Italian telecommunications operator Wind Tre S.p.A (WINDTRE) has been fined approximately €16.7 million (U.S. $18.6 million) for violating data collection provisions of the EU’s General Data Protection Regulation (GDPR).
The Italian Data Protection Authority (IDPA) announced the fine Monday for “illegal data processing” related to the company’s promotional activities, according to a translated press release. The authority noted the violations came even as WINDTRE was operating under a previous injunction related to its data collection activities.
The fine is the sixth-largest handed down under the GDPR since the data privacy regulation took effect in May 2018, according to the GDPR Enforcement Tracker. The penalty is the second-largest issued by the IDPA, following a €27.8 million (U.S. $31 million) fine against fellow telecommunications operator TIM in January this year.
In addition to Monday’s fine, the IDPA “prohibited Wind from processing the data acquired without consent,” as well as implementing procedures “to respect the will of the users not to be disturbed.” The agency also found issues with data collection procedures by a subcontractor operating a call center.
According to the IDPA, WINDTRE was among the most prominent of telemarketing firms that were “subject of hundreds of reports and complaints that reach the Authority weekly to complain about cases of ‘wild marketing.’” Users complained of receiving unwanted calls and contacts through SMS, email, fax, and automated telephone calls. Several whistleblowers complained they could not withdraw their consent or even object to the processing of their data for marketing purposes, and that their personal data was published in public directories.
In particular, investigators found WINDTRE’s MyWind and My3 apps “were set up in such a way as to oblige the user to provide, at each new access, a series of consents for different processing purposes (marketing, profiling, communication to third parties, enrichment, and geolocation), only to allow them to be revoked after 24 hours.”
WINDTRE is a telecommunications and fiber optic cable provider in Italy, owned by CK Hutchinson Holdings Limited, which is listed on the Hong Kong Stock Exchange. The company could not be reached for comment.
As part of the same press release, the IDPA also announced a fine of €800,000 (U.S. $893,000) against telephone operator Iliad for GDPR violations related to methods of access for employees to traffic data.
No comments yet