="/search/" autocomplete="off" method="get" id="SearchForm" name="SearchForm" _lpchecked="1">
  <span class="search-container-nav">
    <label for="q" class="sr-only">Search</label>
    <input type="text" placeholder="Search Lexology" name="q" id="q">
    <input type="submit" class="submit hidden-text" value="Search">
  </span>
</form>

Name: SearchForm — GET /search/

<form action="/search/" autocomplete="off" method="get" id="SearchForm" name="SearchForm" _lpchecked="1" class="foot-search">
  <label for="qfoot" class="sr-only">Search</label>
  <input type="text" placeholder="Search Lexology" name="q" id="qfoot">
  <input type="submit" class="submit hidden-text" value="Search">
</form>

Text Content

Toggle navigation

 * Search
 * PRO
 * Events
 * Awards
    * Client Choice
    * Influencers
    * WWL Awards 2023
   
   Introducing Instruct Counsel
   The next generation search tool for finding the right lawyer for you.
 * About
 * More
   Blog Popular
 * PRO
 * Resources
    * Latest updated
    * Commentary
    * Q&A
    * Analysis
    * Practical resources
    * In-Depth
    * FromCounsel
    * In-House View

 * Research tools
    * Global research hub
    * Data hub
    * Lexy Improved
    * Primary sources
    * Scanner
    * Research reports
    * Instruct Counsel

 * My Lexology
    * My folders
    * My saved reports
    * My account
    * Content settings
    * Log out

 * Resources
 * Research tools
 * Who's Who Legal
    * Find an expert
    * Reports
    * Thought Leaders
    * Performance Index
    * Research methodology
    * Submissions

 * Who's Who Legal
 * Learn
    * All
    * Masterclasses
    * Professional Development
    * Videos
    * Audio

 * Learn
 * Instruct Counsel
 * My newsfeed
 * Events
 * About
 * Blog
 * Popular


resources-nav-link
 * Latest updates
 * Commentary
 * Q&A
 * Analysis
 * Practical resources
 * In-Depth
 * FromCounsel
 * In-House View
 * Browse by

 * 
 * 
 * 

 * 
 * 
 * 

 * 
 * 
 * 

research-nav-link
 * Global research hub
 * Data hub
 * LexyIMPROVED
 * Primary sources
 * Scanner
 * Research reports
 * Instruct Counsel


 * Compare
 * Topics
 * Panoramic Next


ANALYTICS

Review your content's performance and reach.

 * Analytics dashboard
 * Top articles
 * Top authors
 * Who's reading?


CONTENT DEVELOPMENT

Become your target audience’s go-to resource for today’s hottest topics.

 * Trending Topics
 * Discover Content
 * Horizons
 * Ideation


CLIENT INTELLIGENCE

Understand your clients’ strategies and the most pressing issues they are
facing.

 * Track Sectors
 * Track Clients
 * Mandates
 * Discover Companies
 * Reports Centre


COMPETITOR INTELLIGENCE

Keep a step ahead of your key competitors and benchmark against them.

 * Benchmarking
 * Competitor Mandates

Lexology


Back Forward
 * Back
 * Save & file
 * View original
 * Forward
 * Print
 * Share
    * Facebook
    * Twitter
    * Linked In

 * Follow
   
 * Like
 * Instruct

add to folder:

 * My saved (default)
   
   


INTERSECTION BETWEEN CONSUMER AND DATA PROTECTION LAWS: ITALIAN AUTHORITIES TOLD
TO COOPERATE

Ashurst
prev
next

European Union, Italy February 14 2024

On 21 December 2023, the Italian Supreme Administrative Court (CDS) held that
the Italian competition authority, Autorità Garante della Concorrenza e del
Mercato (AGCM), must cooperate with the Italian Data Protection Authority
(Garante Privacy) when investigations give rise to substantive data protection
issues.

The judgment is a significant development that will impact future AGCM
investigations (including, potentially, in relation to the enforcement of the
Digital Markets Act (DMA)). It also casts doubts on the legitimacy of previous
AGCM decisions where the investigation involved antitrust / consumer protection
issues as well as data protection issues.

Key takeaways

 * The AGCM must cooperate with the Garante Privacy when competition / consumer
   (and possibly DMA) investigations give rise to substantive data protection
   issues.
 * Due to the complexity of such cases, the Italian authorities will likely need
   to agree a framework for cooperating at an early stage of investigations.
 * In future, complainants may need to consider proactively engaging with both
   authorities upfront.

Background: the AGCM's investigation into Telepass

The AGCM investigated Telepass S.p.A. and Telepass Broker S.r.l (together,
Telepass) for alleged unfair commercial practices in the context of car
insurance distribution for its commercial partners via its app.

According to the AGCM, Telepass received flows of personal data from potential
customers requesting quotes for insurance policies without adequately informing
them of Telepass' data-sharing process with its insurance partners. Telepass'
privacy notice did inform consumers that the information would be collected for
the purposes of calculating the quote and then processed for marketing purposes.

The AGCM focused on whether Telepass' conduct complied with the Italian Consumer
Code (Legislative Decree of 6 September 2005, n. 206) and concluded that the
conduct was capable of inducing customers to take a commercial decision that
they would not have taken otherwise. Telepass was fined EUR 2 million for
breaching the Consumer Code.

The AGCM argued that it did not assess whether Telepass' privacy notice (which
was only referred to at the start of the quote request process) was compliant
with the EU General Data Protection Regulation (Regulation 679/2016) (GDPR) and
the Italian Privacy Code (Legislative Decree of 30 June 2003, n. 196).

Telepass' appeal

At first instance, the Regional Administrative Tribunal for Lazio (TAR)
dismissed Telepass' appeal against the AGCM's decision. The TAR concluded that
Telepass omitted essential information which misled consumers. In its view, the
link with the privacy notice was merely incidental and not decisive for
assessing the conduct.

The TAR agreed with the AGCM that it was not required to seek the opinion of the
Garante Privacy since data protection rules were not called into question. The
TAR held that an opinion of the Garante Privacy is only required in cases
concerning regulated activities, pursuant to Article 27, 1-bis of the Consumer
Code. This is despite the fact that the Garante Privacy intervened in the case
before the TAR and criticised the AGCM's failure to fulfil its duty of
cooperation. As part of its intervention, the Garante Privacy confirmed that it
had already examined the same conduct investigated by the AGCM and established
that it was legitimate under the GDPR. The Garante Privacy stressed that it does
not "regulate" any activity: it is entrusted with safeguarding a fundamental
right and the free movement of data.

Appeal to the CDS

Telepass appealed the TAR judgment to the CDS. In its defence, the AGCM argued
that: (i) the conduct amounted to a commercial practice which violated the
Consumer Code and (ii) it did not have to involve the Garante Privacy because it
had not applied the GDPR. The AGCM stressed that the Consumer Code and GDPR
pursue different objectives.

The CDS upheld Telepass' appeal: in particular, it held that the Court of
Justice of the European Union's (CJEU) judgment in Meta v Bundeskartellamt
(Meta) could also apply to investigations into unfair commercial practices.

First, contrary to the AGCM's approach, the CDS established that there is a
close link between Telepass' contested commercial practices and the (lawfulness
of) processing of personal customer data. The conduct falls under both the
Consumer Code and applicable privacy laws. According to the CDS, the broad range
of activities falling within the definition of "data processing" in Article 4(2)
GDPR, and which are therefore under the remit of the Garante Privacy, prevents
the AGCM claiming exclusive jurisdiction to assess such conduct. Moreover, the
CDS stressed that cooperation between the two authorities may also be required,
particularly in light of the overlap between certain consumer and data
protection provisions under Italian law. The CDS therefore concluded that the
AGCM's analysis was incomplete.

Secondly, the CDS held that the principles established in the CJEU's ruling in
Meta also apply in cases concerning the interplay between consumer protection
and data protection laws. Where a national competition authority (NCA) considers
it necessary to rule on whether the processing of personal data complies with
GDPR, the NCA and data protection authority must cooperate to ensure that GDPR
is applied consistently.

Analysing whether an undertaking's conduct is GDPR-compliant may be an important
element for assessing compliance with the Consumer Code. Excluding GDPR rules
from the legal context forming part of the assessment of potential violations of
the Consumer Code would undermine the effectiveness of the Consumer Code and
disregard the fundamental importance of data for the digital economy.

As a result, the CDS concluded that the AGCM's failure to involve the Garante
Privacy during the investigation into Telepass meant that the AGCM's decision
was "pathologically flawed".

The Garante Privacy is calling for the cooperation with the AGCM to extend into
DMA investigations

The Garante Privacy has been vocal in stressing the need for cooperation between
it and the AGCM. In addition to the Telepass case, the Garante Privacy stressed
the need for cooperation in general terms and to comply with the ne bis in idem
principle (double jeopardy) when commenting on the draft Annual Law on Market
and Competition.

In that context, the Garante Privacy argued that the general duty to cooperate
imposed on the AGCM by EU law would extend to the enforcement of the DMA. The
Garante Privacy also emphasised that Italian law states that the powers
entrusted to the AGCM under the DMA are without prejudice to the Garante
Privacy's competence. As a result, the authorities will need to coordinate where
data protection profiles are relevant to investigations.

In relation to the DMA, the Garante Privacy emphasised that coordination will be
particularly important when assessing compliance with the obligations imposed on
gatekeepers by Article 6(10) and 6(11).

 * Article 6(10) requires gatekeepers to allow business users (and authorised
   third parties) access to personal data generated in their use of the
   gatekeeper's platform. Access to data is subject to the end-users' consent,
   in line with GDPR requirements.
 * Article 6(11) requires gatekeepers to provide search engines with access to
   anonymised ranking, query, click and view data for free, and paid searches
   generated by users.

According to the Garante Privacy, these DMA provisions presuppose duties of
fairness in processing end-users' data with which the Garante Privacy must be
able to ascertain compliance.

Comment

The CDS' ruling in the Telepass case marks a significant step towards ensuring
harmonised enforcement of competition, consumer and data protection laws. It is
particularly important as it arguably "codifies" that the AGCM has a duty to
cooperate with the Garante Privacy in consumer-related cases which concern data
protection profiles.

As a matter of EU law, this principle was established by the CJEU in Meta. The
CJEU appears to have envisaged broader cooperation than the mere request /
provision of an opinion under Article 27, 1-bis of the Consumer Code required
for "regulated activities".

Bearing in mind that, according to the CDS, failure to fulfil these cooperation
requirements would result in the investigation being procedurally flawed and
subject to annulment, it would be appropriate for the AGCM and Garante Privacy
to establish a proper framework to govern their cooperation, even at an early /
preliminary phase.

Increasingly, the AGCM will be confronted with complex investigations which give
rise to similar data protection facets, including cases arising out of the DMA.
AGCM decisions prior to the Telepass ruling will likely have limited
precedential value in cases involving antitrust / consumer protection issues as
well as data protection issues, given the AGCM did not cooperate with the
Garante Privacy in these cases.

In the same vein, complainants should be prepared to proactively engage with
both authorities at an early stage to avoid risks of incomplete assessments that
may vitiate the outcome of the investigation.

With thanks to Maria Eugenia Finocchio of Ashurst for her contribution.

Ashurst - Gabriele Accardo and Fiona Garside

Back Forward
 * Back
 * Save & file
 * View original
 * Forward
 * Print
 * Share
    * Facebook
    * Twitter
    * Linked In

 * Follow
   
 * Like
 * Instruct

add to folder:

 * My saved (default)
   
 * Read later
   

Folders shared with you
   
 * 
   


FILED UNDER

 * European Union
 * Italy
 * IT & Data Protection
 * Litigation
 * Ashurst


POPULAR ARTICLES FROM THIS FIRM

 1. Q&A ON THE THIRD-COUNTRY BRANCH INTRODUCED BY CRD VI *

 2. DATA BYTES 43: YOUR UK AND EUROPEAN DATA PRIVACY UPDATE FOR DECEMBER 2023
    AND FEBRUARY 2024 *

 3. FINANCIAL SERVICES SPEEDREAD: 8 FEBRUARY 2024 EDITION *

 4. THE EU AI ACT IS HERE - WHAT YOU NEED TO KNOW AND WHAT TO DO NEXT *

 5. PREPARING FOR 'PERFECT STORMS': EBA PUBLISHES CONSULTATION AND SURVEY ON ESG
    RISKS *

If you would like to learn how Lexology can drive your content marketing
strategy forward, please email enquiries@lexology.com.




RELATED SCANNER UPDATES PRO

 * Financial sanctions general guidance
 * PIPC: Opening an era of artificial intelligence where people's lives are
   enriched and personal information is safe
 * Utah Consumer Protection Act: A new law to protect online privacy

View Scanner



LIVE

 * GCR Live: Telecoms, Media & Technology 2024
   
   Global Competition Review
   Freshfields Bruckhaus Deringer, London
   20 March 2024


LAW FIRM SEMINARS & EVENTS

 * Competition Law Outlook 2024
   
   CMS Cameron McKenna Nabarro Olswang LLP
   online
   23 February 2024

 * The Business of Artificial Intelligence: Practical Applications in the IP
   Ecosystem
   
   International Trademark Association
   New York, United States
   20 - 21 March 2024

 * 2024 INTA Annual Meeting
   
   International Trademark Association
   Georgia, USA
   18 - 22 May 2024

 * Regulating AI— Part IV: The EU AI Act – The Expected International Impacts of
   the First Comprehensive AI Regulation
   
   K&L Gates LLP
   online
   27 February 2024

Share your expertise on law firm market intelligence
What data points, and datasets, are most helpful in researching the market and
competitors for law firms?
Take our survey



RELATED PRACTICAL RESOURCES PRO

 * Checklist Checklist: Managing a dawn raid Recently updated
 * Checklist Checklist: Privacy and data security law training (USA) Recently
   updated
 * How-to guide How-to guide: How to manage your organization’s data privacy and
   security risks (USA) Recently updated

View all


FEATURED VIDEO

Watch now
Video
Updating Disclosure Schedules: Section 2 - Scope of Updates and Impact on the
Agreement
8m 56s

Watch now


RELATED RESEARCH HUBS

 * European Union
 * Italy
 * IT & Data Protection
 * Litigation

×


MY LEXOLOGY

Current page clippings

Access my saved content

Back to Top
Resources
 * Daily newsfeed
 * Commentary
 * Panoramic
 * Research hubs
 * Learn
 * In-Depth
 * Lexy: AI search
 * Scanner

Who's Who Legal
 * Find an expert
 * Reports
 * Thought Leaders
 * Performance Index
 * Research methodology
 * Submissions
 * Instruct Counsel

More
 * About us
 * Legal Influencers
 * Firms
 * Blog
 * Events
 * Popular
 * Code of ethics

Legal
 * Terms of use
 * Cookies
 * Disclaimer
 * Privacy policy

Contact
 * Contact
 * RSS feeds
 * Submissions

 
Search
 * Follow on Twitter
 * Follow on LinkedIn

© Copyright 2006 - 2024 Law Business Research


×




Close
×




Close
×




Close
My Lexology: Clip and save Instruct Counsel: Find lawyers for this topic


COOKIE PREFERENCE CENTRE




 * YOUR PRIVACY


 * STRICTLY NECESSARY COOKIES


 * PERFORMANCE COOKIES


 * FUNCTIONAL COOKIES


 * TARGETING COOKIES

YOUR PRIVACY

When you visit any website, it may store or retrieve information on your
browser, mostly in the form of cookies. This information might be about you,
your preferences or your device and is mostly used to make the site work as you
expect it to. The information does not usually directly identify you, but it can
give you a more personalized web experience. Because we respect your right to
privacy, you can choose not to allow some types of cookies. Click on the
different category headings to find out more and change our default settings.
However, blocking some types of cookies may impact your experience of the site
and the services we are able to offer.
More information

STRICTLY NECESSARY COOKIES

Always Active

These cookies are necessary for the website to function and cannot be switched
off in our systems. They are usually only set in response to actions made by you
which amount to a request for services, such as setting your privacy
preferences, logging in or filling in forms. You can set your browser to block
or alert you about these cookies, but some parts of the site will not then work.
These cookies do not store any personally identifiable information.

PERFORMANCE COOKIES

Performance Cookies


These cookies allow us to count visits and traffic sources so we can measure and
improve the performance of our site. They help us to know which pages are the
most and least popular and see how visitors move around the site. All
information these cookies collect is aggregated and therefore anonymous. If you
do not allow these cookies we will not know when you have visited our site, and
will not be able to monitor its performance.

FUNCTIONAL COOKIES

Functional Cookies


These cookies enable the website to provide enhanced functionality and
personalisation. They may be set by us or by third party providers whose
services we have added to our pages. If you do not allow these cookies then some
or all of these services may not function properly.

TARGETING COOKIES

Targeting Cookies


These cookies may be set through our site by our advertising partners. They may
be used by those companies to build a profile of your interests and show you
relevant adverts on other sites. They do not store directly personal
information, but are based on uniquely identifying your browser and internet
device. If you do not allow these cookies, you will experience less targeted
advertising.

Back Button


BACK



Vendor Search
Filter Button
Consent Leg.Interest
checkbox label label
checkbox label label
checkbox label label

Clear
checkbox label label
Apply Cancel
Save settings
Allow All


We use cookies to give you the best online experience. By clicking "Accept
Cookies" or clicking into any content on this site, you agree to allow cookies
to be placed. To find out more visit ourcookie policy

Cookies Settings Accept Cookies