Furthermore, the MyWind and My3 apps were set up in a way that upon access, obliged users to provide their consent for various data processing activities which included marketing, profiling, communication to third parties, geolocalization, and then allowing them to be revoked after 24 hours.
Serious problems concerning the the supply chain of Wind Tre’s business partners were also revealed, including the improper activation of contracts. For example, one partner of the telephone operator – “which had been sub-contracted out (in absence of a legal act) entire phases of processing to call-centres that unlawfully collected data – was fined 200,000 Euro by the DPA and was furthermore prohibited from using the data it collected and processed by agents present on the national territory (called “procacciatori”) in total disregard of the data protection regulations in force.” Also see here.
In addition to the 16,729,600 Euro sanction, the Italian DPA “prohibited Wind from processing the data acquired without consent and ordered it to adopt technical and organizational measures for effective control of the partners’ supply chain, as well as to enact procedures to respect the willingness of users not to be disturbed.”
The Italian DPA, in its 9 July meeting in which the above was determined, “also examined the results of the investigations against another telephone operator, Iliad, which was found to be deficient in other respects, particularly with regard to the methods of access by its employees to traffic data and which, for these reasons, was fined 800,000 Euro.”
Read the original press release from the Italian DPA, published on 13 July, here.