# Ministero della Giustizia (Italian Ministry of Justice): Insufficient legal basis for data processing

- Type: Enforcement
- Source: Italian Data Protection Authority (Garante)
- Date: 2026-10-07
- Original: https://www.enforcementtracker.com/ETid-3393
- Canonical: https://overview.legal/posts/607203
- Topics: Personal Data, Processing, Public Authority, Supervision, Supervisory Authorities

## Summary

The Italian Data Protection Authority (Garante) fined the Italian Ministry of Justice (Ministero della Giustizia) €20,000 for processing personal data without a sufficient legal basis under GDPR Articles 5(1)(a) and (c) and Article 6. The Garante found that the Ministry failed to identify a valid legal basis for the processing operations at issue, thereby violating the lawfulness, fairness, and purpose limitation principles. This enforcement action highlights the Garante's scrutiny of public sector data processing activities to ensure compliance with the GDPR's legal basis requirements.

## Full text

Italian Data Protection Authority (Garante) fined Ministero della Giustizia (Italian Ministry of Justice) €20,000 on 2026-10-07 for: Insufficient legal basis for data processing.
GDPR Articles: Art. 5 (1) a), c) GDPR, Art. 6 (1) c), e) GDPR, Art. 6 (2), (3) GDPR
Sector: Public Sector and Education
Country: Italy
Source: https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/10309500

## Cited law provisions (7)

### GDPR — gdpr-art-5-par-1-en

Personal data shall be:

### GDPR — gdpr-art-5-par-1-pnt-a-en

processed lawfully, fairly and in a transparent manner in relation to the data subject (‘lawfulness, fairness and transparency’);

### GDPR — gdpr-art-5-par-1-pnt-c-en

adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed (‘data minimisation’);

### GDPR — gdpr-art-6-par-1-en

Processing shall be lawful only if and to the extent that at least one of the following applies:

### GDPR — gdpr-art-6-par-2-en

Member States may maintain or introduce more specific provisions to adapt the application of the rules of this Regulation with regard to processing for compliance with points (c) and (e) of paragraph 1 by determining more precisely specific requirements for the processing and other measures to ensure lawful and fair processing including for other specific processing situations as provided for in Chapter IX.

### GDPR — gdpr-art-5-en

Principles relating to processing of personal data

### GDPR — gdpr-art-6-en

Lawfulness of processing

---
Generated by overview.legal · https://overview.legal/posts/607203 · 2026-11-14