Insufficient legal basis for data processing
The Italian data protection authority (‘Garante’) announced, on 13 July 2020, that it had issued a decision (‘the Decision’) fining Wind Tre S.p.A. €16.7 million for several unlawful data processing activities in relation to direct marketing practices.
In particular, Garante outlined that hundreds of complainants claimed that they received unsolicited communications, sent without their previous consent, through SMS, email, phone calls, and automated calls. In addition, Garante highlighted that the individual claimants argued that they have not been able to exercise their right to withdraw consent and to oppose the processing for direct marketing purposes, since the information contained in the privacy policy was incomplete in relation to the means of contact used.
Moreover, Garante stated that the claimants’ data was published on telephone public lists despite their opposition. Furthermore, Garante found that Wind Tre’s apps ‘MyWind’ and ‘My3’ were set in order to oblige the user to provide his/her consent for different processing activities with every access, leaving the possibility to withdraw the same only after 24 hours. In addition, Garante pointed that Wind Tre presented various deficiencies in the management of third-party partners, even in relation to the unlawful activation of contracts.
As a result, Garante found that Wind Tre’s conduct amounted to a violation of Articles 5(1) and (2), 6(1)(a), 12, 24, and 25 of the General Data Protection Regulation (Regulation (EU) 2016/679) (‘GDPR’). Moreover, Garante prohibited Wind Tre’s processing of data collected without consent, as well as ordering the adoption of adequate technical and organisational measures to effectively control third-party partners.
