[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f1SemiFBFl90w2cjtI508wOnQNlAzBWqDzRUehnEq7MY":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":25,"status":26,"created_at":27,"published_at":28,"article":29,"tags":33,"podcasts":52,"controls":53},"37fd0221-d924-4f15-aa62-c65e3d7ba0db","wind-tre-fined-167m-for-unlawful-telemarketing-and-consent-failures","82966714-7b41-42c3-8a5c-a8499c7af9a9","Wind Tre Fined €16.7M for Unlawful Telemarketing and Consent Failures","Wind Tre S.p.A. was found to have conducted promotional communications to individuals who had explicitly objected, and activated contracts without customer knowledge or consent — both serious violations of GDPR principles. The root failures stem from inadequate data governance, poor enforcement of opt-out requests, and insufficient oversight of third-party sales networks. This matters because organisations are legally obligated to honour data subject rights and ensure consent is verifiable, lawful, and respected throughout their entire distribution chain. The scale of the fine (€16.7M) reflects how systemic, rather than isolated, these failures were across Wind Tre's operations.","**Immediate actions:**\n- Audit all marketing contact lists to verify lawful consent bases and immediately suppress records of individuals who have objected or opted out.\n- Conduct an emergency review of third-party sales agent processes to ensure contracts are never activated without documented, verifiable customer consent.\n\n**Long-term improvements:**\n- Implement a centralised, real-time Consent Management Platform (CMP) that enforces opt-out suppression across all marketing channels and sales partners.\n- Establish binding contractual Data Processing Agreements (DPAs) with all third-party sales network partners, with regular audits to verify compliance.\n- Embed Privacy by Design principles into all customer onboarding and marketing workflows so consent validation is a mandatory, system-enforced step.\n\n**Detection & monitoring measures:**\n- Deploy automated monitoring to flag and escalate any outbound marketing activity targeting individuals on suppression or do-not-contact lists.\n- Conduct quarterly internal audits of consent records, contract activation logs, and customer complaint data to identify emerging compliance gaps before regulators do.",[12,13,14,15,16,17,18,19,20,21,22,23,24],"GDPR Article 6 – Lawfulness of processing","GDPR Article 7 – Conditions for consent","GDPR Article 17 – Right to erasure","GDPR Article 21 – Right to object","GDPR Article 24 – Responsibility of the controller","GDPR Article 25 – Data protection by design and by default","GDPR Article 28 – Processor obligations","GDPR Article 32 – Security of processing","NIST Privacy Framework PR.DS-P (Data Subject Rights)","NIST SP 800-53 AC-2 – Account Management","CIS Control 3 – Data Protection","CIS Control 14 – Security Awareness and Skills Training","ITIL Service Design – Information Security Management",{},"published","2026-10-12T12:20:37.012466+00:00","2026-10-12T12:20:36.995+00:00",{"id":7,"url":30,"slug":31,"title":32},"https:\u002F\u002Fwww.edpb.europa.eu\u002Fnews\u002Fitalian-dpa-fines-wind-tre-eur-16-700-000-for-unlawful-telemarketing-and-data-protection_en","italian-dpa-fines-wind-tre-eur-16-700-000-for-unlawful-telemarketing-and-data-pr-452590","Italian DPA fines Wind Tre EUR 16 700 000 for unlawful telemarketing and data protection infringements",[34,40,46],{"id":35,"name":36,"slug":37,"description":38,"color":39},"1ec88fde-2d0f-4ed8-932a-33f5ccc0fdc7","Access Control","access-control","Excessive privileges, missing MFA, weak auth","#f97316",{"id":41,"name":42,"slug":43,"description":44,"color":45},"c0dcc566-3654-4d70-8ede-262a198e732f","Regulatory Compliance","regulatory-compliance","GDPR, NIS2, DORA, sector-specific violations","#ec4899",{"id":47,"name":48,"slug":49,"description":50,"color":51},"c8b843a5-d5a7-41d1-8d3b-cabded09d2ef","Data Protection","data-protection","Unencrypted data, missing DLP, poor classification","#3b82f6",[],[54,58,62],{"slug":55,"name":56,"problem":57},"identity-governance","Identity governance and single sign-on","People who leave or change roles lose access everywhere at once, and forgotten accounts stop piling up.",{"slug":59,"name":60,"problem":61},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.",{"slug":63,"name":64,"problem":65},"compliance-automation","Compliance automation (GRC)","Evidence for NIS2, DORA and ISO 27001 is collected continuously, not in a rush before the audit."]