4.5 million Euro fine against Fastweb SpA
Commercial calls without consent, inadequate safeguards, and failure to report a data breach.

The Italian data protection authority received hundreds of complaints about aggressive telemarketing by Fastweb and its distribution network. In the complex investigation that followed, the authority found numerous violations of the GDPR, the practice of which was systematic in nature and affected both existing and potential new customers.

The call centres working for Fastweb acted largely in disregard of the applicable data protection regulations. For example, they often used telephone numbers for their calls which were not listed in the Italian register for communications operators (Registro degli Operatori di Comunicazione, or ROC). In addition, they processed contact data for the advertising activities which Fastweb had obtained from external partners without the data subjects' valid consents for the transfer of their data. In other cases, customer lists obtained from third parties had been used without the consent of the data subjects for future advertising activities. In total, over 7,542,000 individuals were affected by the processing of their contact data without consent. 

Moreover, in the context of Fastweb's call-back service, there was no possibility for data subjects to give free, specific and informed consent. The DPA found that where the technical modalities of the service are as invasive as in this case - data subjects were called back up to 20 times at 15-minute intervals before the ticket was closed - they must be understood as characteristic of the data processing. Therefore, the data subjects should have been informed about them. Moreover, there was no simple, automated possibility for the data subjects to deactivate the call-back service. Here, the authority recognised a failure on the part of the recipient of the fine to implement a system that would have enabled the data subjects to properly exercise their rights (including the right to object).

Similarly, the recipient of the fine had breached its obligation to implement risk-adequate technical and organisational measures for the security of the processing of personal data. In particular, this concerned the company's CRM systems. This was evidenced by several reports that telephone numbers of data subjects had been leaked to criminals. The criminals had contacted the victims via WhatsApp, pretended to work for Fastweb and tried to obtain identification documents. These were then presumably to be used for spam, phishing, identity theft or other fraudulent activities.

Furthermore, the data protection officers found that the fulfilment of the data subjects' rights according to Art. 15 to 22 of the GDPR was inadequate and that the principle of accuracy was not respected. With regard to many requests for corrections from data subjects, the authority found delays or system errors on the part of Fastweb.

In determining the amount of the fine, the following aggravating factors were taken into account: that the violations were serious and posed a high risk to the data subjects, that the violations had existed over a long period of time, that many persons were affected, that some of the violations resulted from serious negligence on the part of Fastweb and that the data protection authority had previously issued similar orders to the recipient of the fine. On the other hand, the fact that Fastweb had cooperated with the data protection authority and had implemented appropriate measures to protect the processing was taken into account as a mitigating factor.

The authority ordered Fastweb to strengthen its security measures to prevent data misuse and to adapt its advertising practices so that they demonstrably only originate from ROC-registered telephone numbers. Furthermore, the authority once again explicitly prohibited the company from processing contact data submitted by contractual partners without first obtaining valid consents for the transfer from the data subjects.