4.5 Million Contacts, No Consent

On 12 November 2020, the Italian data protection authority (Garante per la protezione dei dati personali) fined Vodafone Italia EUR 12,251,601.

What did the authority find?

Lists of about 4.5 million contacts reached the company from list providers and partners, without consent that allowed them to be passed on. The sales network made tens of millions of marketing calls. The authority found a very large number of calls from numbers outside the company's sales network, almost always unregistered and often with a foreign prefix, some of them to people who had already objected. There was unauthorized access to the company's databases, including by staff of external call centres working for it, and the company did not take adequate security measures to prevent it. The company did not notify the authority of a personal data breach, and customers' access and rectification requests were not fully handled.

The company explained some of the contacts as "human error" or a system glitch.

The gap

On paper there were blocklists, consents and procedures. In practice there was a chain of partners, call centres and subcontractors, and nobody checked that the procedures made it through.

This is where Data Protection Operations (DPOps) comes in: checking that the control works along the whole chain, not only at head office.

Three controls

👉 No consent, no list. Before using a list from a provider or partner, check where it came from and what consent it rests on. A list without documentation does not enter the system.

👉 No contract from an unlawful call. The sales system does not allow a service to be activated or a contract to be recorded if it came from a call made from an unregistered number, or to a person who objected.

👉 Controlled vendor access. Each call centre and vendor accesses only what it needs, and every access to the database is logged and reviewed, so unusual access is found quickly.

Wind Tre too

In July 2020 the Italian authority also fined Wind Tre EUR 16.7 million for a very similar failure: marketing contacts after objections, and contracts activated without customers' knowledge, through the sales partner network. The decision became final only in June 2026, and on 12 October 2026 the European Data Protection Board (EDPB) published its summary.

Same year, same failure, at two large telecom companies. The gap between procedures and the partner chain is not an accident; it is a pattern.

Source

The full decision of the Italian data protection authority, 12 November 2020

To be precise: this is an Italian decision. Its lessons apply to any organization that markets through partners.