New italian rules on transfers of call centers outside Italy

The Law entered into force on August 12, 2012.

By virtue of the Law, stricter requirements now apply to companies which plan to transfer call center activities outside Italy, or which already run call center activities abroad.

THE NEW REQUIREMENTS

The Law is striking in many respects.

First, according to Section 24-bis of the Law, companies which plan to transfer outside Italy call centers which employ at least 20 workers (whether part-time or full-time) are subject to a twofold prior communication requirement:

• communication, at least 120 days before the transfer, to the Italian Ministry of Labor and Social Affairs.  Companies shall provide the Ministry with details of the workers involved in the transfer;
• communication to the Italian Data Protection Authority.  Companies must indicate the measures implemented to ensure that the data protection requirements set forth by the Italian Data Protection Code (Legislative Decree no. 196/2003) and by the Register for Telemarketing (which lists the details of telephone subscribers who do not want their numbers to be used for telemarketing purposes[i]) are met.

The same communication requirement applies to companies which already run call center services abroad.  In this case, the Law does not specify the term within which this communication shall be made.

In the silence of the Law, it seems that companies which already run their call center services abroad are currently required to carry out the aforementioned communication, i.e., starting from the entry into force of the Law on August 12, 2012.

In both cases of inbound and outbound calls, customers shall be informed of the place where the call center operator is physically located.  Moreover, in case of inbound calls, customers shall have the right to choose to be assisted by an Italian call center.  This provision has the clear purpose to favor the Italian national market.

In case of failure to comply with the above depicted requirements, a sanction equal to EUR10,000 for each day of non-compliance might apply.[ii]

COMPLIANCE WITH DIRECTIVE 95/46/EC

With reference to call centers located in the EU, the requirements introduced by the Law seem to be at odds with the overarching principle of free flow of personal data between Member States set forth by the Data Protection Directive 95/46/EC.[iii]

Indeed, according to Section 1, paragraph 2, of Directive 95/46/EC, Member States should not in principle restrict the free movement between them of personal data on grounds relating to protection of the rights and freedoms of individuals, including data protection.  This principle is reflected by Section 42 of the Italian Data Protection Code.

The requirements introduced by the Law raise some concerns also with reference to call centers located in non-EU countries.  Indeed, under the Law, the customers’/data subjects’ consent is considered the only legal ground for the transfer of their data outside the EU, while Directive 95/46/EC provides for other legal grounds.

For instance, according to the Italian Data Protection Code, consistently with Directive 95/46/EC, transfer of personal data to non-EU countries would be lawful if carried out in compliance with the set of standard contractual clauses drafted by the EU Commission and ratified by the Italian Data Protection Authority.[iv]

FURTHER CLARIFICATION NEEDED

The new requirements need further clarifications as certain provisions of the Law are unclear.

As regards the scope of application of the Law, what about companies which, as of today – i.e. after the entering into force of the Law – start carrying out call center activities in a foreign country? Do they have to comply with the Law?  In the depicted scenario, indeed, there would not be a “transfer” of a call center abroad nor the company could be deemed as already running a call center abroad.

Further, it is not fully clear which authority will apply the sanctions envisaged by the Law.

Being the situation as above, any guidance from the Ministry of Labor and Social Affairs and/or the Italian Data Protection Authority is welcomed.

[i] The Registry for Telemarketing entered into force on January 31 2011.

[ii] Section 24-bis, paragraph 6, of the Law.

[iii] Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data.

[iv] Section 44, paragraph 1, letter b), of the Italian Data Protection Code.