TIM Fined €9.5M for Unlawful Telemarketing and Partner Oversight Failures
TIM S.p.A. was fined nearly €9.5 million by Italy's data protection authority for conducting unsolicited telemarketing calls disguised through a 'Leads' generation process, effectively circumventing consent requirements under GDPR. The company failed to exercise adequate supervision over its third-party sales partners, allowing unlawful data processing practices to persist unchecked throughout its supply chain. Critically, TIM also failed to honor data subject rights, as users continued to receive marketing calls even after formally objecting, demonstrating a systemic breakdown in rights-request handling. This case illustrates that GDPR accountability extends fully to a company's partners and processors, not just its own internal operations.
Tactical Insight
Immediate actions
- Audit all active telemarketing campaigns and third-party sales partners to verify that valid, documented consent exists for every contact.
- Implement a centralized suppression list that is updated in real time and shared with all partners to immediately stop communications after an opt-out or objection is received.
Third-party and supply chain controls
- Establish contractual Data Processing Agreements (DPAs) with all sales and marketing partners that include enforceable compliance obligations and regular audit rights.
- Conduct periodic compliance assessments of partner activities, including sampling of call records and consent documentation, to detect unlawful practices early.
- Terminate or remediate partner relationships promptly where non-compliance is identified.
Long-term governance improvements
- Deploy a dedicated Data Subject Rights (DSR) management platform to ensure all objection, erasure, and access requests are logged, tracked, and fulfilled within statutory timeframes.
- Appoint or empower a Data Protection Officer (DPO) with sufficient authority and resources to oversee both internal and third-party data processing activities.
- Integrate privacy-by-design principles into all future marketing campaign workflows before launch.