All news
Enforcement October 12, 2026 5 min

Italian DPA fines Wind Tre €16.7 million: telemarketing despite objections and contracts activated without customers' knowledge

Definitive ban on processing data collected without consent and mandatory measures on the sales network. Decision of 5 June 2026, published by the EDPB on 12 October

TL;DR

By a final decision of 5 June 2026, published by the EDPB on 12 October, the Italian Garante fined Wind Tre S.p.A. €16.7 million. Promotional calls after an objection or without valid consent, contracts activated without people's knowledge, insufficient technical measures and controls over the sales network, data subject requests not handled effectively. Besides the fine: a definitive ban on processing data collected without consent and an order to strengthen the measures. Articles infringed: 5, 6, 12, 15, 21, 24, 25 and 32 GDPR.

How the case began

The investigation started from numerous complaints and reports: unwanted promotional contacts and contracts and services activated without the individuals being aware. The Garante examined telemarketing processing, the procedures through which commercial partners conclude contracts and the measures Wind Tre should have used to prevent unlawful processing and act on data subjects' requests.

What the Garante found

  • OBJECTION IGNORED. People who had exercised their right to object, or had not given valid consent, kept receiving promotional communications (Arts. 6 and 21).
  • CONTRACTS WITHOUT KNOWLEDGE. In some cases contracts were activated without the person knowing, involving unlawful processing of their data.
  • SALES NETWORK. Inadequate technical and organisational measures and controls over commercial partners: the systems did not effectively prevent unlawful processing.
  • RIGHTS. Data subjects' requests, including access, were not handled with due promptness (Arts. 12 and 15).
  • ACCOUNTABILITY. Infringement of accountability, data protection by design and security (Arts. 24, 25 and 32).

The sales network is not a shield

The Garante says it explicitly: those selling through complex commercial networks remain responsible for GDPR compliance and must adopt effective measures to prevent unlawful marketing and unauthorised activations. The contract with the agency does not transfer the controller's responsibility.

What it means for the DPO

Five checks

One: an objection to marketing must propagate to every system and every partner, with a periodic check that an objecting person is no longer contacted. Two: for each agency, an Article 28 contract with written instructions on the lists to use and the consent to collect. Three: sample audits of contracts concluded by the network, with proof of the customer's intent. Four: timelines and a procedure for data subject requests, with a log showing the dates. Five: measures must be documented and reviewed, because they are the first thing the authority asks for.

This is not the first 2026 decision on Wind Tre: in July the Garante had already fined it €1.7 million for a data breach. Two different decisions with a common thread: technical and organisational measures had not kept pace with the size of the network.

Looking for a workspace for your DPO work?

DPO Workspace is built by a certified DPO. 30-day free trial.

Start free

Related articles

Enforcement
€350kto controller and processor over outdated systems

Greece: €350,000 for a data breach — both the Ministry and the processor running outdated systems fined, and there was no Article 28 contract

An attack on the systems of the agency running a Ministry's programmes exposed identification, financial and health data of a very large number of people. The Hellenic DPA fines the controller €200,000 and the processor €150,000: notifying well is not enough if the supplier works on outdated systems and the relationship is not governed by a contract.

Oct 08, 2026New 5 min
Enforcement
€4kfor a camera pointed at a home

Italian DPA fines the municipality of Arvier €4,000: a camera filmed a resident's windows and balconies, and the masking came too late

A small municipality in the Aosta Valley uses cameras for traffic, parking, number plates, the environment and civil protection. A resident finds that one covers her home. The Garante imposes a fine and makes a point that applies to every system: masking private areas is designed before the camera is switched on, not after the complaint.

Oct 08, 2026New 5 min
Enforcement
1 mesehow long the mailbox of someone who has left may survive, and not a day longer

The mailbox of someone who left: the processing nobody documents

In decision 101/2026 of 12 May 2026 the Litigation Chamber of the Belgian data protection authority sanctioned a company that had left a former collaborator's professional mailbox active for over a year after departure. The findings go beyond retention: processing without a basis, failure of transparency, absence of technical and organisational measures for deletion, failure to honour the right of access. The authority's line has been constant for years and comes down to two dates: deactivation on the day of departure, deletion after one month.

Oct 10, 2026New 7 min