Page 30 - CBM22

~ Go Global Ecommerce ~

the compliance of third-party suppliers through external Data management is also a central theme: large-scale
audits, to share collected data with research authorities transfers of users’ personal data will only be legitimate with
and to provide codes of conduct. Basically, with the Digital providers that comply with European standards, including
Markets Act and the Digital Services Act, large companies those outside the EU and, in particular, those based in
will be subject to increasing constraints on transparency and the US. This will encourage European operators either to
diligent management, while small startups will enjoy greater interface with partners within the EU space or to press for
collaboration from platforms. their US counterparts to sign contracts that provide for
compliance with European provisions on the processing and
The selection and highlighting of offers, the user protection of the information sent. This will not be a simple
profiling and the personalisation of prices based on reorganisation of the relationships with providers, as most
consumer preferences are just some of the areas touched of those to which European companies turn every day are in
upon, however, by the Omnibus Directive (new deal for the United States.
consumers), which is scheduled to come into force in 2022.
Businesses will need to ensure that the answers to several In addition, the entire chain of personal data processing
questions are readily available: are you buying from a private will be regulated in relation to consent, thus increasing
individual or a professional? Are search results offered to the burden in the management of lead generation. In
consumers based on deliberate consumer input? Or are they particular, the legislation will intervene with regard to the
filtered by algorithms that monitor and analyse preferences modification of cookies other than those necessary, for
and habits? How are offers classified? What are the which it will be essential to collect and record consent,
selection and highlighting criteria? Is a price personalisation which in any case will be limited in time. The importance
based on an automated profiling process being applied? of responsibility with respect to third-party operators
Either way, standardisation is no longer viable and, rather, returns here, which, together with fair play and transparency,
it will be necessary to adapt privacy solutions on a case-by- represents a characteristic trait of the most recent regulatory
case basis. tendencies. In fact, it will be necessary to make sure that
the subjects to whom lead generation is entrusted meet
Moreover, these issues also affect free service providers: certain parameters: all the steps and subjects involved in the
indeed, even where there is no economic transaction, process of data collection and database construction must be
consumers give up their data in exchange for the service, specifically regulated. For example, the person who initiated
and these data can be monetised later. Of course, one of the the campaign will have the duty of ensuring that those
main consequences of these new rules is the burdening of collecting the data, particularly for marketing purposes, have
the purchasing process, as all this information will have to adequately informed the data subject and collected their
be highlighted at the time of payment. In fact, it will not express consent.
be enough to intervene in the general conditions of sale
provisions, but all the elements pointed out here will have Failure to meet the obligations outlined here carries
to be manifest and easily accessible to the consumer who, in significant risks for companies. As far as Italy is concerned,
most cases, has not been aware, until now, of how their data it is possible to give an example of an important measure
is collected and used and that this practice is commonly that already represents a real case study at this stage: the
used. Privacy Guarantor, in fact, has already adopted a sanction
against a company that had entrusted the management of
Also included in the directives are more classic issues, lead generation campaigns to a supplier company which,
such as protection against unfair commercial practices. For in turn, transmitted the data to another company without
example, if the proposed price has been calculated on the the chain being regulated. In addition, the Guarantor
basis of the user’s preferences without this being specified, announced that by June 2022, a control plan will be
the consumer will now be able to ask for compensation activated that includes as many as 60 inspections with the
without necessarily stopping at an injunction. Sanctions support of the Finance Police. The inspections will concern
will also be applied against companies that, in dealing the processing of personal data against database providers,
with cross-border commerce, commit a significant volume the proper management of cookies, the processing of
of violations to the detriment of a large number of personal data and analysis conducted through algorithms
consumers in different EU countries: in these cases, national and artificial intelligence, and the correct identification of
authorities will be able to request compensation up to 4% the persons in charge of the processing of collected data. No
of the turnover, following the same model that is already aspect of the new directives will be exempt from scrutiny,
applied in relation to the violation of users’ privacy. At the and it is therefore essential that companies that haven’t yet
moment, the provisions relating to representative actions, done so proceed to comply as soon as possible.
those actions carried out by representative consumer bodies
and not by individuals, such as, for example, consumer In harmony with the changes in political sensitivity and
associations, remain unchanged. public opinion on the subject, the latest regulatory changes

30