What happened
Italy's data protection authority has fined the telecoms operator Wind Tre 16.7 million euros over how it handled personal data for marketing and how it concluded contracts through its sales partners. The decision appears on the European Data Protection Board as a national case, with a final decision date of June 5, 2026.
The investigation followed a large number of complaints from individuals who said they kept receiving promotional contacts after objecting, or that contracts and services had been activated without their knowledge. The authority examined the processing carried out for telemarketing, the procedures used to close contracts through sales partners, and the technical and organisational measures the company had in place to prevent unlawful processing.
Regulators found that people continued to receive promotional communications after exercising their right to object, or without having given valid consent at all. They also identified cases where contracts were activated without the individuals' knowledge, involving unlawful processing of their personal data. The authority concluded that the company's systems and procedures were not capable of preventing unlawful processing, or of giving effect to data subject requests promptly.
The order went beyond the money. The authority issued a definitive ban on further processing of personal data acquired without consent, and required the company to adopt measures making data subject rights effective, particularly the right to object to direct marketing. Wind Tre must also strengthen the technical and organisational measures governing its sales network and the procedures used to verify that promotional activity and contract activations are lawful.
The legal references cover the core of the regulation: principles relating to processing, lawfulness, transparency, the right of access, the right to object, controller responsibility, data protection by design and by default, and security of processing.
Why this is a GRC story
Outsourcing a sales channel does not outsource the accountability. The authority's closing message is that a controller operating a complex sales network remains responsible for how personal data is processed inside it. That is the same principle behind third party risk programmes everywhere: activity can be delegated, the obligation cannot.
Controls on paper are not controls. The findings describe gaps in technical and organisational measures and in the oversight applied to partners. A consent record nobody reconciles against suppression lists, or an activation process a partner can bypass, produces exactly this outcome at scale.
The remedies are operational, not legal. The ban and the compliance order point at process design: how objections reach every outbound system fast enough to matter, and how an activation is authorised and evidenced before it happens.
What to watch
Watch how other European authorities treat sales networks and lead generation partners. Where this reasoning is followed, the evidence a regulator asks for will concern oversight: partner due diligence, monitoring, complaint root cause analysis, and records showing that objections actually stopped contact.
For anyone running outbound marketing or channel partners, the starting point is unglamorous. Map where contact data enters the business, prove that an objection reaches every system capable of sending a message, and give partner compliance a measurable owner rather than a policy document.
Attribution: Analysis based on European Data Protection Board and related public reporting. This article is original commentary, not a repost of the source material.