The Regulation will come into force on 13 April 2022, but will definitely repeal the current regulation of the DNCR (Presidential Decree no. 178 of 2010) by 31 July 2022, when the new DNCR shall be established in accordance with the Regulation. The Ministry of Economic Development is in charge for the institution of the new DNCR, subject to a public consultations of the main operators and consumer associations.

Below an overview of the main novelties introduced by the Regulation, compared to the current regime:

• by enrolling in the DNCR, users will be able to object to the receipt of direct marketing communications via mobile and landline phone numbers, regardless of whether they are included in public directories, as well as mail addresses when reported on such directories;
• the enrolment in the DNCR results in the withdrawal of any consent previously provided to communications concerning advertising, direct selling, commercial communication market research by phone or mail. This applies without prejudice to consents granted in the context of agreements for the supply of good or services still in place, or terminated no later than thirty days earlier, in which case the withdrawal right is in any way granted with simplified procedures;
• the enrolment lasts indefinitely, but users can withdraw from it. The withdrawal can be limited to one or more operators, and becomes effective (i) for phone numbers and mail addresses in public directories, from the date in which the withdrawal is registered; (ii) for phone numbers, from the date in which consent has been collected in compliance with the GDPR after the enrolment in the DNCR.

The Italian DPA will have access to the DNCR for the ensuring compliance with GDPR and Italian Code of Privacy.

Next steps

Operators  which intend to send marketing communications will need to:

• submit a request to obtain the access credentials to the entity managing the DNCR;
• consult every month and, in any case, at the beginning of a promotional campaign, the DNCR and update their contact lists accordingly. Such a consultation is effective for (i) 15 days with regards to communications by phone; and (ii) 30 days with regards to communications sent by mail;

inform the user, during the phone call or communication sent via mail, (i) that their personal data have been lawfully extracted by a public directory, or obtained by other sources; and (ii) about the modalities to enrol in the DNCR.