A fine of 2 million euros has been imposed by the Privacy Guarantor on Lusha Systems Inc., a US data broker that through its platform provides, for a fee, "enriched" information such as job titles, email addresses and phone numbers.
Lusha, recalls a note from the Guarantor, "collects such data from multiple sources - for example through scraping activities from social networks and purchases from other data brokers - and makes it available to platform customers for commercial or anti-fraud purposes. Among the information available on the platform was also that relating to representatives of institutional leadership, public administration, law enforcement and the judiciary."
According to the Authority, "the company processed the personal data of a large number of people present in Italian territory in violation of the principles of lawfulness, fairness, transparency and data minimisation. In particular, the information provided to data subjects was not clear and easily accessible. Furthermore, with regard to the legal basis for processing, the Authority considered that the pursuit of legitimate interest was not an adequate legal basis."
In concluding the proceedings, the Guarantor stated that "the GDPR also applies to the processing of personal data of individuals recorded in Lusha's database, a company with no establishment in the EU, as such processing falls within the scope of the monitoring criterion provided for by the European Regulation. Indeed, Lusha does not merely collect professional information, but also manages its updating and monitoring over time. Such operations therefore constitute an activity of monitoring the behaviour and personal positions of data subjects on the Internet, configuring a genuine 'tracking' that is relevant under the GDPR."
"Having established the unlawfulness of the conduct carried out by Lusha and having determined that the processing activities, still ongoing, had lacked a valid legal basis from the outset, the Authority - the note concludes - has prohibited the company from processing the personal data of data subjects present in Italian territory and has ordered its deletion."
Reproduction reserved © Copyright ANSA
