Event Intelligence
Italian DPA fines Wind Tre EUR 16 700 000 for unlawful telemarketing and data protection infringements
Cyber attackBreaking Updated 12th October 2026 · 13:05
- Significance
- Material
- Impact
- Strongly Negative
- Confidence Confidence indicates how reliable ProcIntel considers the event assessment based on the quality, quantity and independence of the supporting evidence. It does not measure the event's importance.
- Moderate
- Evidence
- 1 source 1 signal
Overview
What happened Source facts
Background information Date of final decision: 05/06/2026 National case Controller: Wind Tre S.p. A. Legal Reference(s): Article 5 (Principles relating to processing of personal data), Article 6 (Lawfulness of processing), Article 12 (Transparent information, communication and modalities for the exercise of the rights of the data subject), Article 15 (Right to access by the data subject), Article 21 (Right to object), Article 24 (Responsibility of the controller), Article 25 (Data protection by design and by default) and Article 32 (Security of processing) Decision: Administrative fine, Definitive ban on data processing, Compliance order Website topics: Data subjects rights, Basic principles, Legal basis, Marketing Summary of the Decision Origin of the case The Italian Data Protection Authority (DPA) carried out an investigation into Wind Tre S.p. A. following numerous complaints and reports from individuals concerning unsolicited promotional contacts and the activation of contracts and services without their knowledge. The investigation also concerned the effectiveness of the measures adopted by the company to ensure compliance with data protection rules throughout its sales network and to manage data subjects’ requests. The Italian Authority examined, in particular, the processing carried out for telemarketing purposes, the procedures used to conclude contracts through sales partners and the technical and organisational measures implemented by Wind Tre to prevent unlawful processing. Key Findings The Italian DPA found several infringements concerning the processing of personal data for marketing and contractual purposes. Individuals continued to receive promotional communications despite having exercised their right to object or without having given valid consent. The investigation also identified cases in which contracts were activated without the individuals’ knowledge, involving the unlawful processing of their personal data. They found shortcomings in Wind Tre’s technical and organisational measures and in the controls implemented over its sales network. The company had not ensured that its systems and procedures were capable of effectively preventing unlawful processing and of promptly giving effect to data subjects’ requests. The DPA also identified infringements concerning the principles of accountability, data protection by design and by default and security of processing. Decision The Italian DPA imposed an administrative fine of EUR 16 700 000 on Wind Tre S.p. A. They also prohibited the further processing of personal data acquired without consent and ordered the company to adopt measures to ensure effective compliance with data subjects’ rights, particularly the right to object to processing for direct marketing purposes. Wind Tre was also required to strengthen the technical and organisational measures governing its sales network and the procedures used to verify the lawfulness of data processing connected with promotional activities and the activation of contracts. The Italian DPA stressed that controllers using complex sales networks remain responsible for ensuring that personal data are processed in compliance with the GDPR and must implement effective technical and organisational measures to prevent unlawful marketing activities and unauthorised contractual activations. For further information: Data breach, il Garante privacy sanziona Wind Tre per 1,7 milioni di euro
Suggested considerations
Derived from this Event's rating and type — prompts for your team to evaluate, not reported facts and not recommendations.
- Monitor for explicit timing evidence.
- Determine whether internal exposure warrants earlier investigation.
No explicit date was tightly bound to the matched event text, so no occurrence date is claimed.
Suggested Considerations
These are prompts for a procurement team to evaluate, generated from this Event's rating and type. They are not reported facts and not instructions — ProcIntel does not know your contracts, suppliers or exposure.
- Monitor for explicit timing evidence.
- Determine whether internal exposure warrants earlier investigation.
How to read this Event
- Source facts what the original source reported.
- ProcIntel assessment ProcIntel's own interpretation of those facts.
- Consideration a suggested question for your team — never a recommendation to act.
Source Facts
Only what the sources reported. Nothing on this page is ProcIntel's interpretation.
Recorded source facts
Background information Date of final decision: 05/06/2026 National case Controller: Wind Tre S.p. A. Legal Reference(s): Article 5 (Principles relating to processing of personal data), Article 6 (Lawfulness of processing), Article 12 (Transparent information, communication and modalities for the exercise of the rights of the data subject), Article 15 (Right to access by the data subject), Article 21 (Right to object), Article 24 (Responsibility of the controller), Article 25 (Data protection by design and by default) and Article 32 (Security of processing) Decision: Administrative fine, Definitive ban on data processing, Compliance order Website topics: Data subjects rights, Basic principles, Legal basis, Marketing Summary of the Decision Origin of the case The Italian Data Protection Authority (DPA) carried out an investigation into Wind Tre S.p. A. following numerous complaints and reports from individuals concerning unsolicited promotional contacts and the activation of contracts and services without their knowledge. The investigation also concerned the effectiveness of the measures adopted by the company to ensure compliance with data protection rules throughout its sales network and to manage data subjects’ requests. The Italian Authority examined, in particular, the processing carried out for telemarketing purposes, the procedures used to conclude contracts through sales partners and the technical and organisational measures implemented by Wind Tre to prevent unlawful processing. Key Findings The Italian DPA found several infringements concerning the processing of personal data for marketing and contractual purposes. Individuals continued to receive promotional communications despite having exercised their right to object or without having given valid consent. The investigation also identified cases in which contracts were activated without the individuals’ knowledge, involving the unlawful processing of their personal data. They found shortcomings in Wind Tre’s technical and organisational measures and in the controls implemented over its sales network. The company had not ensured that its systems and procedures were capable of effectively preventing unlawful processing and of promptly giving effect to data subjects’ requests. The DPA also identified infringements concerning the principles of accountability, data protection by design and by default and security of processing. Decision The Italian DPA imposed an administrative fine of EUR 16 700 000 on Wind Tre S.p. A. They also prohibited the further processing of personal data acquired without consent and ordered the company to adopt measures to ensure effective compliance with data subjects’ rights, particularly the right to object to processing for direct marketing purposes. Wind Tre was also required to strengthen the technical and organisational measures governing its sales network and the procedures used to verify the lawfulness of data processing connected with promotional activities and the activation of contracts. The Italian DPA stressed that controllers using complex sales networks remain responsible for ensuring that personal data are processed in compliance with the GDPR and must implement effective technical and organisational measures to prevent unlawful marketing activities and unauthorised contractual activations. For further information: Data breach, il Garante privacy sanziona Wind Tre per 1,7 milioni di euro
This Event rests on a single report. It has not been corroborated by a second, independent source.
-
Background information Date of final decision: 05/06/2026 National case Controller: Wind Tre S.p. A. Legal Reference(s): Article 5 (Principles relating to processing of personal data), Article 6 (Lawfulness of processing), Article 12 (Transparent information, communication and modalities for the exercise of the rights of the data subject), Article 15 (Right to access by the data subject), Article 21 (Right to object), Article 24 (Responsibility of the controller), Article 25 (Data protection by design and by default) and Article 32 (Security of processing) Decision: Administrative fine…
Open original report → edpb.europa.eu
Linked Signals
Every collected Signal that contributed to this Event, with how it was matched.
| Published | Headline | Source | Matched text | Extraction confidence | Method |
|---|---|---|---|---|---|
| 12th October 2026 | Italian DPA fines Wind Tre EUR 16 700 000 for unlawful telemarketing and data protection infringements | EDPB News RSS | data breach | 95.0 | high precision phrase |
Why ProcIntel Rates This
Every rating below is produced from the logged facts by consistent, rules-based scoring — never from the tone or wording of the source.
Significance Significance estimates the potential procurement impact of the event, including factors such as supply, cost, operations, geography and strategic importance.
3 · Material- This type of disruption typically has a moderate procurement impact.
- No specific geography identified yet.
- No specific organisation linked yet — geographies, commodities and routes do not count as organisations.
- No procurement category has been determined for this event.
- Time horizon is not yet assessed for individual Events; a standard short-term assumption is used.
Confidence Confidence indicates how reliable ProcIntel considers the event assessment based on the quality, quantity and independence of the supporting evidence. It does not measure the event's importance.
3 · Moderate- Reported by at least one primary/official source.
- Reported by a single source so far — not yet independently corroborated.
- Some key facts (e.g. exact date) are still missing or unconfirmed.
- Evidence was last updated within the last month.
Urgency How soon the evidence already identified for this event suggests action may be needed. Unknown means no sufficiently explicit or quantified timing evidence has been identified -- ProcIntel never infers a timeframe where the evidence does not support one.
UnknownTiming not established. No sufficiently explicit or quantified timing evidence has been identified. Procintel has not inferred urgency where timing evidence is insufficient.
Impact Direction Whether the procurement impact of this development is assessed as negative, positive, or neutral/mixed.
Strongly NegativeProvisional default — not yet reviewed.