If you are in the European Union, the publisher is breaking the law (regardless of where they are based). Some organisations break the law as a calculated move, but most that do do so "accidentally": owing to the ignorance, incompetence or arrogance of employees, or to procedural failings. This kind of situation can often be resolved with an email.
In this email, you may optionally CC your GDPR supervisory authority, and/or the supervisory authority of the publisher's EU headquarters (if they have one). The Italian DPA maintains a list of DPAs. Many data protection authorities have policies you should follow before contacting the supervisory authority; for example, the UK's ICO requires 30 days' notice (and ongoing engagement) before escalating. Do keep these in mind.
To: Publisher's Legal Department <[email protected]>
CC: Editors <[email protected]>; Own Country Supervisory Authority <[email protected]>; Publisher Country Supervisory Authority <[email protected]>
Subject: Refereeing without additional data processing
Dear Publisher's Legal Department,
I would like to accept this invitation to referee for Name of Journal, but I object and do not consent to the use of my personal data for these additional purposes. Per GDPR §7.3 and §7.4, please allow me to accept the invitation to referee.