# Data Controller: Insufficient legal basis for data processing

- Type: Enforcement
- Source: Italian Data Protection Authority (Garante)
- Date: 2025-12-18
- Original: https://www.enforcementtracker.com/ETid-3025
- Canonical: https://overview.legal/posts/52379
- Topics: Controllers, Personal Data, Processing Agreement, Processing, Data Controller, Supervisory Authorities

## Summary

The Italian DPA has imposed a fine of EUR 1,000 on a data controller. The controller disclosed personal data by sending an email to an address that third parties who were not meant to receive the data had access to.

## Full text

The Italian DPA has imposed a fine of EUR 1,000 on a data controller. The controller disclosed personal data by sending an email to an address that third parties who were not meant to receive the data had access to.

GDPR Articles: Art. 5 (1) a) GDPR, Art. 6 GDPR
Industry: Not assigned

---
Generated by overview.legal · https://overview.legal/posts/52379 · 2026-08-22