[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fiQL2BwC1eAijxlA42BZAV5MzMJXCNThLGX-V75hZ-DI":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":26,"status":27,"created_at":28,"published_at":29,"article":30,"tags":34,"podcasts":53,"controls":54},"d4384c6e-ff0b-4b90-9c03-9bb1470775b9","tim-fined-95m-for-unlawful-telemarketing-and-poor-sales-partner-oversight","29d076ac-965c-42da-8f33-d27a3a89a9f2","TIM Fined €9.5M for Unlawful Telemarketing and Poor Sales Partner Oversight","Italy's data protection authority fined TIM €9,516,000 after finding systemic failures in how the telecom giant managed its third-party sales network and handled personal data for marketing purposes. The core issues included inadequate consent collection, failure to honour opt-out requests, and a lack of effective monitoring and oversight of sales partners who were processing personal data on TIM's behalf. This case illustrates that data controllers cannot outsource accountability — they remain fully liable for the actions of processors and partners in their supply chain. The fine underscores that technical and organisational measures must be actively designed, tested, and audited, not merely documented on paper. Regulators are increasingly scrutinising the entire data supply chain, making third-party governance a critical compliance obligation.","**Immediate actions:**\n- Audit all active third-party sales partners and processors to verify they operate under valid, GDPR-compliant Data Processing Agreements (DPAs).\n- Implement and test a robust opt-out\u002Fsuppression mechanism to ensure marketing stops within regulatory timeframes upon request.\n- Review all consent collection flows to confirm they meet the standards of freely given, specific, informed, and unambiguous consent.\n\n**Third-party & supply chain governance:**\n- Establish a formal vendor risk management programme that includes periodic audits of sales partners' data handling practices.\n- Require partners to submit regular compliance attestations and flag anomalies in lead generation volumes or consent rates.\n- Include contractual rights to audit, suspend, or terminate partners who breach data protection obligations.\n\n**Long-term improvements:**\n- Deploy centralised logging and monitoring of all lead intake and consent records to create a defensible audit trail.\n- Conduct annual Data Protection Impact Assessments (DPIAs) on telemarketing processes and lead-generation systems.\n- Train sales and marketing teams on GDPR obligations, with specific modules covering consent validity and data subject rights handling.",[12,13,14,15,16,17,18,19,20,21,22,23,24,25],"GDPR Article 5(1)(a) – Lawfulness, fairness and transparency","GDPR Article 6 – Lawfulness of processing","GDPR Article 7 – Conditions for consent","GDPR Article 17 – Right to erasure (opt-out)","GDPR Article 24 – Responsibility of the controller","GDPR Article 28 – Processor obligations and contracts","GDPR Article 83(5) – Administrative fines","NIST SP 800-53 AR-3 – Privacy requirements for contractors and service providers","NIST SP 800-53 PT-5 – Privacy notice","NIST Privacy Framework PR.P-P4 – Data processing policies enforced with third parties","CIS Control 15 – Service Provider Management","CIS Control 3 – Data Protection","ISO\u002FIEC 27701:2019 – Privacy Information Management (PIMS)","ITIL Service Design – Supplier Management process",{},"published","2026-08-14T14:20:57.886681+00:00","2026-08-14T14:20:57.803+00:00",{"id":7,"url":31,"slug":32,"title":33},"https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=Garante_per_la_protezione_dei_dati_personali_(Italy)_-_556\u002F2026&diff=52695&oldid=52694","garante-per-la-protezione-dei-dati-personali-italy-556-2026-70f4cf","Garante per la protezione dei dati personali (Italy) - 556\u002F2026",[35,41,47],{"id":36,"name":37,"slug":38,"description":39,"color":40},"c0dcc566-3654-4d70-8ede-262a198e732f","Regulatory Compliance","regulatory-compliance","GDPR, NIS2, DORA, sector-specific violations","#ec4899",{"id":42,"name":43,"slug":44,"description":45,"color":46},"c8b843a5-d5a7-41d1-8d3b-cabded09d2ef","Data Protection","data-protection","Unencrypted data, missing DLP, poor classification","#3b82f6",{"id":48,"name":49,"slug":50,"description":51,"color":52},"f0c2a0af-58aa-4128-87c9-6acd30f2dc48","Supply Chain","supply-chain","Third-party risk, compromised dependencies","#8b5cf6",[],[55,59,63],{"slug":56,"name":57,"problem":58},"identity-governance","Identity governance and single sign-on","People who leave or change roles lose access everywhere at once, and forgotten accounts stop piling up.",{"slug":60,"name":61,"problem":62},"third-party-risk-management","Third-party risk management (TPRM)","You know which suppliers could hurt you, and you hear quickly when one of them is breached.",{"slug":64,"name":65,"problem":66},"compliance-automation","Compliance automation (GRC)","Evidence for NIS2, DORA and ISO 27001 is collected continuously, not in a rush before the audit."]