What Changed
- The Italian DPA fined Wind Tre S.p.A. EUR 16,700,000 for unlawful marketing and contract activations.
- The investigation established breaches of GDPR Articles 5, 6, 12, 15, 21, 24, 25, and 32 due to inadequate sales network oversight.
- A definitive ban on processing data acquired without consent was imposed alongside mandatory corrective orders for sales network procedures.
The Italian Data Protection Authority (DPA) has issued an enforcement decision against telecommunications controller Wind Tre S.p.A., imposing an administrative fine of EUR 16,700,000 alongside a definitive ban on data processing and a compliance order. The decision impacts telecommunications service providers, commercial sales network partners, and consumers whose personal data is processed for direct marketing and service activation.
The action originated from numerous complaints and reports submitted by individuals regarding unsolicited promotional contacts and the activation of contracts and services without their knowledge. Following an investigation into the company’s processing operations, the Italian DPA examined telemarketing practices, procedures used to conclude contracts via sales partners, and the technical and organizational measures implemented by Wind Tre S.p.A.
The authority identified several infringements under General Data Protection Regulation (GDPR) provisions, specifically Articles 5, 6, 12, 15, 21, 24, 25, and 32. The investigation established that individuals continued to receive promotional communications despite having exercised their right to object or without having provided valid consent. Furthermore, contracts were activated without the knowledge of individuals, involving the unlawful processing of their personal data.
The Italian DPA highlighted significant shortcomings in Wind Tre's technical and organizational controls across its sales network. The company failed to ensure that its procedures could effectively prevent unlawful processing or promptly fulfill data subject requests, resulting in breaches of accountability, data protection by design and by default, and security of processing.
In addition to the fine, the Italian DPA prohibited the further processing of personal data acquired without consent. The authority ordered Wind Tre S.p.A. to implement effective measures safeguarding data subject rights, particularly the right to object to direct marketing. Wind Tre S.p.A. must strengthen technical and organizational measures governing its sales network and enhance verification procedures for promotional activities and contract activations. The Italian DPA emphasized that data controllers utilizing complex sales networks remain fully responsible under the GDPR for ensuring compliance.
Who May Be Affected
Wind Tre S.p.A., commercial sales network partners, and telecommunications consumers in Italy.
Cross-Border Context
Applies EU GDPR standards to multinational telecommunications operators and commercial partner networks operating within EU Member States.
What to check next
- Verify the original decision on the Italian DPA (Garante per la protezione dei dati personali) official website.
This article provides general information and does not constitute legal advice. Consult the official text and obtain advice appropriate to your circumstances where needed.