# Comune di Arvier: Insufficient legal basis for data processing

- Type: Enforcement
- Source: Italian Data Protection Authority (Garante)
- Date: 2026-09-23
- Original: https://www.enforcementtracker.com/ETid-3346
- Canonical: https://overview.legal/posts/603861
- Topics: Public Authority, Supervisory Authorities

## Summary

The Italian Data Protection Authority (Garante) fined Comune di Arvier €4,000 for lacking a sufficient legal basis for its data processing activities, finding violations of Articles 5, 6, 12, 13, 25, and 35 of the GDPR. The authority determined that the municipal public sector entity failed to identify and document a valid legal basis, did not provide adequate privacy notices to data subjects, and neglected required data protection by design measures and impact assessments.

## Full text

Italian Data Protection Authority (Garante) fined Comune di Arvier €4,000 on 2026-09-23 for: Insufficient legal basis for data processing.
GDPR Articles: Art. 5 (1) a), c) GDPR, Art. 6 (1) c), e), (2), (3) GDPR, Art. 12 (1) GDPR, Art. 13 GDPR, Art. 25 GDPR, Art. 35 GDPR
Sector: Public Sector and Education
Country: Italy
Source: https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/10304881

---
Generated by overview.legal · https://overview.legal/posts/603861 · 2026-10-24