Wind Tre Fined €16.7M for Unlawful Telemarketing and Consent Failures
Wind Tre S.p.A. was found to have conducted promotional communications to individuals who had explicitly objected, and activated contracts without customer knowledge or consent — both serious violations of GDPR principles. The root failures stem from inadequate data governance, poor enforcement of opt-out requests, and insufficient oversight of third-party sales networks. This matters because organisations are legally obligated to honour data subject rights and ensure consent is verifiable, lawful, and respected throughout their entire distribution chain. The scale of the fine (€16.7M) reflects how systemic, rather than isolated, these failures were across Wind Tre's operations.
Tactical Insight
Immediate actions
- Audit all marketing contact lists to verify lawful consent bases and immediately suppress records of individuals who have objected or opted out.
- Conduct an emergency review of third-party sales agent processes to ensure contracts are never activated without documented, verifiable customer consent.
Long-term improvements
- Implement a centralised, real-time Consent Management Platform (CMP) that enforces opt-out suppression across all marketing channels and sales partners.
- Establish binding contractual Data Processing Agreements (DPAs) with all third-party sales network partners, with regular audits to verify compliance.
- Embed Privacy by Design principles into all customer onboarding and marketing workflows so consent validation is a mandatory, system-enforced step.
Detection & monitoring measures
- Deploy automated monitoring to flag and escalate any outbound marketing activity targeting individuals on suppression or do-not-contact lists.
- Conduct quarterly internal audits of consent records, contract activation logs, and customer complaint data to identify emerging compliance gaps before regulators do.