Italian DPA fines Wind Tre EUR 16 700 000 for unlawful telemarketing and data protection infringements

The investigation also concerned the effectiveness of the measures adopted by the company to ensure compliance with data protection rules throughout its sales network and to manage data subjects’ requests. The Italian Authority examined, in particular, the processing carried out for telemarketing purposes, the procedures used to conclude contracts through sales partners and the technical and organisational measures implemented by Wind Tre to prevent unlawful processing. The company had not ensured that its systems and procedures were capable of effectively preventing unlawful processing and of promptly giving effect to data subjects’ requests. They also prohibited the further processing of personal data acquired without consent and ordered the company to adopt measures to ensure effective compliance with data subjects’ rights, particularly the right to object to processing for direct marketing purposes. Wind Tre was also required to strengthen the technical and organisational measures governing its sales network and the procedures used to verify the lawfulness of data processing connected with promotional activities and the activation of contracts. The Italian DPA stressed that controllers https://gpdp.it/home/docweb/-/docweb-display/docweb/10272004#1using complex sales networks remain responsible for ensuring that personal data are processed in compliance with the GDPR and must implement effective technical and organisational measures to prevent unlawful marketing activities and unauthorised contractual activations.