TIM S.p.A.

Summary

The Italian DPA has imposed a fine of EUR 9,516,000 on TIM S.p.A. The controller is a telecommunications provider. The authority found that the controller had made unauthorised contact with data subjects. Call centres made calls to data subjects who were registered with the Public Opt-Out Register, using caller ID spoofing techniques to propose the controller's offers. Furthermore data subjects received an SMS containing a link to the website of an official TIM sales partner where they could request that the controller contact them. Based on these malicious contact requests official sales representatives then contacted the data subjects. The aim was to create a sales flow that appeared compliant. The authority found that the controller had not taken measures to ensure the lawfulness of personal data used for sales purposes. During the investigation the controller implemented an opt-out mechanism for data subjects being contacted via SMS. However the authority deemed this measure insufficient and required an opt-in mechanism instead. The controller's sales partner made around 20,000 calls per month, which made it impossible to ensure their behaviour was lawful. When data subjects exercised their right to object and requested that TIM stop contacting them the controller failed to respond adequately to numerous requests.