Enforcement · Italian Data Protection Authority (Garante) EN LLM context

Atac s.p.a.: Non-compliance with general data processing principles

The Italian DPA (Garante) has imposed a fine of EUR 400,000 against Atac s.p.a..

€400,000 Fine

Atac s.p.a.

ITALY

Art. 5 GDPR Art. 6 GDPR Art. 30 GDPR Art. 32 GDPR

Integrity and Confidentiality Principle Retention Period Storage Limitation Supervisory Authorities Security

Jul 22, 2021 Source gpdp.it

Full text 2 findings

Paragraphs carrying a topic or an applied provision show those connections inline

The Italian DPA (Garante) has imposed a fine of EUR 400,000 against Atac s.p.a.. The Garante had launched an investigation following a complaint from an individual who had complained about the new parking meters installed in the in the city of Rome. In fact, the company Atac s.p.a., which was contracted by the city to manage the parking lots, had initiated a technical upgrade of the parking meters in order to offer new services (e.g., the payment of fines/fees or the purchase/renewal of public transport tickets) and introduce new payment methods that also take into account the vehicle's license plate number. All parking information was then managed through a centralized system, which could also be accessed through an app by the employees responsible for controlling parking fees. Irregularities were then identified during the investigation. It was found that Atac had not established a data processing register.

Supervisory Authorities

Also, the retention periods for the collected data were not specified, and appropriate security measures were not taken. For example, it was found that at the time of the audit, some data flows to and from the system implemented by were going through insecure channels. In addition, officials could have checked any license plate en masse and repeatedly over time, for example, to find out a person's habits and parking location. GDPR Articles: Art. 5 GDPR, Art. 6 GDPR, Art. 30 GDPR, Art. 32 GDPR Industry: Industry and Commerce

Integrity and Confidentiality Principle Security applies Art. 5 Art. 6 Art. 30 Art. 32

How it connects

2 of 2 paragraphs apply legislation or carry a topic — see them in the full text ↓

References

Related across sources

C-60/22 UZ v Bundesrepublik Deutschland In Case C-60/22, the CJEU (Fifth Chamber) ruled on a preliminary reference from the Verwaltungsgericht Wiesbaden concerning UZ, a third-country national, and the Bundesrepublik… Fifth Chamber May 4, 2023 Right to Restriction Right to be Forgotten Personal Data

C-768/21 TR v Land Hessen In Case C-768/21, the Court of Justice of the European Union (First Chamber) ruled on a preliminary reference from the Verwaltungsgericht Wiesbaden concerning TR's challenge of… First Chamber Sep 26, 2024 Supervision Data Breaches Integrity and Confidentiality Principle

C-231/22 État belge v Autorité de protection des données In Case C-231/22, the Court of Justice of the European Union interpreted Article 4(7) and Article 5(2) of the GDPR in response to a preliminary reference from the Brussels Court… Third Chamber Jan 11, 2024 Controllers Personal Data Public Authority

C-77/21 Digi Távközlési és Szolgáltató Kft. v Nemzeti Adatvédelmi és Információszabadság Hatóság In this preliminary ruling, the CJEU interpreted Articles 5(1)(b) and 5(1)(e) GDPR in proceedings between Digi Távközlési és Szolgáltató Kft. and the Hungarian National Authority… First Chamber Oct 20, 2022 Retention Period Storage Limitation Personal Data

C-638/23 Amt der Tiroler Landesregierung v Datenschutzbehörde In Case C-638/23, the Court of Justice interpreted Article 4(7) GDPR in response to a preliminary reference from the Austrian Verwaltungsgerichtshof in proceedings between the Amt… Eighth Chamber Feb 27, 2025 Public Authority Controllers Personal Data

C-175/20 SIA 'SS' v Valsts ieņēmumu dienests In Case C-175/20, the Court of Justice of the EU interpreted GDPR Articles 5 and 6 in response to a preliminary ruling from the Latvian Regional Administrative Court concerning a… Fifth Chamber Feb 24, 2022 Retention Period Personal Data Legitimate Interest