Italian DPA heavily fines TelCOs

Pushed by hundreds of reports and complaints about cases of wild marketing, the Italian Authority (the DPA) sanctioned Wind Tre Spa for around 17m euros for numerous illegal data processing, mainly related to promotional activities. For similar violations, the company had already been addressed of an injunction and prescriptive measure when the old Privacy Code was still in force in Italy.

The new decision was adopted following a complex preliminary investigation and inspection. Users complained of receiving unsolicited promotional contacts, made without consent via sms, e-mail, fax, telephone calls and automated calls. In numerous cases, moreover, the individuals declared that they had not been able to exercise their right to withdraw consent or to object to the processing of their data for marketing purposes (also due to inaccuracies in the indication of the contact channels present in the notice).

In other cases, the publication of personal data in public telephone directories was complained despite the (sometimes repeated) opposition of the interested parties.

The investigation also revealed that the MyWind and My3 apps were set up in such a way as to oblige the user to provide, at each new access, a series of consents for different processing purposes (marketing, profiling, communication to third parties, enrichment and geolocation). Beyond these system gaps, the investigations of the DPA have highlighted several serious offenses in the chain of Wind Tre's commercial partners, even with improper activation of contracts.

For these violations, one of the partners of the telephone operator - who had subcontracted (however without any formal contract in place) entire phases of the treatments to call-centers that collected the data illegally - was fined for Euro 200.000 by the DPA and he was sentenced with the prohibition to use the data collected and processed by agents present on the national territory (called procacciatori) in total disregard of the data protection rules.

The arguments brought in its defence by Wind Tre and the series of corrective measures implemented by the company, also regarding the centralization of promotional campaigns, were not considered adequate by the DPA.
In addition to sanctioning the telephone company for Euro 16,729,600, the DPA has prevented Wind to process the data acquired without consent and ordered it to adopt technical and organizational measures for effective control of the supply chain of the partners, as well as procedures to respect the will of the users not to be disturbed.

It is worth mentioning that DPA also examined the results of the investigations arranged against another telephone operator, Iliad Spa, which was found to be deficient in other respects, in particular regarding the methods of access for its own employees to traffic data and that for these reasons, it was sanctioned for 800,000 euros.