Innovation Law Insights

Podcast

New Italian Online Gambling License Regime and Tender: What you need to know

The Italian government recently approved new legislation on the gambling framework and licensing regime, alongside the reorganization of remote games with cash winnings in Italy. DLA Piper lawyers Giulio Coraggio and Vincenzo Giuffré discuss the changes and implications in Italy for both established operators and new entrants. Watch the webinar here.

Data Protection and Cybersecurity

EDPB issues guidance on the compliance of Pay or Ok cookie model with privacy laws

The European Data Protection Board (EDPB) has issued comprehensive guidance for large online platforms to help them comply with privacy laws of the Pay or Ok cookie management model, which is becoming quite common in the market.

This marks a significant milestone in the realm of data protection and privacy, with far-reaching implications for a multitude of businesses operating in the digital sphere.

The EDPB guidance underscores the need for companies to perform a nuanced and context-specific assessment of the validity of consent obtained from data subjects within the framework of consent or pay models. Companies should meticulously examine various facets of consent, including whether it’s freely given, informed and specific.

Is consent freely given with the Pay or Ok cookie model?

Freely given consent is central to the EDPB's analysis. The EDPB emphasizes the importance of ensuring that data subjects are given genuine choices when it comes to consenting to the processing of their personal data. Controllers are urged to provide a free alternative version that does not involve processing personal data for behavioural advertising. While not mandated, offering an alternative reinforces the argument that consent is actually freely given.

The EDPB also highlights the potential detriment faced by data subjects in scenarios where consent is presented as the sole option, alongside payment. This binary choice may impose financial burdens or impede individuals' access to services deemed as essential, particularly in the case of online platforms that have become part of their daily life. For instance, social media platforms play a pivotal role in facilitating social interactions, while professional networking platforms are crucial for career advancement. Refusing to consent or to pay under such circumstances could have far-reaching consequences, including social exclusion or limitations in accessing job opportunities.

The issue of power imbalance is also a focal point of the EDPB's guidance. If there’s a clear imbalance of power between the controller and the data subject, the consent might not be considered as freely given. Regarding large online platforms, there are some elements that have to be carefully assessed to identify a possible situation of power imbalance such as market dominance, the presence of lock-in effects, and the vulnerability of specific target audiences, such as children.

The EDPB further scrutinizes the alternatives provided to data subjects, particularly concerning potential alternative versions of the same service offered by the same data controller. While these alternatives do not need to be exact replicas of the original service, they should offer comparable functionalities. The EDPB emphasizes that the greater the disparity between the alternative and the version with behavioural advertising, the less likely it is to be deemed genuinely equivalent.

The EDPB offers guidance regarding imposing a fee as an alternative to consent. Controllers are advised to evaluate, on a case-by-case basis, whether the fee is necessary and appropriate and what amount should be requested given the circumstances, bearing in mind that personal data cannot be considered as a tradeable commodity. Controllers should assess whether they offer a genuine choice to data subjects, respecting their autonomy. And controllers should pay special attention to the principles set out in article 5 of the GDPR, emphasizing transparency, fairness, and accountability in data processing practices.

Finally, according to the EDPB, granularity is also important when assessing whether consent is freely given, so data subjects should be free to choose the individual purposes for which they consent to their personal data being processed rather than consenting to a bundle of processing purposes.

Do these principles only apply to large online platforms?

A major question that many clients are asking is whether the principles apply only to large online platforms or to any business adopting the Pay or Ok cookie management system. The guidance continuously refers to large online platforms. This isn’t a GDPR specific definition. It comes from the Digital Services Act and the Digital Markets Act. The rationale of this reference is that customers don’t have valid alternatives to these services because of the platform’s dominant position. And this is why the EDPB requires that customers have a third option that doesn’t require any payment or profiling consent.

But the risk is that regulators like the Italian data protection authority tend to extend the same principles to either any platform or at least platforms that are large but don’t fall under the definitions under the DMA and the DSA. We believe there are valid arguments against this position. The CNIL in its guidance on the matter doesn’t refer to the need to offer a further third alternative.

The EDPB is expected to issue general guidance on the Pay or Ok cookie management model. In the meantime, hopefully, privacy authorities will keep a flexible approach that takes into account the peculiarities of each scenario, rather than trying to impose a one-size-fits-all solution.

Authors: Giulio Coraggio and Roxana Smeria

Italian retrospective scientific research is no longer subject to the approval of the Italian Data Protection Authority

On 23 April 2024, the Italian Parliament approved an important change to the Italian Privacy Code, enabling companies to run retrospective scientific research without first getting prior approval from the Data Protection Authority.

This change involves Article 110 of the Italian Privacy Code addressing “Medical, Biomedical, and Epidemiological Research.” It eliminates the requirement for companies to consult the Italian Data Protection Authority (Garante) and get their approval before conducting research programs involving the processing of health data for scientific purposes, when obtaining consent from data subjects is unattainable.

The Italian regulatory framework has been emphasizing a consent-centric approach so far to justify the processing of health-related personal data for scientific research, except in cases where:

• the research was carried out based on specific legal or regulatory provisions; or
• informing data subjects was “impossible” or involved “disproportionate effort” or risked “making it impossible or seriously prejudicing the achievement of the purposes of the research” (Article 110, paragraph 1, second sentence of the Italian Privacy Code).

In cases under second point above, data controllers had to get prior approval from the Garante under Article 36 of the GDPR. They also had to get approval from the relevant ethics committee and implement “appropriate measures to protect the rights, freedoms and legitimate interests of the data subjects. ”

This requirement presented a significant impediment to scientific research, particularly for retrospective studies. These studies rely on pre-existing data (typically collected in regular clinical practice), where obtaining consent may be impossible because data subjects are unavailable or may even have died.

Article 36 of the GDPR stipulates that the Italian data protection authority should provide its opinion within a specified timeframe (ie within eight weeks of receiving the consultation request, extendable by an additional six weeks in the case of particularly complex processing). However, practical constraints often hindered timely responses, potentially prolonging the research process and increasing costs.

The requirement for prior approval from the Garante has been a deterrent for sponsors to conduct studies. We’ve helped multinational pharmaceutical companies that have decided not to conduct retrospective studies in Italy precisely because of this requirement, instead choosing jurisdictions that don’t have such restrictions and don’t require to get patients’ consent. These problems have now been overcome thanks to the amendment approved by the Italian Parliament.

This amendment is a welcome effort to streamline national legislation, aligning it with the overarching support for scientific research embedded in the GDPR. By eliminating unnecessary regulatory burdens, the amendment facilitates research endeavours while upholding data protection principles.

The decision of the Italian Parliament marks a crucial step in fostering a more conducive environment for retrospective scientific research by removing a data protection law requirement that’s a burdensome peculiarity of Italian data protection law.

Authors: Cristina Criscuoli

Intellectual Property

Conflict between Community designs and earlier trademarks: Design for snack packaging confirmed as invalid

In a recent decision, the Third Board of Appeal (Board) of the European Union Intellectual Property Office (EUIPO) confirmed the invalidity of a Community design relating to packaging for snacks (contested design). The contested design had already been declared invalid by the Cancellation Division of the EUIPO, which had found there was a likelihood of confusion with an earlier trademark. The earlier trademark was also intended to distinguish snacks and considered to be highly similar to one of the word elements on the packaging.

The Cancellation Division declared the contested design invalid on the basis of Article 25(1)(e) CDR, which provides that “a Community design may be declared invalid only in the following cases [...] (e) if a distinctive sign is used in a subsequent design and Community law or the law of the Member State concerned to which the distinctive sign is subject confers on its proprietor the right to prohibit its use,” read in conjunction with Article 36(2)(b) and (c) of the Romanian trademark law, which applied to the earlier trademark.

On the basis of those provisions, and in view of the similarity of the graphic representation of the verbal elements of the design and the trademark, the Commission considered that the similarity of those distinctive verbal elements of the two designs in three out of four letters outweighed their differences. The verbal element of the earlier mark is almost entirely reproduced in the contested design. Consequently, the Commission considered that there is a risk that the public may be misled into thinking that the contested design uses the earlier mark in the manner referred to in Article 25 pa. 1(e) CDR. This is also the case in view of the identity of the goods involved in the use of both signs and the fact that the earlier mark is used as an integral part of packaging for identical or similar goods.

The Commission pointed out that the graphic representation of the contested design relates to the front of food packaging intended for snacks or goods similar to those covered by the earlier mark. Since the packaging is strictly necessary for the use of those goods and is therefore related to them, it also found that they’re complementary.

The Commission found that there were differences between the design and the trademark. But those differences were not sufficient to exclude the likelihood of confusion between the designs used for identical or similar goods. The assumption was that the consumer, when confronted with the contested design used on the packaging of snacks for which the earlier mark is also registered, might believe that the goods had the same commercial origin. So, affixing a registered trademark to the packaging of the designated goods is an intended use inherent in the nature of that distinctive sign.

Author: Tamara D’Angeli

Audrey Hepburn trademark: Italian Supreme Court confirms commercial use

The lawsuit between a famous fashion house and the heirs of the famous actress and owner of the Audrey Hepburn trademark has been settled.

The recent decision of the Italian Supreme Court, dated 23 February 2024 shed light on a legal dispute concerning the use of Audrey Hepburn's name and image by a renowned Italian fashion brand, confirming what had already been established by the Court of Appeal of Florence in 2022. The decision rejects the claim for damages made by the heirs of the Belgian actress against the company for the alleged unauthorised use of their mother's name and the alleged counterfeiting of the registered trademark “Audrey Hepburn” for three different shoe models.

According to the Supreme Court, the fashion company had not infringed Hepburn's image rights, as the shoes in question had been created for the actress in 1959 and had become an icon of elegance over time. The court clarified that the use of a celebrity's name or image for commercial purposes can be accepted if there is also an informational intent.

The decision is based on the principles set out in Articles 6 and 7 of the Italian Civil Code, which recognise the right to one's name and the right to act against any unauthorised use by third parties that may cause undue prejudice,. It’s also based on Articles 2 and 22 of the Italian Constitution. According to the Italian Supreme Court, the fact that the use in question is commercial, and protected by Article 41 of the Italian Constitution and Article 16 of the Charter of Fundamental Rights the EU, does not automatically mean that the unauthorised use of a person’s name is undue prejudice. It could be justified by informative purposes, and therefore be protected by Articles 2 and 21 of the Italian Constitution, 10 ECHR, and Article 11 of the Charter of Fundamental Rights the EU.

In this case, it’s a fact that the shoes in question had been created, or in any case worn, by Hepburn. So the Italian Supreme Court held that the Court of Appeal had correctly balanced the interests at stake: even if the company’s purpose was commercial, the purpose of the communication in question, and therefore the use of Hepburn's name, was merely descriptive.

Author: Maria Vittoria Pessina

Innovation Law Insights is compiled by the professionals at the law firm DLA Piper under the coordination of Arianna Angilletta, Matteo Antonelli, Edoardo Bardelli, Carolina Battistella, Carlotta Busani, Giorgia Carneri, Maria Rita Cormaci, Camila Crisci, Cristina Criscuoli, Tamara D’Angeli, Chiara D’Onofrio, Federico Maria Di Vizio, Enila Elezi, Alessandra Faranda, Nadia Feola, Laura Gastaldi, Vincenzo Giuffré, Nicola Landolfi, Giacomo Lusardi, Valentina Mazza, Lara Mastrangelo, Maria Chiara Meneghetti, Deborah Paracchini, Maria Vittoria Pessina, Tommaso Ricci, Miriam Romeo, Rebecca Rossi, Roxana Smeria, Massimiliano Tiberio, Giulia Zappaterra.

Articles concerning Telecommunications are curated by Massimo D’Andrea, Flaminia Perna e Matilde Losa.

For further information on the topics covered, please contact the partners Giulio Coraggio, Marco de Morpurgo, Gualtiero Dragotti, Alessandro Ferrari, Roberto Valenti, Elena Varese, Alessandro Boso Caretta, Ginevra Righini.

If you no longer wish to receive Innovation Law Insights or would like to subscribe, please email Silvia Molignani.