Italy

[IT] Data Protection Authority approves targeted advertising by Sky Italia

IRIS 2016-8:1/34

Amedeo Arena

Università degli Studi di Napoli "Federico II"

On 13 July 2016, the Italian Data Protection Authority issued a decision ruling that the processing of users’ personal data by the Italian satellite pay-TV operator Sky Italia, aimed at providing targeted advertising to some of its subscribers (Adsmart project), is in line with the Italian Data Protection Code (legislative decree No. 196 of 30 June 2003).

Targeted advertising is a new advertising technique that enables the broadcaster to replace the advertising spots included in the linear feed with different, targeted advertising spots that are stored in the user’s decoder box. Thus, broadcasters can show different advertising to different clusters of users watching the same programme.

In its decision, which was issued upon Sky Italia’s request, prior to implementing the Adsmart project, the Data Protection Authority found that the provision of targeted advertising in the context of the said project involves a twofold processing of personal data: the anonymisation of participating users’ data, and their allocation to different user clusters, based on criteria (for example, age, location, type and length of subscription, payment method) specified by Sky Italia.

Accordingly, the Data Protection Authority ruled that the above processing of personal data can be regarded as in line with Italian data protection laws subject to two conditions: first, participating users must be duly informed of the purpose of data processing (that is to say, profiling-based marketing), of the processing methods (that is to say, only in aggregate and anonymised form), and of their statutory right to oppose data processing; and secondly, the Authority ruled that participating users must be allowed to easily opt out of the Adsmart project through any of the following means: (i) via their remote control, (ii) through their profile page on Sky Italia’s website, or (iii) by e-mail or Sky Italia’s customer care number.

The Data Processing Authority added that an appropriate notice to that effect must be displayed when the decoder box is turned on after software update, as well as on two subsequent occasions, so as to ensure that several family members are made aware of their participation in the Adsmart project and of their right to opt out.

The Authority also enjoined Sky Italia to communicate the steps taken to ensure that the above requirements are fulfilled.