[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fEJ50IhtJzP_756DYKeiDkCUpyalF00DLfJIfj5qlZak":3},{"article":4,"iocs":35,"watch_terms":36,"solutions":37,"lesson":115},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":20,"category":21,"article_tags":24},"82966714-7b41-42c3-8a5c-a8499c7af9a9","Italian DPA fines Wind Tre EUR 16 700 000 for unlawful telemarketing and data protection infringements","italian-dpa-fines-wind-tre-eur-16-700-000-for-unlawful-telemarketing-and-data-pr-452590","Italian DPA fines Wind Tre EUR 16 700 000 for unlawful telemarketing and data protection infringements ikerinar Mon, 12\u002F10\u002F2026 - 13:26","The Italian Data Protection Authority (DPA) has fined Wind Tre S.p.A. EUR 16,700,000 for numerous data protection infringements, including unlawful telemarketing and activating contracts without customer consent. The investigation revealed that individuals received promotional communications despite objecting, and contracts were activated without their knowledge. The DPA also found shortcomings in Wind Tre's technical and organizational measures, particularly concerning its sales network.","Italian DPA fines Wind Tre EUR 16.7M for unlawful telemarketing and data protection infringements.","https:\u002F\u002Fwww.edpb.europa.eu\u002Fnews\u002Fitalian-dpa-fines-wind-tre-eur-16-700-000-for-unlawful-telemarketing-and-data-protection_en",null,"2026-10-12T11:26:51+00:00","2026-10-12T12:00:21.430304+00:00",7,[17],{"name":18,"type":19},"Wind Tre","vendor","c5c77cdb-f7d7-4990-9436-c81dcbff1163",{"id":20,"icon":12,"name":22,"slug":23},"Policy","policy",[25,30],{"category":26},{"id":27,"icon":12,"name":28,"slug":29},"3f0f8451-91df-4b6c-9a73-ef3b2509b7f1","GDPR","gdpr",{"category":31},{"id":32,"icon":12,"name":33,"slug":34},"d95477d7-eb04-4fad-a2dc-be1428040ce7","Privacy Fines","privacy-fines",[],[18],{"controls":38,"vendors":114},[39,68,97],{"slug":40,"name":41,"problem":42,"products":43},"identity-governance","Identity governance and single sign-on","People who leave or change roles lose access everywhere at once, and forgotten accounts stop piling up.",[44,52,60],{"vendor_slug":45,"vendor_name":46,"vendor_logo":47,"product_slug":48,"product_name":49,"url":50,"description":51},"sailpoint","SailPoint","\u002Fvendor-logos\u002Fsailpoint.png","human-fabric","SailPoint Human Fabric","https:\u002F\u002Fwww.sailpoint.com\u002Fproducts\u002Fhuman-fabric","Identity governance platform, the successor to Identity Security Cloud: lifecycle management, access requests and continuous access reviews.",{"vendor_slug":53,"vendor_name":54,"vendor_logo":55,"product_slug":56,"product_name":57,"url":58,"description":59},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","entra-id","Microsoft Entra ID","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fidentity-access\u002Fmicrosoft-entra-id","Cloud identity and access management with single sign-on, conditional access, passkeys and identity governance.",{"vendor_slug":61,"vendor_name":62,"vendor_logo":63,"product_slug":64,"product_name":65,"url":66,"description":67},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","workforce-identity","Okta Workforce Identity","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fworkforce-identity\u002F","Single sign-on, adaptive MFA including phishing-resistant methods, and lifecycle management for employees.",{"slug":69,"name":70,"problem":71,"products":72},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.",[73,81,89],{"vendor_slug":74,"vendor_name":75,"vendor_logo":76,"product_slug":77,"product_name":78,"url":79,"description":80},"netskope","Netskope","\u002Fvendor-logos\u002Fnetskope.png","netskope-dlp","Netskope DLP","https:\u002F\u002Fwww.netskope.com\u002Fproducts\u002Fdata-loss-prevention","Data loss prevention for web, cloud apps, AI tools and endpoints.",{"vendor_slug":82,"vendor_name":83,"vendor_logo":84,"product_slug":85,"product_name":86,"url":87,"description":88},"proofpoint","Proofpoint","\u002Fvendor-logos\u002Fproofpoint.png","enterprise-dlp","Proofpoint Enterprise DLP","https:\u002F\u002Fwww.proofpoint.com\u002Fus\u002Fproducts\u002Fdata-loss-prevention","Data loss prevention across email, cloud and endpoints.",{"vendor_slug":90,"vendor_name":91,"vendor_logo":92,"product_slug":93,"product_name":94,"url":95,"description":96},"forcepoint","Forcepoint","\u002Fvendor-logos\u002Fforcepoint.png","forcepoint-dlp","Forcepoint DLP","https:\u002F\u002Fwww.forcepoint.com\u002Fproduct\u002Fdlp-data-loss-prevention","Data loss prevention for endpoints, network, email and cloud applications.",{"slug":98,"name":99,"problem":100,"products":101},"compliance-automation","Compliance automation (GRC)","Evidence for NIS2, DORA and ISO 27001 is collected continuously, not in a rush before the audit.",[102,108],{"vendor_slug":103,"vendor_name":104,"vendor_logo":105,"product_slug":103,"product_name":104,"url":106,"description":107},"drata","Drata","\u002Fvendor-logos\u002Fdrata.png","https:\u002F\u002Fdrata.com\u002F","Continuous control monitoring and audit readiness across security frameworks.",{"vendor_slug":109,"vendor_name":110,"vendor_logo":111,"product_slug":109,"product_name":110,"url":112,"description":113},"vanta","Vanta","\u002Fvendor-logos\u002Fvanta.png","https:\u002F\u002Fwww.vanta.com\u002F","Automated evidence collection and continuous monitoring for ISO 27001, SOC 2, NIS2 and other frameworks.",[],{"slug":116,"title":117,"body":118,"framework_refs":119,"framework_notes":133},"wind-tre-fined-167m-for-unlawful-telemarketing-and-consent-failures","Wind Tre Fined €16.7M for Unlawful Telemarketing and Consent Failures","Wind Tre S.p.A. was found to have conducted promotional communications to individuals who had explicitly objected, and activated contracts without customer knowledge or consent — both serious violations of GDPR principles. The root failures stem from inadequate data governance, poor enforcement of opt-out requests, and insufficient oversight of third-party sales networks. This matters because organisations are legally obligated to honour data subject rights and ensure consent is verifiable, lawful, and respected throughout their entire distribution chain. The scale of the fine (€16.7M) reflects how systemic, rather than isolated, these failures were across Wind Tre's operations.",[120,121,122,123,124,125,126,127,128,129,130,131,132],"GDPR Article 6 – Lawfulness of processing","GDPR Article 7 – Conditions for consent","GDPR Article 17 – Right to erasure","GDPR Article 21 – Right to object","GDPR Article 24 – Responsibility of the controller","GDPR Article 25 – Data protection by design and by default","GDPR Article 28 – Processor obligations","GDPR Article 32 – Security of processing","NIST Privacy Framework PR.DS-P (Data Subject Rights)","NIST SP 800-53 AC-2 – Account Management","CIS Control 3 – Data Protection","CIS Control 14 – Security Awareness and Skills Training","ITIL Service Design – Information Security Management",{}]