Registro pubblico delle opposizioni (Public Register of Oppositions), Codice Privacy Article 130(3) to (3-quater) and Presidential Decree 26/2022

Article 130(3-bis) of the Codice Privacy permits, notwithstanding Article 129, the processing of telephone and paper-mail contact data for advertising, direct sale, market research or commercial communication against those who have not exercised the right of opposition by registering their number and other personal data in a public register of oppositions.

Article 130(3) permits further communications for those purposes by means other than those in paragraphs 1 and 2 under Articles 6 and 7 of the General Data Protection Regulation (GDPR) and under paragraph 3-bis. Article 130(3-quater) gives the Garante supervision and control of the register's organization and operation and of the data processing.

Article 3(1) of Presidential Decree 26/2022 has the Ministry of Economic Development (Ministero dello sviluppo economico) establish the register for the postal addresses in the subscriber lists and for all national fixed and mobile numbers, whether or not they appear in those lists.

Article 2(2) applies the Decree to processing by telephone communications by any means, whether through an operator or, under Article 1(5) of Law 5/2018, through automated calling systems or calls without an operator, and to processing by paper mail, for advertising, direct sale, market research or commercial communication. Article 7(1) makes registration in the register free of charge.

Article 5(1) requires each operator that wants to process national fixed and mobile numbers by telephone, with or without a human operator, or postal addresses by paper mail, for those purposes to apply to the register's manager, with proof of identity and the lists that are the source of the data and, for processing by telephone only, a declaration that it activates calling line identification or uses the codes or prefixes set by AGCOM or, where it outsources the calls, the identity of each third party making them.

Article 5(2) provides that the validity of the operator's registration ends twelve months after its last consultation of the register. Article 7(6) provides that registration precludes any processing by operators, for those purposes, of the postal addresses in the subscriber lists and of national fixed and mobile numbers by telephone or paper mail, subject to the following paragraphs.

Under Article 7(7), registration or renewal made on the subscriber's explicit request is deemed to revoke all consents previously given, in any form or by any means, to the processing of national telephone numbers by telephone, with or without an operator, or by paper mail, for those purposes.

Under Article 7(5)(b), after a registered subscriber revokes the opposition, processing of national numbers is allowed if specific consent was collected after the most recent registration or renewal, in compliance with Articles 6, 7, 13, 14 and 21(2) of the GDPR.

Article 8(2) requires operators that use telephone advertising and sales systems, telephone market research or telephone commercial communications, or paper mail, to consult the register monthly and in any case before the start of each promotional campaign, and to update their lists. A consultation of the register is effective for fifteen days for processing by telephone, with or without an operator, and for thirty days for processing by paper mail.

Article 9(1) requires operators and call-center businesses that call subscribers for those purposes to guarantee the presentation of the calling line identification, as Article 2(1) of Law 5/2018 provides. Article 9(2) has AGCOM regulate and supervise compliance with that duty and apply, for a violation, the sanctions of Article 2(1) of Law 5/2018.

Article 10(1) requires operators, at the time of the call or in the paper advertising, to state precisely that the subscriber's data were lawfully extracted from the subscriber lists or from other sources and to give the information useful for registering in the register. Article 13 provides that, for a violation of the Decree's prescriptions, the subscriber relies on the remedies of Chapter VIII of the GDPR and Part III of the Codice Privacy.

Article 166(2) of the Codice Privacy names Article 130, paragraphs 1 to 5, for the administrative sanction of Article 83(5) of the GDPR.