Sending commercial communications for promotional purposes to users must always be preceded by the acquisition of a valid consent, which must be free, specific and accountable. The Data Controller is also responsible for implementing adequate organizational and technical measures in order to guarantee the correct management of the rights of the data subjects, with particular reference to the right to object to the processing.
This is what is established by the provision of the Data Protection Authority n. 133 of 20 June 2019.

Following a public consultation process, the European Data Protection Board has adopted the final version of the Guidelines 2/2019 on the processing of personal data under Article 6(1)(b) of Regulation (EU) 2016/679 – General Data Protection Regulation (the “GDPR”) in the context of the provision of online services to data subjects.

Sending commercial communications for promotional purposes to users must always be preceded by the acquisition of a valid consent, which must be free, specific and accountable. The Data Controller is also responsible for implementing adequate organizational and technical measures in order to guarantee the correct management of the data subjects rights, with particular emphasis to the right to object to the processing.
This is what was established by the provision of the Data Protection Authority n. 133 of 20 June 2019.

L’invio di comunicazioni commerciali per finalità promozionali ai clienti deve essere sempre preceduto dall’acquisizione di un valido consenso,

At the end of 2018, a few months after the full applicability of EU Regulation 679/2016 on the protection of personal data, most companies and public bodies have understood the concepts promoted by the Regulation related to the principle of accountability; despite this, there are still significant shortcomings in the effective implementation of specific policies for the protection of personal data. This is the outcome of the international survey on respect for privacy (“Sweep 2018”) conducted by the personal data protection authorities belonging to the Global Privacy Enforcement Network.