Summary

• The EDPB published the decision summary on 12 October, although the fine was decided in June.
• Investigators identified unwanted promotional contact and unauthorised contract activations.
• The regulator ordered improved data controls across Wind Tre’s sales network.

A €16.7 million Italian data protection penalty against telecom operator Wind Tre has been detailed in a European Data Protection Board notice published on 12 October, putting the operation of outsourced sales networks and consent controls under scrutiny. The underlying regulatory decision dates to 5 June 2026; the latest development is the publication of its European summary rather than a newly imposed fine.

The Italian privacy authority investigated complaints about unsolicited promotional communications and the activation of contracts or services without customers' knowledge. Its findings included marketing contact despite an objection or without valid consent. The investigation also examined the procedures by which sales partners entered contracts and how the operator processed requests made by people whose information it held.

The case extends beyond the familiar problem of unwanted calls. If a customer's objection is recorded in one application but does not reach a sales partner or outbound calling tool, a business can continue processing information it should no longer use. If a contract is submitted through an external channel without reliable verification, the organisation can also create a new customer record and service obligation on the basis of information acquired unlawfully.

Regulators concluded that Wind Tre's organisational and technical controls were insufficient to prevent such activity throughout the sales network. They also found weaknesses in the implementation of privacy rights, accountability, data protection by design and default, and security obligations. The authority imposed processing restrictions alongside the financial sanction and required measures to strengthen compliance and prevent unauthorised contract activations.

The European notice records that the company was ordered to stop further processing data obtained without consent and to improve procedures for verifying the lawfulness of promotional activity. These directions distinguish the enforcement from a fine that could simply be recorded as a historical financial charge. Changes to operational systems, partner oversight and complaints handling may carry continuing implementation costs.

Large service providers often depend on multiple retail, contact-centre and intermediary relationships. Those channels may use different applications, incentives and customer verification methods. A central privacy policy cannot guarantee lawful behaviour where partners are rewarded for conversion and where records are not reconciled quickly across systems. Responsibility remains with the controller even when contact with the customer is performed by another business.

A practical response requires reliable consent provenance, suppression mechanisms that cover every relevant partner, and evidence that objections are honoured throughout the data lifecycle. Systems also need controls over the creation of contracts and a trail showing which channel supplied information, who checked it and on what basis processing was permitted. Periodic partner audits are useful, but they may miss harmful activity between review cycles if live controls remain weak.

That challenge is partly technical and partly commercial. Data integration can reduce inconsistencies, while contractual obligations and incentive design affect how partners behave. Operators must also distinguish a record that may lawfully be retained for billing or complaints from one that can be reused for future promotions. Treating all customer information as a single unrestricted marketing asset creates avoidable risk.

The scale of the €16.7 million sanction draws attention, but the more enduring question is whether the remedial steps alter the workflows that produced the infringements. For telecom groups, including those operating across national markets, the case provides a concrete enforcement example of the difficulty of controlling external acquisition channels without losing operational visibility.

The EDPB publication brings the Italian decision to a wider European audience. Its findings underline the regulator's expectation that a company demonstrate working controls through its sales network, not merely obtain promises of compliance from intermediaries.

Marketing campaigns often combine first-party customer records with purchased leads, data collected by agents and information produced by earlier sales activity. Each dataset may have a different legal basis and retention history. A compliance system needs to prevent that history being lost when records are combined or moved into a customer relationship management tool. Without usable provenance, a business may struggle to demonstrate why any particular individual was contacted.

Sales partners can also switch software, staff and subcontractors without the network operator noticing immediately. Effective oversight therefore includes controls over who can export data, how account credentials are issued, how complaints are escalated and whether a suspected breach can be isolated rapidly. Those operational details are necessary to make contractual privacy commitments enforceable.

The sanction should be understood as a documented Italian enforcement outcome, not as an indication that every sales practice used by telecom operators is unlawful. Companies with well-controlled consent and verification procedures can still conduct legitimate marketing. The issue is whether those procedures work reliably when multiple intermediaries handle customer information.