Understanding the Challenge
During a quarterly risk review, Legal informs you of new complaints about promotional calls made after customers opted out. Your sales partner insists they followed the process, and your CRM confirms the opt-out was logged. Yet, the calls persisted.
These issues are familiar to Governance, Risk, and Compliance (GRC) teams managing third-party sales networks, contact centers, and partner channels where data flows through systems you don't directly control. This became evident when the Italian Data Protection Authority fined Wind Tre S.p.A. EUR 16,700,000 for failing to prevent unlawful telemarketing and contract activations. Individuals received promotional communications without valid consent or after objecting. Contracts were activated without their knowledge. The company's technical and organizational measures failed to prevent this.
If you're responsible for compliance in an organization with external sales channels, these challenges are yours too.
Proving Consent Verification
Your sales partners may use their own CRM systems, but you need to ensure they're checking consent before making calls. Attestations aren't enough. Implement an automated consent verification API that partners must query before each outbound contact. This API checks your central consent database and returns a yes/no response. No consent record? No call. Opt-out on file? Call blocked. This is the technical measure the Italian DPA expected Wind Tre to have in place.
Log every API call with details like timestamps, partner ID, phone number queried, and response. This allows you to trace what the partner was told before making the call. If they called anyway, you have evidence for enforcement. If your API failed to surface an opt-out, you know where to fix the control.
Under Article 24 of the General Data Protection Regulation (GDPR), you're accountable for demonstrating compliance. System-enforced checks make non-compliance technically difficult.
Defining "Effective" Measures
The Italian DPA cited Wind Tre's inability to prevent unlawful processing and promptly respond to data subjects' requests. This defines what "effective" measures mean.
Your measures must prevent violations before they happen, not just detect them afterward. Implement real-time consent checks, automated suppression lists that sync hourly, and hard stops in contract activation workflows when consent is missing. If a sales rep can override the system with a checkbox that says "customer consented verbally," your measure isn't effective.
For data subject requests, "prompt" means your systems can propagate an opt-out across all channels within hours. If someone opts out on your website at 2 PM and your partner's dialer doesn't see the update until tomorrow, you've failed Article 12's requirement for requests "without undue delay."
Document your sync frequencies, override controls, and propagation testing. When the regulator asks how you ensure compliance, "we have a policy" won't suffice. "Here's the system architecture and test results proving a web opt-out blocks partner calls within two hours" is what they're looking for.
Liability in Complex Sales Networks
You're fully liable when things go wrong, even if your partners handle the actual calling. The Italian DPA made this clear: controllers using complex sales networks remain responsible for ensuring personal data are processed in compliance with the GDPR.
Your partners are processors under Article 28, processing data on your instructions. You need processor agreements specifying what they can and cannot do, mandatory technical measures they must implement, and audit rights to verify compliance.
Even with a perfect contract, you're liable for their violations. Article 82 states the controller "shall be liable for the damage caused by processing which infringes this Regulation." You can sue your partner for indemnification later, but the DPA fines you first.
This changes your vendor management approach. Monitor their calling patterns in real time. Audit their consent-checking logs quarterly. Test their systems by planting known opt-outs and seeing if calls get blocked. Treat them like an extension of your IT environment, because regulators do.
Managing Consent at Retail Locations
You need proof of consent that survives regulatory scrutiny, which means more than a signature on a form.
Implement point-of-sale systems that capture explicit consent with granular options. Separate checkboxes for "I consent to marketing calls" and "I consent to marketing emails" are essential. Photograph or scan the signed form and link it to the customer record with a timestamp and location ID. Train retail staff that pre-checked boxes violate Article 7's requirement that consent be "freely given."
Wind Tre's issue included contracts activated without individuals' knowledge, indicating gaps in verification at the point of sale. Require photo ID verification and a confirmation SMS or email sent immediately after signup. The message should include what they signed up for and a one-click opt-out link. If they didn't actually sign up, you'll know within hours, not months.
For Article 5's principle of accountability, document your retail partner training program, the point-of-sale system's consent capture workflow, and your spot-check audit results. When someone complains they never consented, you can produce the timestamped form, the ID verification, and the confirmation message they received.
Handling Objections Across Channels
Build a universal suppression system that every channel checks before processing.
When someone exercises their Article 21 right to object, their identifier (phone, email, customer ID) goes into a central suppression database immediately. Your website, call center, email platform, SMS gateway, and every partner system must query this database in real time or sync it hourly at minimum.
The Italian DPA found individuals continued to receive promotional communications despite having exercised their right to object. That's a preventable Article 21 violation with proper technical architecture. You need a single source of truth for consent and objection status, not fragmented records across channel-specific systems.
Test it monthly: submit an objection through each channel and verify it propagates everywhere within your documented timeframe. If your SLA says "objections are honored within 24 hours," prove it with timestamped logs showing the suppression record was created and synced to all downstream systems.
Data Protection by Design and Default
Your systems should make compliant behavior easy and non-compliant behavior difficult or impossible.
Article 25 requires you to implement appropriate technical and organizational measures designed to integrate data protection principles into processing activities. For sales operations, this means consent checks happen automatically, not opt-in checkboxes that sales reps can ignore.
Data protection by default means processing only the personal data necessary for each specific purpose. If your CRM collects date of birth for age verification but your marketing team can access it for profiling, you've violated the default principle. Implement role-based access controls that limit marketing users to contact details and consent flags only.
When designing a new sales channel or partner integration, the compliance review happens before launch, not after the first complaint. The system architecture should enforce consent requirements, Data Minimisation, and retention limits without requiring human judgment calls.
Next Steps
Review the Italian DPA's decision for insights on accountability and technical measures.
Evaluate your processor agreements against Article 28's requirements. If they don't specify mandatory technical controls and audit rights, they're inadequate.
Map your current consent propagation flow from web opt-out to partner system blocking. If you can't draw it with timestamps, you can't defend it to a regulator.
Test your controls with the assumption that you'll need to prove they work under audit pressure. After a EUR 16,700,000 fine, proving it matters more than documenting it.
