# GDPR Violations: Multi-Million Euro Fine Against Wind Tre > Italy’s data protection authority fines Wind Tre for unlawful telemarketing, inadequate sales controls and security deficiencies. Source: https://www.mtrlegal.com/en/gdpr-violations-million-euro-fine-against-wind-tre/ · Language: en · Updated: 2026-10-26 --- ## Italian Data Protection Authority Imposes Multi-Million Euro Fine on Wind Tre The Italian data protection authority imposed a fine of EUR 16.7 million on Wind Tre S.p.A. for unlawful data processing in connection with telephone marketing and the conclusion of contracts. It also prohibited the further processing of personal data collected without consent and ordered measures to ensure compliance with data subject rights. According to the authority’s findings, the provisions affected included, in particular, Art. 5, 6, 12, 15, 21, 24, 25 and 32 of the General Data Protection Regulation (GDPR). Among other matters, these provisions concern the principles and lawfulness of processing, information and access obligations, the right to object, as well as the responsibility of the controller, data protection by design and the security of processing. ## Complaints Concerning Advertising and Unknown Contract Conclusions ### Unsolicited Marketing Contacts as the Starting Point The investigation was preceded by numerous complaints and reports from individuals who had received unsolicited marketing communications. The proceedings also concerned cases in which contracts or services were allegedly activated without the knowledge of the data subjects. In particular, the authority investigated: - the processing of personal data for telemarketing purposes, - the procedures used through sales partners to conclude contracts, - the handling of requests and objections submitted by data subjects, - Wind Tre’s supervision of its sales network, - the technical and organisational measures used to prevent unlawful processing. The investigation was therefore not limited to individual marketing calls. It also covered the organisational processes and control mechanisms within the sales model. ### Marketing Despite Objection or Without Valid Consent According to the findings of the Italian data protection authority, individuals continued to receive marketing communications even though they had objected to the processing of their data for direct marketing purposes. In other cases, no valid consent had been obtained for marketing communications. The investigation also found that contracts had been activated without the knowledge of the respective data subjects. The authority deemed the associated processing of personal data unlawful. ## Deficiencies in Systems and Sales Controls ### Data Subject Rights Not Effectively Implemented The data protection authority identified deficiencies in the technical and organisational measures and in the monitoring of the sales network. In its assessment, the systems and internal procedures were not sufficiently designed to effectively prevent unlawful data processing. At the same time, there was no assurance that requests from data subjects would be implemented promptly. The right to object under Art. 21 GDPR was particularly significant in this regard. An objection to the [processing of personal data for direct marketing purposes](https://www.mtrlegal.com/dsgvo-bussgeld-gegen-bbva-wegen-direktmarketing/) must actually be observed throughout the systems and sales channels used. ### Responsibility Remains with the Controller The authority also identified infringements of the accountability obligation, of data protection by design and by default, and of the requirements concerning the security of processing. These obligations apply to the controller even where it uses an extensive network of external partners for sales activities. In the opinion of the Italian data protection authority, even within complex sales structures, a company remains responsible for ensuring that personal data is processed throughout the network in accordance with the GDPR. This requires effective technical and organisational safeguards that prevent unlawful marketing activities and unauthorised contract activations. ## Fine, Processing Ban and Further Orders The Italian data protection authority imposed a fine of EUR 16.7 million on Wind Tre. It also prohibited the further processing of personal data obtained without consent. Wind Tre was also required to take measures to effectively safeguard the rights of data subjects. This related in particular to objections to the processing of personal data for direct marketing purposes. Furthermore, the company was required to strengthen the technical and organisational measures applicable to its sales network. The order also covered the procedures used to assess the lawfulness of data processing in connection with marketing activities and contract activations. ## Separate Proceedings Concerning a Personal Data Breach ### Separate Fine of EUR 1,715,600 A further decision by the Italian data protection authority against Wind Tre must be distinguished from the telemarketing proceedings. By order dated 14 May 2026, it imposed a separate fine of EUR 1,715,600 due to security deficiencies. According to the authority, this corresponded to 0.04 percent of turnover and one percent of the statutory maximum fine. The proceedings were initiated against Wind Tre by letter dated 6 October 2025 pursuant to Art. 166(5) of the Italian Data Protection Code. The company had previously reported two personal data breaches itself. ### Data of More Than 365,000 Customers Affected The incidents affected the master data and contact details of more than 365,000 customers. For 41,359 individuals, the affected information also included payment data. This comprised details concerning postal payment slips and bank accounts, as well as partially masked credit card numbers, including the respective expiry dates. The authority based its findings in particular on Art. 5(1)(f) GDPR concerning the principle of integrity and confidentiality and Art. 32(1)(b) GDPR concerning the assurance of an appropriate level of protection. These proceedings concern a separate set of facts and must be considered separately from the penalty imposed for telemarketing and sales-related infringements. ## Data Protection Law Implications for Companies The decisions illustrate the scope of data protection responsibility in sales models involving a division of responsibilities. Engaging independent sales partners does not release the controller from its obligation to ensure lawful processing operations, effective control mechanisms and the actual implementation of data subject rights. Companies, investors and private individuals seeking to clarify questions concerning data protection obligations, marketing activities or data subject rights can obtain [legal advice on data protection law](https://www.mtrlegal.com/rechtsberatung/it-recht/datenschutz/) from MTR Legal Rechtsanwälte tailored to the specific circumstances of their case.