Sintesi Evolution S.r.l – €20,000 Fine (Italy, 2024)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
A fine was imposed on Sintesi Evolution for their role in a case where a customer faced unauthorized charges from Vodaphone. The company failed to properly verify customer identities, leading to fraudulent contracts. This case highlights the importance of secure practices in handling personal data.
What happened
Sintesi Evolution was involved in opening fraudulent contracts for a customer without proper identity verification.
Who was affected
The customer who experienced unauthorized charges and had contracts opened in their name without consent.
What the authority found
The authority found that Sintesi Evolution did not adequately verify the identity of customers before processing their personal data.
Why this matters
This case emphasizes the need for companies to implement strong identity verification processes to prevent fraud and protect customer data.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Secondary-source text retrieved.
Automated check recorded — 18 October 2026.
No issues were reported by that automated check.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
The data subject complained against her telephone service provider Vodaphone before the DPA. The complaint concerned unusual charges on her bank account from the telephone provider Vodaphone Italia S.p.A, starting from 2023. The data subject managed to get some reimbursements from the client care service, but then an operator informed her about the installation of different devices on an unknown address. Moreover, the data subject found that different invoices were issues concerning new phone lines, SIMs Wifi routers and other devices that she never requested. Thus, the data subject advanced an access request as per Article 15 GDPR. Vodaphone confirmed that there were four contracts with her name on it but with fake signature, address, phone numbers and emails. All contracts were concluded at the same office of the controller, which is a sales agent of Vodaphone. The DPA decided to start an investigation in this regard and advanced a request for information to the controller. Vodaphone stated that five contracts were opened with the data subject’s name. All of these contracts resulted only partially active and all of them were concluded in the same Vodaphone store from their partner Sintesi Evolution S.r.l. Vodaphone confirmed that it deactivated the active data backup SIMs, refunded the amounts charged to the data subject, processed and confirmed receipt of the data access requests, and that it has initiated a change of customer data to a new IT platform to enable customers to receive immediate email and mobile notifications when new SIMs or fixed networks are activated. In light of these information, the DPA deemed it appropriate to advance a request for information to Sintesi Evolution S.r.l as well. This request revealed that the employee who opened the five contract was always the same employee. This employee was, by contract, required to identify the customer before the delivery of the SIM card, the acquisition of personal data from a valid document of iden
Related Enforcement Actions (0)
No other enforcement actions found for Sintesi Evolution S.r.l in IT
This is the only recorded action for this entity in this jurisdiction.
Details
Fine Date
27 November 2024
Authority
Garante per la protezione dei dati personali
Fine Amount
€20,000
GDPRhub ID
gdprhub-8886About this data
Cite as: Cookie Fines. Sintesi Evolution S.r.l - Italy (2024). Retrieved from cookiefines.eu
Last updated: