The Guarantor for the protection of personal data has ordered Vodafone to pay a fine of over 12 million and 250 thousand euros for having illegally treated the personal data of millions of users for telemarketing purposes.
In addition to the payment of the fine - informs a note from the Guarantor -, the company will have to adopt a series of measures dictated by the Authority to comply with national and European legislation on data protection.
The provision concludes a complex investigation launched by the Guarantor following hundreds of reports and complaints from users who complained of continuous unwanted telephone contacts, made by Vodafone and its sales network, to promote the telephone and internet services offered by the company.
The investigations carried out by the Authority highlighted important "system" criticalities - which concern the violation not only of the obligation of consent, but also of the fundamental principles of accountability and implementation of privacy protections right from the design phase of the treatments, established by EU regulation.
Criticalities attributable to the complex of transactions carried out by the company with regard to both the entire customer base of Vodafone and the wider range of potential users in the electronic communications sector.
In particular, during the investigation, an alarming phenomenon emerged of the use of fictitious numbers or in any case not registered in the Register of Communication Operators to make promotional contacts.
A phenomenon, perceived by Vodafone itself, which seems to be traced back to an "underbrush" of abusive call centers, which carry out telemarketing activities in total disregard of the provisions on the protection of personal data.
Additional violation profiles were identified in the management of the lists of names to contact acquired from external suppliers.
Lists that Vodafone's commercial partners had received from other companies and transferred to the telephone operator without the necessary free, informed and specific consent of the users.
The security measures of the customer management systems were also found to be inadequate, a profile on which the Authority had already received numerous complaints and reports from customers who had been contacted by self-styled Vodafone operators, who requested the '' sending identity documents via Whatsapp, probably for the purpose of spamming, phishing or for carrying out other fraudulent activities.
In light of the violations found, the Privacy Guarantor applied a fine of 12,251,601 euros.
The Authority therefore ordered Vodafone to introduce systems that make it possible to prove that data processing for telemarketing purposes is carried out in compliance with the provisions on consent.
The company must also demonstrate that the contracts are activated only following promotional calls made by its sales network, through numbers registered and registered in the Roc.
Vodafone will also have to strengthen security measures in order to prevent unauthorized access to customer databases and provide full response to the requests for exercise of rights made by some users.
Finally, the Guarantor has prohibited Vodafone from any further processing of data for promotional or commercial purposes carried out through the acquisition of personal data lists from third parties, without the latter having acquired a specific, free and informed consent from users for the communication of their data.