Italian DPA Fines Wind Tre €16.7 Million Over Unlawful Telemarketing and Data Governance Failures

Background and Scope of the Investigation

The Italian Data Protection Authority (Garante) opened an investigation into Wind Tre S.p.A. after receiving numerous complaints and reports from individuals about unsolicited promotional contacts and contracts or services activated without their knowledge. The inquiry focused on three areas: processing for telemarketing purposes, the procedures used by sales partners to conclude contracts, and the technical and organisational measures Wind Tre had in place to prevent unlawful processing across its distribution network.

Key Findings

The DPA identified multiple infringements tied to how Wind Tre handled marketing and contractual data. Individuals continued to receive promotional communications even after exercising their right to object, or in the absence of valid consent. The investigation also uncovered instances where contracts were activated without the individual's knowledge, constituting unlawful processing of personal data.

Beyond these specific incidents, the Garante found systemic shortcomings: Wind Tre's technical and organisational measures and its oversight of the sales network were insufficient to prevent unlawful processing or to promptly act on data subjects' requests. The decision cites infringements of core GDPR provisions, including Articles 5, 6, 12, 15, 21, 24, 25, and 32 — spanning lawfulness of processing, transparency, the right to object, accountability, data protection by design and default, and security of processing.

The Decision

The Garante imposed an administrative fine of €16,700,000 on Wind Tre. In addition to the fine, the authority issued a definitive ban on further processing of personal data that had been acquired without consent, and ordered the company to implement measures ensuring effective compliance with data subjects' rights — particularly the right to object to direct marketing. Wind Tre was also directed to strengthen the technical and organisational controls governing its sales network, along with the procedures used to verify the lawfulness of processing connected to promotional activities and contract activations.

The DPA emphasized that controllers operating through complex, multi-partner sales networks remain fully responsible for ensuring that personal data processed on their behalf complies with the GDPR, and must put in place effective safeguards to prevent unlawful marketing and unauthorized contractual activations.

What This Means

This decision is a reminder that outsourcing sales and marketing activities to third-party partners does not reduce a controller's accountability under the GDPR. Organizations that rely on indirect or franchised sales channels should treat this as a prompt to:

• Audit how opt-outs and objections to direct marketing are actually propagated and enforced across all sales channels and partners in real time, not just at the point of initial consent capture.
• Verify that contract activation processes include safeguards against unauthorized sign-ups, including identity and consent verification steps.
• Review technical and organisational measures for monitoring and auditing third-party sales partners, ensuring that control mechanisms are documented and tested, not merely contractual.
• Ensure data subject rights-handling processes (access, objection) are responsive and effective across the full organisational structure, including outsourced functions.

The size of the fine and the accompanying processing ban signal that regulators are prepared to combine financial penalties with operational remedies when systemic governance failures — rather than isolated incidents — are at issue.