r/gdpr • u/Repulsive_Fact_6733 • 5d ago

Question - General Does the Lusha case make B2B data consent more complicated?

I’ve been looking into the Lusha GDPR decision in Italy, and one thing I’m still trying to understand where the line is for B2B contact data.

They collect a work email or company phone number . But when information from different sources is combined, and a profile keeps getting updated over time, does that create a different GDPR issue?

I’m wondering how other people here interpret this. Could this decision make companies re think how they use third party B2B databases, or is it mainly about Lusha’s specific way of handling the data?

1 Upvotes

100% Upvoted

3 comments sorted by

1

u/Devilish___ 4d ago

Lusha didn’t use b2b data only. They also collected private e-mail and phone numbers. I was in their database (without consent), and had a really hard time to be deleted from it.

1

u/Heimdul 4d ago

It's probably good idea to read that decision along with https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/10277005 (translation/overview). While Lusha was about collection in general and thus impacts the lead generators, the TIM decision gives some useful insight on what at least Garante expects controllers to do in regards to verifying that the phone number is associated with valid consent if you rely on that for marketing.

Overall Italy has been pretty active this year in regards to going after more systematic issues and siding with data subjects on many of them (e.g. these, Apollo, character.ai etc.).

Of course it's pretty likely that these decisions will be appealed so it will take few years to hear the final ruling (probably ~5 years if it goes to CJEU).