Register of the Decisions
n. 704 - 14 November 2024
GARANTE PER LA PROTEZIONE DEI DATI PERSONALI
AT today's meeting, which was attended by Prof. Pasquale Stanzione, president, Prof. Ginevra
Cerrina Feroni, vice-president, Dr. Agostino Ghiglia and Mr. Guido Scorza, members, and Cons. Fabio
Mattei, secretary-general;
HAVING REGARD TO Regulation (EU) 2016/679 of the European Parliament and of the Council of 27
April 2016 on the protection of natural persons with regard to the processing of personal data and on
the free movement of such data and repealing Directive 95/46/EC (General Data Protection Regulation,
hereinafter "GDPR");
HAVING REGARD TO THE Personal Data Protection Code (Legislative Decree No. 196 of 30 June
2003), as amended by Legislative Decree No. 101 of 10 August 2018, containing provisions for the
adaptation of the national system to the aforementioned Regulation (hereinafter the "Code");
HAVING REGARD TO THE documentation on file;
HAVING REGARD TO THE observations made by the Secretary-General pursuant to Section 15 of the
Garante’s Regulations No. 1/2000, adopted by resolution of 28 June 2000;
Acting on the report submitted by Prof. Pasquale Stanzione;
PREAMBLE
1. THE INVESTIGATION
1.1. Introductory Remarks
By decision No. 18752/21 of 8 April 2021 (notified on the same day by certified e-mail), which
shall be deemed to be reproduced herein in its entirety, the Office initiated, pursuant to Section 166(5)
of the Code, proceedings for the adoption of the measures referred to in Article 58, para. 2, of the
GDPR against Hoda s.r.l. (hereinafter "Hoda" or "the Company"), by the agency of its interim legal
representative, with registered office in Milan, Piazza Ernesto De Angelis 13, Tax ID 10160470968.
The proceedings originate from an investigation started by the Authority, following the receipt of
several reports and complaints coming mainly from large-scale retail distribution (GDO) companies.
The inspections were documented in the minutes of the operations carried out in which the
documentation acquired was also acknowledged.
In addition to the statements made and the documents produced during the inspection, the Office
examined the documents on the Weople platform as available until 2 July 2024 to the data subjects
prior to registration, along with similar documents of the LifeKosmos application.
1.2. Notification of administrative infringements
Whilst the considerations contained in the notification of initiation of administrative proceeding
(doc. no. 18752/21 of 8 April 2021) shall be referenced in full for the purposes hereof, it should be
1
noted that, upon completion of the preliminary investigation activity, the Office notified Hoda s.r.l.
of the following alleged infringements:
a) Infringement of Articles 5, 6(1)(b), 9 and 20 of the GDPR, having carried out processing
operations aimed at the acquisition of data following portability (including special category
data referred to in Article 9) as well as at profiling Weople users, in the absence of an
appropriate legal basis and in breach of the principles of data minimization and purpose
limitation and accordingly of the exercise of the right to portability;
b) Infringement of Articles 5 and 6(1)(b) of the GDPR, having carried out processing aimed at
profiling LifeKosmos users in the absence of an appropriate legal basis;
c) Infringement of Articles 5 and 6(1)(b) and 20 of the GDPR, having processed data for the
purpose of forwarding requests for the exercise of rights and declarations of users’ consent
withdrawal without being legitimated to carry out such activities in the name and on behalf of
those users - on account of the unsuitability of the act of delegation of powers, with reference to
the requests for the exercise of rights, and of the impossibility to delegate the power to
withdraw one’s consent, respectively;
d) Infringement of Articles 5 and 8 of the GDPR, having processed personal data relating to children
in the absence of an appropriate legal basis - since the legal basis under Article 6(1)(b) of the
GDPR is not applicable to children pursuant to Sections 2 and 1425 of the Italian Civil Code,
which set out children’s lack of contractual capacity;
e) Infringement of Articles 12 and 13 of the GDPR, with reference to the information provided on
the nature of the data, the purposes and the legal basis of the processing, which did not meet
the requirements of straightforwardness and clarity, as well as to the information relating to the
processing aimed at profiling data subjects and the processing related to requests to exercise
the right to data portability, where information on the 'logic used and the importance and the
expected consequences of such processing for the data subject' was found to be missing.
2. THE COMPANY’S DEFENCE AND THE ASSESSMENT BY THE AUTHORITY
2.1 The company’s pleadings and hearing
On 24 May 2021, Hoda sent the Authority the statement of defense provided for in Section 166(6)
of the Code. Pursuant to the latter provision, the hearing requested by the party under investigation
took place on 4 June 2021 by videoconference, of which minutes were drawn up. Both documents
shall be considered to be fully referenced and reproduced herein, for the protection of the party under
investigation.
The company first of all gave a general overview of its processing of personal data and of Hoda's
entrepreneurial rationale, representing that its business is carried out through its main assets as
consisting in the Weople service, the LifeKosmos platform and the technological-statistical engine
called ' DOTCONN Engine'.
In particular, DOTCONN Engine processes the data collected by Hoda through users' interactions
with the Weople service and the LifeKosmos platform, obtaining probabilistic models that client
companies can apply to their own databases. This operation is therefore alleged to not entail the
communication of Hoda's data to other controllers, since what is exported outside the Company's
perimeter consists allegedly in statistical algorithms that are said to be unrelated to the database that
enabled their processing.
Starting from the consideration that the processing of personal data can generate economic value,
Hoda has implemented a business model that envisages not only the return of a significant part (around
2
90%) of this value to data subjects, but also data subjects’ participation s in the data acquisition and
marketing processes such as to give rise to a sort of 're-appropriation' of their data; in this activity
Hoda takes on the role of an intermediary [broker] and facilitator.
In its statement, Hoda draws attention to the circumstance that the data through which its
processing tools are fed cannot be limited to those recorded in the systems of the original data
controller, as they must also consist of the additional data that are generated by interactions between
the data subject and other data controllers, and that it was precisely in the acquisition of such data that
the company encountered significant resistance.
In the light of the call made repeatedly, also at European level, for data subjects to have full
knowledge of the data processed by the multiple data controllers to whom such data have been provided,
Hoda has therefore set its role as that of an aggregator that can carry out, on behalf of the data subjects,
the complex operations entailed by the collection of such data (on the basis of the right to portability as
set out in Art. 20 of the GDPR), by means of specific functionalities of the Weople platform. Those
functionalities allow the creation of "safe-deposit boxes" which represent both the main way to grant
Hoda the power to exercise that right and the virtual place where the data are stored, as well as being
the "reservoir" to allow Hoda itself to process the data acquired in the manner described above.
As far as data processing is concerned, Hoda represented that it differs substantially from that
performed by other enrichment providers, since the final product of such processing are statistical
algorithms generated from the pseudonymized data. The statistical patterns obtained in this manner
are made available to corporate clients, who can apply them to their own databases to outline
marketing strategies and campaigns. However, these statistical patterns are never applied to Weople
users, who are said accordingly to take on the role of 'matrices' with respect to subsequent processing.
Hoda further argues that the processes described in this way cannot even be considered as profiling,
since they entail no assessment of a natural person's characteristics.
Hoda therefore pointed out that it did not start an actual profiling activity, since the one also
mentioned in the privacy policy, consisting in the analysis and evaluation of the habits and consumption
choices of Weople users and in the consequent offer of products and services in line with these
interests, has not yet been undertaken due to the low number of users registered on the Weople
platform.
Lastly, Hoda argued that the activity of ‘enhancement’ of users' personal data differs from
'monetization', since the latter is allegedly focused on the acquisition and also the reselling of large
quantities of data to other entities; conversely, the purposes sought by the Company are allegedly
intended to facilitate the re-appropriation of data by the data subjects and to consistently develop the
exercise of the right to portability through the creation of open-source IT interfaces that can foster the
free circulation of personal data, in line with the principles underpinning the GDPR.
As to the specific notified infringements, Hoda submitted the following:
o With reference to the alleged infringement under point (a), Hoda premised that Article 6(1)(b) of the
GDPR (relating to the contractual legal basis for processing) is intended to support the freedom to
conduct a business guaranteed by Article 16 of the Charter of Fundamental Rights of the European
Union and thus to allow the proper performance of contractual obligations through the provision and
processing of personal data where such processing is 'an integral part of the provision of the service
requested' and as such it is carried out in the interest of all contractual parties. The assessment as to
the necessity of the processing must be conducted on a case-by-case basis, taking into account the
specific purpose, aims and objectives of the service.
In the case of the contract concluded between Hoda and Weople users, it includes a main service,
consisting of the personal data investment functionality, as well as additional ancillary services. In
the document 'Terms and Conditions' as made available to users, Hoda specified 'Logic and
3
operation of personal data' under Article 4. In particular, it clarified that the service 'allows you to
reap an economic benefit from the controlled and secure use of your personal data' and described the
stages and operations of the enhancement mechanism, consisting of the provision of data through safe
deposit boxes, the processing of the deposited personal data through analysis tools and profiling
algorithms, and the provision of services to corporate clients in order to obtain the consideration to
be returned to the user. In the statement it is said that ‘the contract for access to the Weople service
[...] is predicated upon the enhancement of the personal data deposited in the safe-deposit boxes in
order to redistribute the proceeds from the Investment Activity to the user’.
According to Hoda, therefore, it can be easily appreciated that the rationale of the Weople service
is precisely that of a contract for data analysis and profiling. Profiling, being the only means that allows
users' data to be assigned a value, is therefore 'intrinsically necessary' for contractual performance
and for obtaining of the economic benefit sought by users.
With regard to the failure to refer, in the privacy policy, to the necessity of providing the data, the
obligation, if any, on the user to provide them, and the possible consequences of not providing them
(which information is required if communication of the data is envisaged as a contractual
obligation), Hoda represents that providing the data is optional, however "without providing the data,
the profiling mechanism that is the object of the contract is not activated" and that, to date, no Weople
user has challenged the contract before any judicial authority or lodged any complaint – which is said
to "indirectly confirm that the processing outlined is clear and corresponds to the instructions garnered
from the Weoplers following registration to the service".
With regard to the alleged infringement concerning the possible use of special category data under
Article 9 of the GDPR, Hoda reiterated that the Company has no interest in processing special
category data or data relating to criminal convictions and offences under Article 10 of the GDPR.
Therefore, should such additional data be acquired "in accordance with the user's wishes", Hoda
would provide for their automatic deletion following non-importation into its database. In this
regard, the Company set specific fields on the platform to import users' personal data, which is why
excess data are bound to be cancelled – in that they have no target field;
o With reference to the alleged infringement under subheading b), the Company first described the
LifeKosmos service by representing that it 'is a separate service from Weople' and it is activated by
signing a specific contract.
By signing the contract, the user undertakes to participate regularly in the surveys administered to
him/her and to activate a Weople account within 5 days in order to start using the safe deposit
boxes relating to the digital accounts as previously declared when completing the questionnaires.
The contract also provides for the LifeKosmos user to be equipped with a "Meter" to detect radio
and/or television broadcasts listened to during the day. For each questionnaire answered by the user,
the user receives a virtual score, which is converted into rewards according to a special catalogue.
According to Hoda, therefore, the LifeKosmos user activation contract is not a mere addendum to
the Weople contract; it is actually a separate contract the user can activate in order to accumulate
points to be converted into rewards by providing information that can be used to enrich the database
covered by the Weople services. This information, however, is not pooled into Weople since it is used
as a separate basis for statistical analysis, or as an element of stabilization of the data that are
extrapolated from Weople and intended to feed a database shared by the Weople and LifeKosmos
services, called Wekosmos, which feeds the DOTCONN Engine in turn;
o with reference to the alleged infringement under section c), Hoda points out that the Italian legal
system allows performing legal acts through a representative (Section 1387 et seq. of the Italian Civil
Code) and this must be considered to be also applicable, in the absence of legal provisions prohibiting
4
it, to the exercise of the rights under Articles 15-22 of the GDPR. This is in pursuance of the principle
of freedom, which is inherent in every democratic state and is set out in Article 23 of the Italian
Constitution, as well as being in line with an approach promoting the full exercise of individual
freedoms as per the Latin brocardo (maxim) "ubi lex voluit dixit, ubi noluit tacuit" (i.e., where the
law required it, it mentioned it; where it did not require it, it kept silent). The delegation for the
exercise of rights must not, therefore, be considered as granting of powers, which would be subject
to formal and substantive constraints; rather, it should be possible to exercise such delegation freely
and fully within the remit in whose respect it was conferred, which is specified and circumscribed in
the case at hand, and it may be reiterated according to the needs connected with execution of the
contract.
With regard to the formation and signing of the instrument of delegation, Hoda considers it fully
legitimate that it may be formed through conclusive conduct, or as it defines it, "the effect of a positive
action" that the user freely puts in place in accordance with what is specified (and accepted) in the
"Terms and Conditions" document.
Furthermore, according to Hoda, the set of information and elements the user uses to identify
him/herself in Weople's systems must be considered for all intents and purposes as a digital
signature, which is therefore suitable for the finalisation of the delegation instrument.
The same considerations apply to the power to delegate withdrawal of the consent given by a data
subject to the initial data controller, since this act of withdrawal must be included among the rights of
the data subjects, even if it is provided for and placed in a different section of the GDPR. Moreover, 'the
fact that the data protection framework does not expressly provide for the possibility of giving (and
withdrawing) one’s consent to processing by way of an agent delegated for that purpose does not mean
that it is prohibited'. Hoda also draws attention to the 'draft recommendation' drawn up by the
French DP authority (CNIL) on the exercise of rights, which was submitted for public consultation
and also contains a reference to the right to withdraw consent. On the basis of these elements, Hoda
considers that the processing related to the delegation to withdraw consent is legally sound and is
therefore fully legitimate;
o with reference to the alleged infringement under point d), there is no breach of Article 8 of the
GDPR in the case of processing operations involving children, since that provision applies only to
processing operations whose legal basis is consent (Article 6(1)(a) of the GDPR), which is not the
case here. The legal basis identified in the present case is in fact the contractual one provided for by
Article 6(1)(b) of the GDPR and in this regard the Company argues that contracts entered into by
children must be considered valid until the finalisation of any action for annulment precisely on
the basis of Sections 2 and 1425 of the Civil Code as referred to in the notification; therefore, the
contractual legal basis set out in the privacy policy must be considered legitimate until that time;
o with reference to the alleged infringement under point e), Hoda rejects the considerations set out
in the notification of commencement of administrative proceeding whereby the requirements of
simplicity and clarity are not met in the privacy policy provided pursuant to Article 13 of the GDPR;
it points out that any user accessing the Weople website is guided through the services by a series
of explanatory pages, with very clear language and images and detailed video-tutorials. It is also
clear from using the Weople platform that the latter has been designed having the user in mind, to
whom the privacy policy and "Terms and Conditions" documents in summary and extended format
are submitted prior to registration. Once registration has been completed, the user is provided with
information regarding the upload of his or her identity document, how to acquire/submit his or her
data, delegation, the right to withdraw consent, and the different methods of remuneration.
Hoda argues that "the privacy policy document contains all the elements required by Article 13 of the
5
GDPR; moreover, the statement that a privacy policy in which recourse is made to cross-
referencing is bound to be not straightforward and unclear needs being substantiated", since
simplicity and clarity pertain to the language used.
In any case, Hoda, 'always with a view to maximum transparency in communication, has decided to take
a step further [...] and provide a new document in which the wording is accompanied by a series of
easy-to-understand icons'.
With regard to the description of the logic used for profiling activities and the consequences for the
data subjects, Hoda recalls that it has provided detailed information in point 4 of the 'terms and
conditions' document, in which the modalities of profile creation, the categories of data that are used,
the purpose and the effects are described, with an explanatory example. In addition, Article 7 of the
'terms and conditions' document specifies that the data contained in the safe-deposit boxes are
processed for profiling purposes through variables, multivariate statistical technical
characterizations, and artificial intelligence algorithms that allow the value of the deposited personal
data to be enhanced. In addition, the Company pointed out that the provision of meaningful
information on the logic used does not involve the disclosure of the complete algorithm or the
drafting of complex explanations, but rather indications that are sufficiently complete for the data
subject to understand the reasons underlying the decision.
2.2 The facts and the law
Assessment of the arguments put forward by the controller
As mentioned above, it was found during the investigation that Hoda offered its customers an 'investment
service' involving their personal data.
In particular, the company collected the personal data of its customers both directly and through the
exercise of the right to portability on behalf of its customers based on a wide-ranging delegation of
powers granted by those customers. In essence, Hoda requested several controllers on behalf of its
customers to transmit all the personal data such controllers held regarding those customers to itself.
Once such personal data had been collected, the company used proprietary algorithms to develop
consumption profiles of the data subjects, which it used to convey advertisements from third-party
companies, as well as - completely anonymous - algorithmic patterns which it sold to third parties.
Hoda then distributed a percentage of the revenues obtained in this manner to its customers.
All the activities and processing of personal data carried out by the company as addressed in the present
proceedings can therefore be traced back to a single contractual agreement whereby Hoda collected
personal data - including special category personal data - of its users from different sources and in
different ways for the purpose of ‘enhancing’ their value, i.e., investing them in the advertising market,
by means of different solutions, and paying 'interest income' to the data subjects.
As to the alleged infringements under (a) and (b).
By way of the notification of the alleged infringements under (a) and (b), the Office first of all raised to
Hoda that the legal basis of contractual performance (Article 6(1)(b) of the GDPR) was inadequate for
the purpose of carrying out the processing of personal data in the context of the 'Weople safe-deposit-
boxes' main service and the 'Life-Kosmos' ancillary service.
In relation to both services, the Office moreover notified Hoda of having carried out the processing in
breach of the principles set out in Article 5 of the GDPR and, in particular, the principles of
6
minimization, proportionality, privacy by design and by default.
Finally, the Office charged Hoda, under (a), with having processed special categories of personal data
still by relying on contractual performance as the relevant legal basis.
The first two alleged infringements, under (a) and (b), can be addressed jointly. Indeed, both services - the
one called 'safe-deposit boxes' and the one called Life-Kosmos - provided by the company to its
customers have as their object Hoda's undertaking to process personal data as directly received from
the data subjects and collected, on their behalf, from third-party data controllers in order to exploit
them commercially in different manners, whilst affording users an unspecified economic return to
be calculated as a percentage of the revenue earned by the company exactly through the commercial
exploitation of personal data.
As mentioned above, such processing is alleged by Hoda to be underpinned by Article 6(1)(b) of the
GDPR, according to which the processing of personal data is lawful if it is necessary for the performance
of a contract to which the data subject is a party. Therefore, according to this rationale, two distinct
elements (the contract and the data processing) are closely linked by a relationship of necessity such that
the contract cannot be performed without processing the data.
This requirement of 'necessity for the performance of the contract' has been interpreted several times
by the Article 29 Data Protection Working Party (WP 29), today's European Data Protection Board
(EDPB). In particular, in the "Guidelines on automated decision-making relating to natural persons and
profiling for the purposes of GDPR 2016/679" adopted on 3 October 2017 (amended version adopted
on 6 February 2018) by WP 29 and in the Opinion rendered by the WP on 9 April 2014 on the legal
basis for processing, it is reiterated that the provision concerning the contractual legal basis “must be
interpreted strictly and does not cover situations where the processing is not genuinely necessary for
the performance of a contract, but rather unilaterally imposed on the data subject by the controller.
Also the fact that some processing is covered by a contract does not automatically mean that the
processing is necessary for its performance.’ Again with reference to Article 6(1)(b) of the GDPR it
is noted that “the processing must be necessary for the performance of the contract to which the data
subject is a party. This may include, for example, processing the address of the data subject so that
goods purchased online can be delivered, or processing credit card details in order to effect payment.
In the employment context this ground may allow, for example, processing salary information and
bank account details so that salaries could be paid.”
On the basis of the guidance provided by WP 29, as well as of the rationale of the relevant legislation,
it appears that the requirement of 'necessity for the performance of the contract' must be understood in
respect of the processing of personal data as instrumental in nature rather than as an item of negotiation.
The emphasis is actually on data processing that is indispensable precisely for the performance of the
contract concluded between the controller and the data subject. Thus, the requirement of 'necessity
for the performance of the contract' does not apply to the processing of personal data that is made
specifically necessary by controller as the object or cause of the contract. Otherwise, one would end
up mistakenly considering the contract to be an appropriate legal basis whenever a controller, following
its own unilateral assessment, sets the processing of personal data as the necessary object of a contractual
agreement. Indeed, Article 6(1)(b) of the GDPR was not designed to include also those situations where
the processing of personal data is itself the object of the contract. Rather, as set out in EDPB Guidelines
2/2019 with regard to the contractual legal basis, this provision is intended to cover those situations
where personal data are necessary for the fulfilment of a contractual obligation other than the
7
processing of personal data - as is the case, for example, typically with the processing of a customer's
address in order to fulfil the contractual obligation to deliver a purchased good.
In the case at issue, the processing (in particular, that relating to the acquisition of data for the purpose
of profiling and enrichment) is necessary because it is set out by the company as one of the services
covered by the contract with a view to the expected gain in exchange for the data subject's
authorization to process his/her personal data. From this perspective, Article 6(1)(b) of the GDPR
cannot constitute a valid legal basis for the processing of personal data, contrary to what was argued by
Hoda, since the processing of personal data would not be instrumental to the performance of a contract
having a different object, being itself the object of the contract as explained in the foregoing paragraphs.
In order for the legal basis provided for in Article 6(1)(b) GDPR to be lawfully relied upon, validity of
the contract must be demonstrated along with the objective necessity of the processing for the
performance of the contract at issue. Indeed, as set out by the EDPB in the aforementioned Guidelines
2/2019, “A controller can rely on the first option of Article 6(1)(b) to process personal data when it can, in
line with its accountability obligations under Article 5(2), establish both that the processing takes place in
the context of a valid contract with the data subject and that processing is necessary in order that the
particular contract with the data subject can be performed. Where controllers cannot demonstrate that (a)
a contract exists, (b) the contract is valid pursuant to applicable national contract laws, and (c) that the
processing is objectively necessary for the performance of the contract, the controller should consider
another legal basis for processing.” In this sense, “contracts and contractual terms must comply with
the requirements of contract laws and, as the case may be for consumer contracts, consumer
protection laws in order for processing based on those terms to be considered fair and lawful”.
Whilst the finding of the unsuitability of the contract as a legal basis on account of non-compliance with
the requirement of necessity would make it unnecessary for this Authority to establish the possible
invalidity of such contract, it is however worth noting in the present case that the indefinite duration
of the contract, the vagueness of the forms of exploitation covered by the contract - and therefore of
the modalities of processing - as for the users' personal data, the Company's right to unilaterally
modify contractual contents as well as the substantially blanket nature of the delegation Hoda requests
from its users for the exercise of rights, a delegation that is linked in a contractual way to the contract
itself - as will be clarified further on - are elements that raise serious doubts as to the validity of the
contract drafted by Hoda and, as a consequence, as to its compliance with civil and consumer law.
In this context and, in particular, when the processing is not 'necessary for the performance of a
contract', a different legal basis may be applicable. In particular, consent is considered more appropriate
for that purpose within the meaning of Articles 6(1)(a) and 9(2)(a) of the GDPR, provided that its
essential requirements are met. Indeed, where the applicable legal basis is consent, the controller must
ensure that it is specific, unambiguous, based on adequate information ('informed'), 'freely given' and
always revocable without prejudice to the data subject.
In identifying whether consent can be considered as freely given, special consideration must be given
to the concept of 'vulnerability of the individual'. More precisely, as set out in the WP 29 Guidelines
on Data Protection Impact Assessment of 4 April 2017 (version amended and adopted on 4 October
2017) - vulnerability is a general and evolving concept and can be found where an imbalance can be
identified in the relationship between the position of the data subject and that of the controller (by way
8
of example, in the cases of employees or patients). Moreover, data subjects may also belong to a
population cohort that, by definition, is more vulnerable, as is the case with ethnic, religious or linguistic
minorities or, as will be analyzed in detail below, children. Vulnerabilities in data subjects can entail
different levels of awareness and capacity to make decisions, resulting in greater risks to their
fundamental rights and freedoms. Vulnerability also decreases decision-making capacity in terms of
awareness of the possible impact of personal data processing (and of how to mitigate this impact by
exercising one's rights as a data subject).
Moreover, a model in which data subjects may obtain remuneration and, in return, the controller or its
partners may process their personal data entails, in particular, the risk that only individuals with
substantial economic resources may choose to reject such processing. Conversely, the vulnerability of
some individuals may induce them to provide their personal data for financial gain, thereby altering the
free nature of consent. Therefore, for processing to be lawful, it must not be designed in such a way as
to exploit the needs or vulnerabilities of data subjects; consequently, the impact assessment carried
out pursuant to Article 35 of the GDPR must contain, among other things, a specific analysis to that
effect as well as the relevant risk mitigation measures to protect the rights and freedoms of those data
subjects.
The Office, as mentioned above, also notified Hoda, under (a), of having processed special categories
of data by relying on contractual performance as the relevant legal basis.
Once again, with regard to this alleged infringement, contract does not constitute a suitable legal basis for
the processing of personal data in the case at hand. It is undisputed that Hoda collects, stores - at least
until their precise classification as special category data - and, therefore, processes special categories of
personal data on the basis of a contract, which is clearly in breach of Article 9 GDPR. As is well known,
Article 9 GDPR does not envisage, unlike other conditions of lawfulness, a contract as a possible legal
basis for the processing of special category data; therefore, the relevant processing carried out by the
company is unlawful, and the considerations put forward by the latter in relation, essentially, to the
unintentional nature of such processing and to the difficulty of eliminating that category of data also on
account of third parties’ obstructive conduct are not sufficient to override this conclusion.
In its statement of defence, Hoda outlines a more articulated reconstruction of the contractual situation
underpinning its commercial activity, whereby the object of its contracts is said to include a service for the
investment or exploitation (enhancement) of users' personal data (Weople) and a service offering a
survey and monitoring activity of users' 'media diet' (LifeKosmos). The reconstruction submitted by
Hoda appears to be essentially coincident with the one set out by the Office in the commencement of
proceedings instrument albeit from a different perspective, given the narrow, almost imperceptible,
gap between setting - as the object of the given contract - a service for the exploitation of personal
data or for the survey and monitoring of consumption habits concerning audiovisual contents and, on
the other hand, directly the processing of personal data. Even if one were to follow the approach
proposed by Hoda, therefore, the legal basis under Article 6(1)(b) of the GDPR does not appear
appropriate.
In relation to the aforementioned LifeKosmos ancillary contract, it does not seem possible to accept
Hoda’s submissions - not even in the abstract. Indeed, the object of the contract in this case, however
it may be described, consists in the supply of personal data by the data subject to Hoda in return for
9
financial consideration; therefore, the arguments already made as to the inapplicability of the legal basis
under Article 6(1)(b) of the GDPR apply.
For the reasons set out above, the findings of alleged infringements notified by the Office to the
Company under (a) and (b) as for the violation of Article 6(1)(b) of the GDPR are therefore found to be
substantiated and to also take care of the alleged violation of Article 5 of the GDPR. In the absence of
a suitable legal basis for the processing of personal data carried out by the controller, this Authority
considers it appropriate not to dwell on the assessment of the limits and methods the controller ought to
have implemented in a series of processing operations which were in any event unlawful.
As to the alleged violation under (c).
Based on the preliminary investigation carried out by the Office, it has been ascertained that
Hoda has devised a delegation mechanism in order to forward portability requests on behalf of data
subjects directly to the original data controllers (i.e., to major retail companies, e-commerce companies
and social media that hold the data subjects’ information by reason of their membership of a loyalty
program or a social network, or of the purchase of goods or services). This is allegedly intended to
facilitate the exercise of rights by Weople users, in particular the right to data portability under Article
20 GDPR.
With reference to the delegation concerning the exercise of data subject rights and, in particular,
the right to portability, this Authority pointed out in the commencement of administrative proceeding
instrument that such delegation should at least meet the requirements of the actions that are intended
to be performed on behalf of the data subject; accordingly, it should reflect the data subject’s specific,
unambiguous intention and lay down limitations regarding both the object and the timing of the
delegated entity’s activity .
Conversely, it has been found that the delegation Hoda acquires from its users is essentially based
on the data subjects’ conclusive conduct (namely, the activation of a 'safe deposit box' where the data
acquired from the original data controller following the exercise of the right to portability are placed);
nor does it refer to a single instance - or a pre-determined set of multiple instances - of exercising the
rights vis-à-vis the original data controller, since it can be relied on by Hoda indefinitely and until
'revocation' on account of the requirements linked to the commercial exploitation of the data subject's
personal data.
In the case in point, moreover, the requirement that the delegation for the exercise of the right
to portability should take on the characteristics of the delegated activity (i.e., that it should be contained
in a document referring to one or more specific activities in respect of a clearly defined subject-matter
and providing that such activities may only be repeated if this repetition is expressly mentioned) is in
itself, on account of the high-ranking rights to be protected, a minimum requirement both to afford
data subjects the genuine, effective control over the processing of their personal data and to enable
the original data controller to demonstrate the unambiguous intention harboured by the persons
intending to exercise their rights.
With regard to the possibility to delegate withdrawal of consent, on the other hand, this Authority takes
note of the arguments whereby this action falls allegedly within the scope of the rights under Articles
15-22 of the GDPR and may be delegated. Nonetheless, this Authority cannot but confirm the findings
10
set out in the notice of initiation of the administrative proceeding - namely, that the placement of the
provision on the right to withdraw consent within the framework of Article 7 GDPR stems from a
very clear systematic perspective, which is that of equating the features and effects of the manifestation
of one’s consent with those relating to non-consent. From this point of view, giving (or withdrawing)
one’s consent is a very personal act as well as being the instrument for guaranteeing implementation of
the right to informational self-determination - Article 8 of the Charter of Fundamental Rights of the
European Union turns it de facto into a statutory requirement. For all of the above reasons, giving
one’s consent cannot be downsized to the performance of an activity that can be delegated like any
other, since this is liable to nullify the very essence of the right that consent is meant to safeguard. Placing
withdrawal of consent under the umbrella of the exercise of data subject rights is not supported by the
regulatory framework and would additionally deprive the data subject of the power to directly,
possibly simply express their intention to terminate the processing forthwith, in the same manner as
when their consent was initially acquired; in turn, this would result into an unjustified imbalance
between provision and withdrawal of one’s consent, to the detriment of the data subject.
Accordingly, it is considered that the investigation confirmed the violations found under (c).
As to the alleged violation under (d).
It was found, at the time of the Authority's inspection, that Hoda was processing personal data
relating to 1,031 children.
It could also be ascertained regarding these 1,031 children that Hoda did not request, either from
them or from those exercising parental authority, the consent referred to in Articles 6(1)(a) and 8 of
the GDPR, whereas the legal basis of the processing of children’s personal data was traced back to what is
indicated in the information notice for all the other data subjects (i.e., performance of a contract for the
purposes of exercising rights and for profiling; legitimate interest for the purposes of sending
promotional messages and newsletters on the operation of Weople).
In the notice of initiation of proceedings, Hoda was accordingly also notified of having processed, in the
absence of an appropriate legal basis, the personal data of underage users who were unable to conclude
a contract with the company.
In addition to the unsuitability of the legal basis under Article 6(1)(b) of the GDPR that has been
highlighted above, irrespective of the data subject’s age, since the processing is not necessary for the
performance of the contract, it should be noted that the GDPR (Recital 71) specifically excludes the
lawfulness of profiling activities in respect of children. Indeed, as indicated in notice of initiation of
proceedings, the legal basis of contractual performance is also incompatible with Sections 2 and 1425
of the Italian Civil Code as far as children are concerned. In this regard, the company’s submissions
whereby it is precisely Section 1425 of the Civil Code that underpins the legitimacy of such legal basis
also for children, at least until voidance and annulment of the contract signed by them, are irrelevant.
In fact, pursuant to the civil law provisions just referred to, it must be ruled out that a child in our legal
system has the required capacity to act in order to enter into a contract through which he transfers -
albeit within the limits and under the conditions outlined in the foregoing paragraphs hereof - part of
the exercise of a very personal and fundamental right with a view to a gainful benefit of which he or
she is clearly not in a position to assess the appropriateness - as compared to the value of the portions
of his or her personal identity that have been made available to the service provider. Indeed, as also recalled
in the WP 29 Guidelines on Automated Individual Decision Making and Profiling adopted on 3
11
October 2017 (version amended and adopted on 6 February 2018), children may be particularly
susceptible, especially in the online environment, and more easily influenced by the incentive of
monetary consideration, which would undermine their ability to understand the underlying
motivations and/or the consequences of the relevant processing of personal data.
In this regard, it must be observed, in response to the submissions put forward by Hoda in its brief, that
Article 8(1) of the GDPR envisages the ability of a child (if aged above 14 years, under Italian law) to
give consent to the processing of his or her personal data only in the limited context of the direct offer
of information society services.
However, para. (3) of Article 8 provides that “Paragraph 1 shall not affect the general contract law
of Member States such as the rules on the validity, formation or effect of a contract in relation to a
child”, precisely in order to avoid misunderstandings to the effect that the age of majority derogation
set out para. 1 of that Article may also apply to the contractual legal basis. This accordingly
emphasizes that the recognition of a limited capacity to act in giving one’s consent for the processing
of personal data does not alter what is set forth in national law concerning the capacity of a child to
undertake obligations by entering into a contract.
Such capacity must be considered to be unquestionably excluded with reference to the Italian legal
system given that the "capacity to perform all acts for which a different age is not established" is acquired
upon turning 18 under Section 2 of the Italian Civil Code; moreover, Section 1425 of the latter envisages
a specific consequence (voidability) if a contract is signed by a party that is "legally incapable of entering
into a contract" such as a child.
The fact that the effects of a contract continue to be produced until such contract is found to be null
and void by a court does not alter the general principle of the child's incapacity to enter into a contract;
this entails, in the field of personal data protection, that contractual performance is not a suitable legal basis
for any processing resulting from contracts that are entered into by children.
Indeed, a contrario, no age limitation might ever be imposed on the legal basis of contractual
performance, since a judicial ruling on the possible annulment of the contract would have to be awaited
in order to put an end to the specific processing - including with reference to infants.
This would render the provision in Article 8(1) GDPR substantially meaningless, since the limitations
placed on a child’s capability to consent to the processing of their personal data could easily be
circumvented by resorting to the unlawful signing of a contract that would allow processing to be carried
out for a period of time that would certainly be far from limited – i.e., processing would continue until
the court's annulment of the given contract.
Accordingly, this Authority finds that there was a breach of Articles 5 and 8 of the GDPR in the present
case.
As to the alleged infringement under (e)
Having read the statement of defence, one must acknowledge that the effort made by Hoda to
illustrate the multiple processing operations envisaged by joining the Weople service, not only through
the text of the information notice but also through the use of IT techniques, provides a set of cognitive
elements capable of sufficiently guiding the data subject. This was also noted during the inspection, when
the Company responded to the Authority's requests for information by providing explanatory documents
of considerable clarity. Precisely in line with this approach, this Authority would suggest that the
Company provide for a more effective tools in order to make Articles 2, 3 and 4 of the information
12
notice more comprehensible. All of the above, of course, is without prejudice to the assessment made
by the Garante as to the unlawfulness of the basic choices underlying the breaches notified under heads
a), b), c) and d).
Accordingly, this Authority finds that there is no infringement as notified under (e) and terminates
the relevant proceeding.
3. CONCLUSIONS
In view of the foregoing considerations, this Authority finds that Hoda is liable for the infringements
of:
a) Articles 6(1)(b), 9 and 20 of the GDPR, for having carried out processing operations related to
the acquisition of data through portability (including the special categories of data referred to
in Article 9), as well as processing aimed at the profiling of Weople users, in the absence of
a suitable legal basis;
b) Article 6(1)(b) of the GDPR, for having carried out processing for the purpose of profiling
LifeKosmos users, in the absence of a suitable legal basis;
c) Articles 5 and 6(1)(b) and 20 of the GDPR, for having processed data for the purpose of
forwarding users’ requests to exercise their rights and declarations of withdrawal of consent,
without being entitled to carry out such activities in the name and on behalf of those users;
d) Articles 5 and 8 of the GDPR, for having processed personal data relating to children in the
absence of a suitable legal basis.
Having also ascertained the unlawfulness of the Company's conduct with regard to the processing
operations at issue, this Authority finds it necessary to impose, pursuant to Article 58(2)(f) GDPR, the
prohibition on Hoda to carry out any further processing of the data acquired by virtue of the contracts
and delegation instruments that are the subject of this decision, in the manner and in the form set out
in the preamble.
The Authority is aware of the complexity of the issues at hand and welcomes the fully cooperative
conduct held by the Company throughout the proceeding, which also mirrors the Company’s good faith
in the conception and management of its business initiative. For these reasons, this Authority finds that it
can dispense with the imposition of an administrative fine and that addressing a reprimand to Hoda,
pursuant to Article 58, paragraph 2, letter b) GDPR, is sufficient in relation to the infringements mentioned
above, so that any future processing is brought fully into compliance with the above requirements.
BASED ON THE FOREGOING PREMISES, THE GARANTE
a) imposes on Hoda, pursuant to Article 58(2)(f) GDPR, a ban on any further processing of data
acquired through the contracts and the delegation instruments considered in this decision, in the
manner and form set out in the preamble hereof;
b) issues a reprimand to Hoda, pursuant to Article 58(2)(b) GDPR, by having regard to the above-
mentioned infringements;
c) orders Hoda, pursuant to Section 157 of the Code, to inform this Authority of any steps taken
in order to implement the ban in question; any failure to comply with the measure set out
herein may result in the imposition of the administrative fine provided for by Article 83,
paragraph 5, of the GDPR.
13
Pursuant to Section 152 of the Code and Section 10 of Legislative Decree no. 150/2011, this decision
may be challenged before the judicial authority by lodging an appeal with the court of the place where
the controller has its registered office within thirty days from the date of communication hereof.
Rome, 14 November 2024
THE PRESIDENT
THE RAPPORTEUR
THE SECRETARY-GENERAL
14