Italian DPA fines Wind Tre EUR 16,700,000 for unlawful telemarketing and data protection infringements

- Controller: Wind Tre S.p.A.

- Legal Reference(s): Article 5 (Principles relating to processing of personal data), Article 6 (Lawfulness of processing), Article 12 (Transparent information, communication and modalities for the exercise of the rights of the data subject), Article 15 (Right to access by the data subject), Article 21 (Right to object), Article 24 (Responsibility of the controller), Article 25 (Data protection by design and by default) and Article 32 (Security of processing)

- Decision: Administrative fine, Definitive ban on data processing, Compliance order

- Website topics: Data subjects rights, Basic principles, Legal basis, Marketing

The Italian Data Protection Authority (DPA) carried out an investigation into Wind Tre S.p.A. following numerous complaints and reports from individuals concerning unsolicited promotional contacts and the activation of contracts and services without their knowledge.

The investigation also concerned the effectiveness of the measures adopted by the company to ensure compliance with data protection rules throughout its sales network and to manage data subjects’ requests.

The Italian Authority examined, in particular, the processing carried out for telemarketing purposes, the procedures used to conclude contracts through sales partners and the technical and organisational measures implemented by Wind Tre to prevent unlawful processing.

The Italian DPA found several infringements concerning the processing of personal data for marketing and contractual purposes.

Individuals continued to receive promotional communications despite having exercised their right to object or without having given valid consent. The investigation also identified cases in which contracts were activated without the individuals’ knowledge, involving the unlawful processing of their personal data.

They found shortcomings in Wind Tre’s technical and organisational measures and in the controls implemented over its sales network. The company had not ensured that its systems and procedures were capable of effectively preventing unlawful processing and of promptly giving effect to data subjects’ requests.

The DPA also identified infringements concerning the principles of accountability, data protection by design and by default and security of processing.

The Italian DPA imposed an administrative fine of EUR 16 700 000 on Wind Tre S.p.A.

They also prohibited the further processing of personal data acquired without consent and ordered the company to adopt measures to ensure effective compliance with data subjects’ rights, particularly the right to object to processing for direct marketing purposes.

Wind Tre was also required to strengthen the technical and organisational measures governing its sales network and the procedures used to verify the lawfulness of data processing connected with promotional activities and the activation of contracts.