# Vimar S.p.A.: Insufficient legal basis for data processing

- Type: Enforcement
- Source: Italian Data Protection Authority (Garante)
- Date: 2025-09-25
- Original: https://www.enforcementtracker.com/ETid-2924
- Canonical: https://overview.legal/posts/49039
- Topics: Controllers, IP Address, Processing Agreement, Personal Data, Processing, Human Resources, Supervisory Authorities, Data Controller, Law Enforcement

## Summary

The Italian DPA has imposed a fine of EUR 15,000 on Vimar S.p.A. The controller created an internal and personalised email account with the personal data of a third party, without their knowledge. Multiple people within the controller's company used this account for three years.

## Full text

The Italian DPA has imposed a fine of EUR 15,000 on Vimar S.p.A. The controller created an internal and personalised email account with the personal data of a third party, without their knowledge. Multiple people within the controller's company used this account for three years.

GDPR Articles: Art. 5 (1) a), b), c), d) GDPR, Art. 6 GDPR, Art. 13 GDPR
Industry: Industry and Commerce

---
Generated by overview.legal · https://overview.legal/posts/49039 · 2026-08-22