The Italian data protection supervisory authority (Garante per la protezione dei dati personali) ordered Vodafone to pay a fine in excess of Euro 12,250,000 on account of having unlawfully processed the personal data of millions of users for telemarketing purposes. As well as having to pay the fine, the company is required to implement several measures set out by the Garante in order to comply with national and EU data protection legislation.
This decision marks the final step in a complex proceeding that the Garante had initiated following hundreds of complaints and alerts submitted by users against unsolicited phone calls made by Vodafone and/or the company’s sales network in order to promote telephone and Internet services.
The investigations carried out by the Garante brought to light major criticalities of a ‘structural’ nature having to do with the violation not only of consent requirements, but also of key principles such as accountability and data protection by design as set forth in the EU GDPR. These criticalities could be traced down to the processing activities performed both in respect of Vodafone’s customer database and – more broadly – with regard to prospective users of electronic communications services.
More specifically, one of the most worrying findings of the investigations was the use of fake telephone numbers or numbers that were not registered with the ROC (i.e. the National Consolidated Registry of Communication Operators) in order to place the marketing calls. This practice is under Vodafone’s own spotlight and is seemingly related to a shady set of unauthorised call centres that carry out telemarketing activities in utter disregard of personal data protection legislation.
Additional violations could be established as for the handling of contact lists purchased from external providers. Those lists had been obtained by Vodafone business partners from other companies and had been transferred to Vodafone without the users’ required free, informed, and specific consent.
Customer resource management security measures were also found to be inadequate. In this respect, several complaints and alerts had been submitted to the Garante by customers who had been contacted by operators purporting to be acting on Vodafone’s behalf and requesting IDs to be sent to them via WhatsApp – quite likely for purposes related to spamming, phishing or other fraudulent activities.
Taking account of the infringements found in the course of the proceeding, the Italian Garante imposed a fine amounting to Euro 12,251,601.00.
Further, the Garante ordered Vodafone to implement systems to demonstrate that processing for telemarketing purposes complies with consent requirements. Vodafone will be required additionally to provide proof that contractual arrangements are activated only following telemarketing calls placed by their own sales network through numbers that are registered with the ROC. Stronger security measures will have to be implemented by the company to prevent unauthorised accesses to the customer database, and the company was also ordered to reply in full to certain data subject rights requests.
Finally, the Garante banned Vodafone from further processing data for marketing or commercial purposes where such data are acquired from third parties that have not obtained the users’ free, specific, and informed consent to data disclosure.
For further information, please contact the Italian SA: ufficiostampa@gpdp.it