Italy's data protection authority has fined US-based data broker Lusha Systems Inc. €2 million (approximately $2.3 million) for unlawfully collecting, enriching, and selling personal data belonging to a large number of individuals in Italy.
Lusha operates a subscription-based platform that provides customers with “enriched” personal information, including individuals' job titles, email addresses, and phone numbers for commercial and anti-fraud purposes.
According to the regulator, the company obtained this information from multiple sources, including web scraping of social media platforms and data purchased from other data brokers. The platform also contained information relating to senior government officials, public administration representatives, law enforcement personnel, and members of the judiciary.
The investigation found that Lusha processed the personal data of a large number of people in Italy in violation of the GDPR's principles of lawfulness, fairness, transparency, and data minimization. The company also failed to provide a privacy notice that was sufficiently clear and easily accessible to affected individuals.
The regulator further determined that Lusha could not rely on legitimate interest as the legal basis for its processing activities, concluding that the company lacked a valid legal justification under the GDPR.
As part of its decision, the authority clarified that the GDPR applies to Lusha despite the company having no establishment within the European Union. Although the platform focuses on collecting professional information, it also continuously updates and verifies those records over time. According to the decision, those activities constitute monitoring of individuals' behavior and professional profiles on the internet, bringing the company's processing within the scope of the GDPR.
Having concluded that Lusha's processing activities lacked a valid legal basis from the outset and remained ongoing, the authority ordered the company to stop processing the personal data of individuals located in Italy and to delete the affected data.
Leave a Reply