Support Centre

Italy: Garante fines Wind Tre €16.7M for unlawful direct marketing practices, highlights consent violations

The Italian data protection authority ('Garante') announced, on 13 July 2020, that it had issued a decision ('the Decision') fining Wind Tre S.p.A. €16.7 million for several unlawful data processing activities in relation to direct marketing practices. In particular, Garante outlined that hundreds of complainants claimed that they received unsolicited communications, sent without their previous consent, through SMS, email, phone calls, and automated calls. In addition, Garante highlighted that the individual claimants argued that they have not been able to exercise their right to withdraw consent and to oppose the processing for direct marketing purposes, since the information contained in the privacy policy was incomplete in relation to the means of contact used. Moreover, Garante stated that the claimants' data was published on telephone public lists despite their opposition. Furthermore, Garante found that Wind Tre's apps 'MyWind' and 'My3' were set in order to oblige the user to provide his/her consent for different processing activities with every access, leaving the possibility to withdraw the same only after 24 hours. In addition, Garante pointed that Wind Tre presented various deficiencies in the management of third-party partners, even in relation to the unlawful activation of contracts.

As a result, Garante found that Wind Tre's conduct amounted to a violation of Articles 5(1) and (2), 6(1)(a), 12, 24, and 25 of the General Data Protection Regulation (Regulation (EU) 2016/679) ('GDPR'). Moreover, Garante prohibited Wind Tre's processing of data collected without consent, as well as ordering the adoption of adequate technical and organisational measures to effectively control third-party partners.

You can read the press release here and the Decision here, both only available in Italian.

UPDATE (28 July 2020)

EDPB issues statement on Garante's fine against Wind Tre

The European Data Protection Board ('EDPB') issued, on 27 July 2020, a statement on the Decision.

You can read the statement here.