The rules apply to public and private entities involved in the use of these tools and cover promotional communications as well as informational, institutional, and service-related communications.
The Data Protection Authority considers tracking to fall within the scope of Article 122 of the Italian Privacy Code, within the framework of the safeguards provided for by the GDPR. Recipients must therefore be informed and give their consent, unless a specific exception applies, as assessed on a case-by-case basis. . Where tracking is based on consent, it must also be possible to withdraw that consent separately whilst continuing to receive communications.
For businesses and organisations, compliance therefore begins with a review of the email platforms and their configurations, to ascertain whether tracking tools are active, what data they collect, and for the purposes for which the data is being used.
Based on this review, it is then necessary to verify the roles of the service providers involved, update privacy notices, adapt the mechanisms for obtaining and withdrawing consent, and adopt technical measures that limit the data collected and ensure their protection.
This is a process that requires coordination between data protection, marketing, and IT functions.
Compliance also depends on how these tools work in practice and on the ability to respect recipients’ choices.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
