Insufficient legal basis for data processing
The Italian data protection authority (‘Garante’) announced, on 13 July 2020, that it had issued a decision (‘the Decision’) fining Wind Tre S.p.A. €16.7 million for several unlawful data processing activities in relation to direct marketing practices.
Moreover, Garante stated that the claimants’ data was published on telephone public lists despite their opposition. Furthermore, Garante found that Wind Tre’s apps ‘MyWind’ and ‘My3’ were set in order to oblige the user to provide his/her consent for different processing activities with every access, leaving the possibility to withdraw the same only after 24 hours. In addition, Garante pointed that Wind Tre presented various deficiencies in the management of third-party partners, even in relation to the unlawful activation of contracts.
As a result, Garante found that Wind Tre’s conduct amounted to a violation of Articles 5(1) and (2), 6(1)(a), 12, 24, and 25 of the General Data Protection Regulation (Regulation (EU) 2016/679) (‘GDPR’). Moreover, Garante prohibited Wind Tre’s processing of data collected without consent, as well as ordering the adoption of adequate technical and organisational measures to effectively control third-party partners.