Garante per la protezione dei dati personali (Italy) - 556/2026
Italy's DPA fines TIM €9.5M for unlawful telemarketing and data handling failures.
Italy's Garante per la protezione dei dati personali (DPA) has fined TIM €9,516,000 for unlawful telemarketing practices and inadequate supervision of its sales partners. The DPA found that TIM failed to implement effective systems for monitoring its sales network and that its organizational and technical design for accepting leads was inadequate. The ruling also highlighted issues with consent collection, data subject rights handling, and an insufficient opt-out mechanism.
AI summary of the linked source. Not reviewed by an editor. How this works
Run TIM?
Get an email when a new story names TIM, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonItaly's data protection authority fined TIM €9,516,000 after finding systemic failures in how the telecom giant managed its third-party sales network and handled personal data for marketing purposes. The core issues included inadequate consent collection, failure to honour opt-out requests, and a lack of effective monitoring and oversight of sales partners who were processing personal data on TIM's behalf. This case illustrates that data controllers cannot outsource accountability — they remain fully liable for the actions of processors and partners in their supply chain. The fine underscores that technical and organisational measures must be actively designed, tested, and audited, not merely documented on paper. Regulators are increasingly scrutinising the entire data supply chain, making third-party governance a critical compliance obligation.
What helps against this
How we list vendors- Identity governance and single sign-on
People who leave or change roles lose access everywhere at once, and forgotten accounts stop piling up.
- Third-party risk management (TPRM)
You know which suppliers could hurt you, and you hear quickly when one of them is breached.
- Compliance automation (GRC)
Evidence for NIS2, DORA and ISO 27001 is collected continuously, not in a rush before the audit.