# Ristorante Luna: Insufficient legal basis for data processing

- Type: Enforcement
- Source: Italian Data Protection Authority (Garante)
- Date: 2026-08-06
- Original: https://www.enforcementtracker.com/ETid-3395
- Canonical: https://overview.legal/posts/607205
- Topics: Personal Data, Supervisory Authorities, Transparency, Employees, Human Resources

## Summary

The Italian Data Protection Authority (Garante) fined Ristorante Luna €2,000 for processing personal data without a sufficient legal basis. The authority found violations of GDPR Articles 5(1)(a), 6, 13, and 88, concerning failures related to lawfulness, fairness, transparency, and the processing of employee data in the hospitality sector.

## Full text

Italian Data Protection Authority (Garante) fined Ristorante Luna €2,000 on 2026-08-06 for: Insufficient legal basis for data processing.
GDPR Articles: Art. 5 (1) a) GDPR, Art. 6 GDPR, Art. 13 GDPR, Art. 88 GDPR
Sector: Accommodation and Hospitality
Country: Italy
Source: https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/10301625

## Cited law provisions (6)

### GDPR — gdpr-art-5-par-1-en

Personal data shall be:

### GDPR — gdpr-art-5-par-1-pnt-a-en

processed lawfully, fairly and in a transparent manner in relation to the data subject (‘lawfulness, fairness and transparency’);

### GDPR — gdpr-art-5-en

Principles relating to processing of personal data

### GDPR — gdpr-art-6-en

Lawfulness of processing

### GDPR — gdpr-art-13-en

Information to be provided where personal data are collected from the data subject

### GDPR — gdpr-art-88-en

Processing in the context of employment

---
Generated by overview.legal · https://overview.legal/posts/607205 · 2026-11-14