On October 12, 2026 the European Data Protection Board published the Italian Data Protection Authority's summary of a final decision dated June 5, 2026: an administrative fine of EUR 16,700,000 on Wind Tre S.p.A. for unlawful telemarketing and for activating contracts without the individuals' knowledge, citing Articles 5, 6, 12, 15, 21, 24, 25 and 32 of Regulation (EU) 2016/679 (GDPR). Controllers that run telemarketing and contract activation through a sales network on the Italian market, and the sales partners and call centres that place those contracts, must immediately check consent and objection records for telemarketing, and the controls over sales partners that activate contracts, against GDPR Articles 5, 6, 21, 24, 25 and 32, or face the same class of outcome the Garante imposed on Wind Tre: an administrative fine, a ban on processing data acquired without consent, and an order to fix sales-network controls.
Wind Tre must also make the right to object to direct marketing effective and strengthen the measures on its sales network. The EDPB further-information link is a different Garante page, not this telemarketing decision.
- Authority : Garante per la protezione dei dati personali (Italian Data Protection Authority)
- Entity : Wind Tre S.p.A.
- Measure and amount : fine of EUR 16,700,000, ban on processing data acquired without consent, compliance order on sales-network controls
- Legal basis : GDPR Articles 5, 6, 12, 15, 21, 24, 25 and 32
- Decision date : June 5, 2026 (EDPB publication October 12, 2026)
- Official source : EDPB national news, Italian DPA fines Wind Tre EUR 16,700,000
What happened
The Garante investigated complaints about unsolicited promotional contacts and about contracts activated without the individuals' knowledge, including how sales partners conclude contracts. People kept receiving promotions after an objection or without valid consent. Systems did not stop that processing or give prompt effect to requests. Beside the fine, the authority banned further processing of data acquired without consent and ordered effective objection handling and tighter sales-network controls. A controller using a complex sales network remains responsible for that processing.
The breach
The summary lists GDPR Articles 5, 6, 12, 15, 21, 24, 25 and 32 and does not quote an operative sentence. Contact after an objection or without valid consent sits on Articles 6 and 21. Activation without the individual's knowledge sits on Articles 5 and 6. Requests without prompt effect sit on Articles 12 and 15. Failed sales-network controls sit on Articles 24, 25 and 32. The text is the Official Journal version of Regulation (EU) 2016/679.
Who else is in the same regime
Wind Tre is the sanctioned controller. Controllers that run telemarketing and contract activation through a sales network on the Italian market, and the sales partners and call centres that place those contracts, process data for the same purposes, under the same articles and the same Garante. A partner that collects consent or keys the contract is inside that control.
What to check now
- Confirm a valid consent before each telemarketing contact (Article 6).
- Stop campaigns where an Article 21 objection is on file.
- Stop processing of personal data acquired without consent.
- Confirm the individual knows of each sales-partner contract activation.
- Test that access requests and objections are actioned promptly (Articles 12 and 15).
- Document sales-network measures for Articles 24, 25 and 32.
Obsidian monitoring surfaces a national fine when the authority's summary is published.
