# Interflora Italia S.p.A.: Insufficient legal basis for data processing

- Type: Enforcement
- Source: Italian Data Protection Authority (Garante)
- Date: 2025-03-13
- Original: https://www.enforcementtracker.com/ETid-2665
- Canonical: https://overview.legal/posts/48780
- Topics: Right to Object, Direct Marketing, Marketing, Controllers, Personal Data, Processing Agreement, Processing, Data Controller, Supervisory Authorities, Law Enforcement

## Summary

The Italian DPA imposed a fine of EUR 20,000 on Interflora Italia S.p.A. The controller, who operates an online shop, used customer data for direct marketing purposes without a sufficient legal basis. The controller also failed to react to the objection of a data subject and only reacted after the data subject filed a complaint with the DPA.

## Full text

The Italian DPA imposed a fine of EUR 20,000 on Interflora Italia S.p.A. The controller, who operates an online shop, used customer data for direct marketing purposes without a sufficient legal basis. The controller also failed to react to the objection of a data subject and only reacted after the data subject filed a complaint with the DPA.

GDPR Articles: Art. 5 (1) a), b) GDPR, Art. 6 (1) a) GDPR, Art. 12 (3) GDPR, Art. 15 GDPR, Art. 21 GDPR
Industry: Industry and Commerce

---
Generated by overview.legal · https://overview.legal/posts/48780 · 2026-08-22