The Italian Data Protection Authority has continued its investigation into telephone operators following a significant number of complaints related to marketing activities, fining Wind Tre Spa approximately 17 million Euro for unlawful data processing. In the course if its investigation, the authority found that users had been contacted by SMS, email, fax, phone and automated calls in absence of having provided their consent.  It was also found that users were unable to revoke previously provided consent or to object to their processing for marketing purposes, partially due to inaccuracies in the contact information published in the relative privacy policy. 

Furthermore, the MyWind and My3 apps were set up in a way that upon access, obliged users to provide their consent for various data processing activities which included  marketing, profiling, communication to third parties, geolocalization, and then allowing them to be revoked after 24 hours.

Serious problems concerning the the supply chain of Wind Tre’s business partners were also revealed, including the improper activation of contracts. For example, one partner of the telephone operator – “which had been sub-contracted out  (in absence of a legal act) entire phases of processing to call-centres that unlawfully collected data – was fined 200,000 Euro by the DPA and was furthermore prohibited from using the data it collected and processed by agents present on the national territory (called “procacciatori”)  in total disregard of  the data protection regulations in force.” Also see here.

In addition to the  16,729,600 Euro sanction, the Italian DPA “prohibited Wind from processing the data acquired without consent and ordered it to adopt technical and organizational measures for effective control of the partners’ supply chain, as well as to enact procedures to respect the willingness of users not to be disturbed.”

The Italian DPA, in its 9 July meeting in which the above was determined, “also examined the results of the investigations against another telephone operator, Iliad, which was found to be deficient in other respects, particularly with regard to the methods of access by its employees to traffic data and which, for these reasons, was fined 800,000 Euro.”

Read the original press release from the Italian DPA, published on 13 July, here.