The Italian supervisory authority (Garante per la protezione dei dati personali) in its decision of 9 July 2020, sanctioned WINDRE with an administrative fine of €17,000,000. This decision results from an investigation carried out by the authority following numerous consumer complaints about unsolicited messages and calls.  

In addition to the lack of prior consent from data subjects, it was not possible to withdraw consent or even object to the processing of personal data such as the publication in public phone listing registers. Moreover, certain processing activities were carried out by default, such as geolocation or the communication of data to third parties. Opposition to such processing could only be made after a period of 24 hours after subscribing to the service(s). 

Thus, the amount of the administrative fine is justified by the multiple infringements (general principles of the PGRD, lack of information and transparency, exercise of the rights of the data subjects and the unlawfulness of the processing activities ,carried out by the operator), the number of data subjects concerned and the turnover of the undertaking (group).  

Finally, two partners of WINDTRE were also ordered to pay an administrative fine for their involvement in the unlawful processing activities at stake. They amount to 200,000€ and 800,000€. 

The decision in original version and the English press release