1. For the purposes of this regulation, the following definitions shall apply:

a) Code: the Personal data protection code set out in Legislative Decree No. 196 of 30 June 2003;

b) contractor: any natural or legal person, entity or association that is party to a contract with a provider of publicly available telephone services for the provision of such services, or the recipient of such services, including by means of prepaid cards;

c) operator: any entity, natural or legal person, which, in its capacity as data controller pursuant to the General Data Protection Regulation (GDPR), intends to process the data under Article 129, paragraph 1, of the Code and national telephone numbers through the use of telephone or through paper mail for the purpose of sending advertising or direct sales materials or for carrying out market research or for business communication;

d) registry: the public opt-out registry referred to in Article 130, paragraph 3-bis of the Code, extended to national land-line and mobile numbers not included in the contractors’ list under Article 129 of the Code, in accordance with the provisions of Article 1, paragraph 2, of Law No. 5 of 11 January 2018;

e) contractors list: the lists under Article 129 of the Code;

f) registry manager: the Ministry of economic development or the third party to which the implementation and management of the service may be entrusted;

g) GDPR: Regulation (EU) No. 679/2016 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (General Data Protection Regulation);

h) h) advertising material: any form of message that is disseminated, in any way whatsoever, in the course of a commercial, industrial, craft or professional activity for the purpose of promoting the transfer of movable or immovable assets, the provision of works or services, or the creation or transfer of rights and obligations pertaining thereto.

1. This regulation governs the public opt-out registry referred to in Article 130, paragraph 3-bis, of the Code, with regard to the processing of numbers and corresponding postal addresses included in the contractors’ list, and in Article 1, paragraph 2, of Law No. 5 of 11 January 2018, with regard to the processing of all national land-line and mobile telephone numbers.

2. This regulation applies to the processing, by means of telephone communications by whatever means made, either through an operator or, pursuant to Article 1, paragraph 5 of Law no. 5 of 11 January 2018, by means of automated calling systems or calls without the intervention of an operator or through paper mail, for the purpose of sending advertising or direct sales material or for carrying out market research or commercial communication, of national land-line and mobile telephone numbers, whether or not they are included in contractors lists, and postal addresses included in the same lists, without prejudice to Articles 6, 7, 13 and 14 of the RGPD, the right to object under Article 21, paragraph 2, of the RGPD, and Law No. 5 of 2018.

3. The processing of data relating to national land-line and mobile telephone numbers and postal addresses included in the contractors lists, carried out for statistical purposes by the bodies and statistical offices belonging to the National Statistical System pursuant to Legislative Decree No. 322 of 6 September 1989, shall remain excluded from the scope of this regulation.

1. The Ministry of economic development shall establish, pursuant to Article 130, paragraphs 3-bis and 3-ter, of the Code, Law No. 5 of 11 January 2018, and the provisions set out in this regulations the public opt-out registry relating to the postal addresses included in the contractors’ lists and to all national land-line and mobile numbers, whether or not they are included in those lists.

2. The right of opt-out, under Article 21(2) of the GDPR, may be exercised by the contractor by subscribing to the registry referred to in paragraph 1 and shall be effective with regard to the processing of personal data referred to in this regulation carried out for the purpose of sending advertising materials, or for direct sales or for conducting market research or for commercial communication.

1. The Ministry of economic development provides for the implementation and management of the registry also by entrusting its implementation and management to third parties who fully assume its financial and organisational burdens, by means of a service contract, in compliance with the Public Contracts Code pursuant to Legislative Decree No. 50 of 18 April 2016. In the event of outsourcing to a third party, the service contract, in compliance with the GDPR, the Code and this regulation, shall provide, after consulting the Data protection authority to the extent of its area of competence, also with regard to the supervisory and control tasks referred to in Article 12, paragraph 1:
a) the general conditions for the effective and efficient performance of the service, the duration of the relationship, the obligations of the contractor;
b) the parameters for the calculation of fees in accordance with the provisions of the Ministry of economic development, based on the actual operating and maintenance costs of the registry;
c) the grounds for withdrawal, revocation and forfeiture, the guarantees to be provided and the liability of the contractor, as well as the fines for non-compliance;
d) the obligation of the assignee to guarantee the continuity of the service and the transfer of all data in the event of the takeover of a new assignee or in the event of a subjective change of the assignee;
e) the obligation to allow the exercise of supervisory and control activities by the Ministry of economic development, for the profiles pertaining to compliance with the outsourcing deed and the service contract, and by the Data protection authority, for the profiles falling within its area of competence.

2. The actual implementation and operation of the registry must also be ensured in the event that it is outsourced to a third party; for this purpose, the Ministry of economic development, also through the manager of the public opt-out registry:
a) within thirty days from the date of publication of this regulation, it shall ensure the conduct and conclusion of the consultation of the main operators and consumer associations represented in the National Council of Consumers and Users, pursuant to Article 136 of Legislative Decree No. 206 of 6 September 2005;
b) within one hundred and twenty days from the date of publication of this regulation it shall, in cooperation with the Department for digital transformation of the Presidency of the Council of ministers, also on the basis of the outcome of the consultations referred to in sub-paragraph (a), prepare and activate the technical and operational methods for the subscription, also electronic, to the registry by the contractors and for the operation and access, also electronic, to the registry, as well as verify the contact lists through its operators.

1. Each operator, in order to carry out the processing of national land-line and mobile telephone numbers, through the use of the telephone with or without the intervention of a human operator, or of the postal addresses listed in the contractors’ lists, through paper mail, for the purpose of sending advertising or direct sales materials or for carrying out market research or for commercial communication, shall file an application with the registry manager that must include:
a) documentation attesting to the identity of the operator: for natural persons, a valid identity document of the subject; for legal persons and entities, including unrecognised entities, an identity document of the pro-tempore legal representative, a deed of conferral of power of representation or office held by the holder, a deed of incorporation and articles of association; an attestation of the identity of the operator may also be made through the methods provided for by Legislative Decree No. 82 of 7 March 2005;
b) for only those operators who carry out the processing through the use of the telephone with or without the intervention of a human operator, a declaration of activation of the system of identification of the calling line to which they may be contacted or a declaration of the use of the specific codes or prefixes established by the Communication protection authority, in accordance with the provisions of Article 2, paragraph 1, of Law no. 5 of 2018, or, in the case of outsourcing to third parties the service of making the calls, the indication of the identification data of each subject who will materially take care of the contacts with the contractors;
c) the updated list(s) of contractors constituting the source of the personal data that the operator intends to process.

2. The registry manager, within fifteen days of the actual receipt of the application, assigns authentication credentials and authorisation profiles to the operator. The registry manager shall publish the operator’s identification details, including contact details, in a list that may be consulted on the public opt-out registry website for a period not exceeding twelve months from the last consultation of that registry. The operator shall notify the registry manager, without delay, of any change in the data communicated when submitting the application for access to the registry. The validity of the subscription to the registry ceases twelve months after the last consultation of the registry.

1. Operators required to consult the registry shall pay the registry manager access fees on an annual or other fractions of time basis, even of shorter duration, according to the operator’s requirements and within the limits set by the manager. The registry manager, if different from the Ministry of economic development, prepares annually the budget plan of the costs of operation and maintenance of the registry, including the proposed fees for the following year, and communicates it by 30 November to the Ministry of economic development. The aforementioned plan is approved by decree of the Minister of economic development pursuant to Article 130(3-ter)(b) of the Code. The periodic updating of fees is carried out in accordance with the general criteria established by the ministerial decree referred to in Article 1, paragraph 13, of Law No. 5 of 11 January 2018. Revenues from access fees to the registry constitute exclusive resources for the operation of the registry and may not be increased for profit by the manager. By decree of the Minister for economic development pursuant to Article 130, paragraph 3-ter, letter b) of the Code, the preliminary plan of costs and fees for the implementation, start-up, operation and maintenance of the registry – including what is necessary for the information campaigns under Article 11 – is determined following verification of the preliminary plan prepared annually by the manager.

2. In the event of direct management of the registry by the Ministry of economic development, the related fees are paid to the State budget to be reallocated to the corresponding items of the expenditure of the Ministry of economic development. The Ministry of economic development manages the registry using the human and instrumental resources available under current legislation.

1. Each contractor may request from the registry manager that the number of which it is the holder, whether or not included in the lists under Article 129 of the Code, or the corresponding postal address, included in the same lists, are subscribed to the registry in order to opt-out of the processing of such data for the purpose of sending advertising or direct sales material or for the performance of market research or for commercial communication, carried out by means of an operator using the telephone or paper mail as well as, for the revocation referred to in paragraph 7, by means of automated calling systems or calls without an operator. Subscription is free of charge when carried out as follows:
a) by filling in the appropriate electronic form on the website of the registry manager; in this case, the contractor is required to communicate the number to be subscribed to the registry, to prove its availability and to provide its e-mail address, in accordance with the technical methods described in Article 4, paragraph 2, letter b); the contractor’s identity may also be certified as provided for in Legislative Decree No. 82 of 7 March 2005;
b) by means of a call, made from the telephone line with the number corresponding to the number for which subscription to the registry is requested, to the telephone number set up for this purpose by the registry manager; the system works by means of an automatic responder, with the possibility for the contractor to obtain non-automated telephone assistance in the event of difficulties or problems in executing the subscription, or its renewal or withdrawal;
c) by electronic mail; in this case, the contractor is required to send an electronic form containing the number to be subscribed to the registry and to prove its availability.

2. The technical and operational modalities for subscribing to the registry under paragraph 1 may be further defined by decree of the Minister for economic development, after consulting the Data protection authority and, to the extent of its competence, the Department for digital transformation of the Presidency of the Council of ministers, in order to improve access to the service and in compliance with the parameters and technical specifications guaranteeing the operations of the registry.

3. In the event that the contractor is the holder of several numbers, it is possible to apply for their simultaneous subscription to the registry, provided that the modalities set out in paragraph 1 a) or c) are used. The registry manager shall provide tools for the contractor to verify its subscription to the registry.

4. Contractors subscribed under paragraph 1 may renew their subscription at any time. The renewal of subscription to the registry entails the revocation of the consent to the processing of one’s own number, as referred to in paragraph 7, that was given to the data controllers prior to the date of renewal of the subscription.

5. Contractors subscribed to the registry may revoke their opt-out to one or more operators at any time. Withdrawal of the opt-out allows data processing by the data controllers for the purpose of sending advertising or direct sales materials or for carrying out market research or for commercial communication:
a) of the number and the corresponding postal address, contained in the contractors’ lists, from the date of the annotation of the opt-out withdrawal;
b) of national numbers, if consent had been obtained after the most recent date of subscription or renewal of the subscription to the registry, provided that this was or will be done in compliance with Articles 6, 7, 13, 14 and 21(2) of the GDPR.

6. Subscription to the registry precludes any processing of postal addresses contained in contractors’ lists and of national land-line and mobile telephone numbers by operators for the purpose of sending advertising or direct sales material or for carrying out market research or for commercial communication, carried out by telephone or by paper mail, without prejudice to the provisions of the following sub-paragraphs.

7. With the subscription to the registry referred to in paragraph 1 and with the renewal of the subscription referred to in paragraph 4, following the explicit request of the contractors, all the consents previously provided, in whatever form or by whatever means, authorising the processing of national telephone numbers, whether or not included in the lists under Article 129 of the Code, carried out by means of telephone with or without operator for advertising or sales purposes or for the performance of market research or for commercial communication or by means of paper mail, shall be deemed to be revoked. With reference to specific contractual relationships to which the contractor is a party, Article 1(5) of Act No. 5 of 2018 applies.

8. Any contractor may subscribe or renew or withdraw without limitation. Subscription, renewal and withdrawal are carried out by the registry manager within one working day after receipt of the contractor’s request.

9. The subscription to the registry of a number or of the corresponding postal address in the contractors lists is for an indefinite period of time and ceases only in the event of revocation by the subscriber and holder of the phone line. The subscription of the contractor to the registry refers only to the number in his/her name and to the corresponding postal address, if any, and may not extend to numbers in the name of other contractors.

10. The registry manager shall comply with the organisational rules and modalities for the implementation and provision of a general telephone directory service established by the Communication protection authority for the provision of the services referred to in Article 98-vicies quinquies of Legislative Decree No. 259 of 1 August 2003, as amended by Legislative Decree No. 207 of 8 November 2021, or acquires the data contained in the aforementioned single database in force, and updates its data periodically, in order to verify whether or not the contractors applying for subscription, renewal or revocation are on the lists referred to in Article 129 of the Code. Within sixty days from the date of publication of this regulation, a decree of the Ministry of economic development, having consulted the Communication protection authority and the Data protection authority to the extent of its competence, shall define:
a) the specifications and technical and security requirements for the provision by telephone operators to the registry manager of land-line numbers not published in the lists of contractors under Article 129 of the Code, in accordance with Article 1(3) of Law No. 5 of 2018;
b) the way in which the numbers referred to in sub-paragraph (a) must be provided to the registry manager for the purpose of default subscription, if not already subscribed.

11. Numbers and the corresponding postal addresses already subscribed to the public opt-out registry on the date of the establishment of the registry under Article 3, paragraph 1, shall be deemed to be automatically included in the latter registry, without prejudice to the contractor’s right to renew or withdraw his opt-out after subscription.

12. The subscription to the public opt-out registry may take place at any time, without distinction as to the time of day and also on public holidays, at least with regard to automated methods. The registry manager is responsible for keeping a log, for twelve months from the time of their generation, of any access to the subscription, renewal or revocation systems, as well as of the operations for the subscription to or renewal or withdrawal in the public opt-out registry by contractors, in accordance with criteria of completeness, integrity, unalterability and verifiability. These records are protected by the registry manager against unauthorised access, so that they can only be accessed for inspection purposes by the Data protection authority or the judicial authority.

1. Each operator must align its technological infrastructure, used to interface with the registry, to the technological and operational standards set by the registry manager, after consultation with the main operators. Consultation of the public opt-out registry, by operators, shall be solely for the purpose of the proper performance of the obligations arising from paragraphs 3-bis, 3-ter and 3-quater of Article 130 of the Code, Law No. 5 of 2018 and this Regulation.

2. Operators using telephone advertising and telephone sales systems or carrying out market research or commercial communication by telephone, as well as through the use of paper mail, are required to consult the public opt-out registry on a monthly basis, and in any case before the start of each promotional campaign, and to update their lists. Consultation of the registry by each operator shall be effective for fifteen days for the processing of data for the purpose of sending advertising or direct sales material or for the performance of market research or for commercial communication by telephone, with or without an operator, and for thirty days for the processing of data for the same purposes by paper mail.

3. The way in which the registry is consulted must not permit the transfer of personal data contained in the registry itself, by providing automated systems enabling the registry manager to receive the operator’s electronic lists, compare it with the data contained in the registry and update it, making only the relevant information available again to the operator, in a special section of the website or by forwarding it by e-mail to the operator, without the latter being able in any way to extract the data contained in the registry. The registry manager shall process the selective query of each operator within twenty-four hours of receiving the request.

4. The registry manager shall determine in which specific electronic format the lists legitimately held may be forwarded for comparison with the registry and subsequent updating, also taking into account any technological developments.

5. Records of any event of access, updating of the lists and disconnection carried out by the operators, when accessing the system and updating the lists on the basis of the data contained in the registry, are kept by the registry manager for twenty-four months from the moment of their generation, according to the criteria of completeness, integrity, unalterability and verifiability. These records are protected by the registry manager against unauthorised access, so that they can only be accessed for inspection purposes by the Data protection authority or the judicial authority.

1. Operators and entities carrying out call centre activities targeting national telephone numbers are required, when making calls to contractors, for the purpose of sending advertising or direct sales materials or for carrying out market research or for commercial communication, to ensure the display of the caller line identification, in accordance with Article 2(1) of Law No. 5 of 2018.

2. The Communication protection authority governs and supervises compliance with the provisions referred to in paragraph 1 by applying, in the event of violation, the fines referred to in Article 2, paragraph 1, of Law No. 5 of 2018.

1. Even in the absence of a specific request by the contractor, the operators or the persons designated by them for that purpose shall, at the time of the call or in the advertising or direct sales materials or for the performance of market research or for commercial communication sent by paper mail, accurately indicate to the contractors that their personal data have been legitimately extracted from the lists of contractors referred to in Article 129 of the Code or from other sources, also providing the information necessary for the possible subscription by the contractors to the public opt-out registry. The information is also provided in the way specified by the Data protection authority in accordance with Article 12, paragraphs 7 and 8 of the GDPR.

1. Pursuant to Article 4 of Legislative Decree No. 206 of 6 September 2005, within the framework of the resources available for this purpose under the Fund provided for in Article 148 of Law No. 388 of 23 December 2000, the Ministry of economic development and the Presidency of the Council of ministers, in collaboration with the National Council of Consumers and Users, shall implement and promote an information campaign aimed at contractors, during the first six months of operation of the registry as from its actual implementation, for the purpose of promoting full awareness of their rights and the procedures for opting-out of data processing as regards sending advertising or direct sales materials or for carrying out market research or for commercial communication. For the same purposes, operators authorised to provide publicly available telephone services or those who carry out sales or sales promotions by means of paper mail shall make available to their contractors, or recipients of sales promotions, similar means aimed at raising awareness of their right to opt-out of the subscription to the public opt-out registry, and they must enter specific information in invoices or sales promotion documents.

1. The manager shall ensure access to the registry by the public administrations, where provided for by the legislation in force, and by the Data protection authority, in order to carry out controls on the organisation and operations of the registry itself, as well as for any other checks or inspections that may be necessary in accordance with the provisions of the GDPR and the Code.

1. In the event of a violation of the requirements of this regulation, the contractor shall avail itself of the forms of protection provided for in Chapter VIII of the GDPR and in Part III of the Code.

1. Presidential Decree No. 178 of 7 September 2010 shall be repealed as from the date of operation of the public opt-out registry, ascertained by order of the Minister for economic development to be published in the Official Gazette of the Italian Republic and in any case as from 31 July 2022.

2. Until the activation of the registry, telephone contractors, whose number is included in the contractors’ lists referred to in Article 129 of the Code, may exercise their right to opt-out to the use of their number or their corresponding postal address included in the same lists, by human operators, either by phone or by paper mail for the purpose of sending advertising or direct sales materials or for carrying out market research or for commercial communication, in accordance with the provisions of Presidential Decree No. 178 of 7 September 2010.

3. From the date of entry into force of this Regulation, any reference to Presidential Decree No. 178 of 7 September 2010 shall be deemed to refer to the corresponding provisions of this regulation insofar as they are compatible.

1. The implementation of this decree shall not result in new or increased burdens on the public finance. The administrations concerned shall fulfil the obligations provided for therein with the human, instrumental and financial resources available under current legislation. This decree, bearing the seal of the State, shall be included in the Official Compendium of Legal Acts of the Italian Republic. Everyone is required to comply and enforce it.