# Garante per la protezione dei dati personali (Italy) - 10309500-n.761 - Type: Enforcement - Source: Garante - Date: 2026-11-10 - Original: https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_(Italy)_-_10309500-n.761 - Canonical: https://overview.legal/posts/615094 ## Cited law provisions (35) ### GDPR — gdpr-art-5-par-1-pnt-a-en processed lawfully, fairly and in a transparent manner in relation to the data subject (‘lawfulness, fairness and transparency’); ### GDPR — gdpr-art-5-par-1-pnt-c-en adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed (‘data minimisation’); ### GDPR — gdpr-art-6-par-1-en Processing shall be lawful only if and to the extent that at least one of the following applies: ### GDPR — gdpr-art-6-par-1-pnt-c-en processing is necessary for compliance with a legal obligation to which the controller is subject; ### GDPR — gdpr-art-6-par-1-pnt-e-en processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller; ### GDPR — gdpr-art-6-par-2-en Member States may maintain or introduce more specific provisions to adapt the application of the rules of this Regulation with regard to processing for compliance with points (c) and (e) of paragraph 1 by determining more precisely specific requirements for the processing and other measures to ensure lawful and fair processing including for other specific processing situations as provided for in Chapter IX. ### GDPR — gdpr-art-6-par-3-en The basis for the processing referred to in point (c) and (e) of paragraph 1 shall be laid down by: ### GDPR — gdpr-art-6-par-3-pnt-b-en Member State law to which the controller is subject. ### GDPR — gdpr-art-58-par-2-en Each supervisory authority shall have all of the following corrective powers: ### GDPR — gdpr-art-58-par-2-pnt-i-en to impose an administrative fine pursuant to Article 83, in addition to, or instead of measures referred to in this paragraph, depending on the circumstances of each individual case; ### GDPR — gdpr-art-83-par-2-en Administrative fines shall, depending on the circumstances of each individual case, be imposed in addition to, or instead of, measures referred to in points (a) to (h) and (j) of Article 58(2). When deciding whether to impose an administrative fine and deciding on the amount of the administrative fine in each individual case due regard shall be given to the following: ### GDPR — gdpr-art-83-par-2-pnt-a-en the nature, gravity and duration of the infringement taking into account the nature scope or purpose of the processing concerned as well as the number of data subjects affected and the level of damage suffered by them; ### GDPR — gdpr-art-83-par-2-pnt-b-en the intentional or negligent character of the infringement; ### GDPR — gdpr-art-83-par-2-pnt-f-en the degree of cooperation with the supervisory authority, in order to remedy the infringement and mitigate the possible adverse effects of the infringement; ### GDPR — gdpr-art-83-par-2-pnt-g-en the categories of personal data affected by the infringement; ### GDPR — gdpr-art-83-par-3-en If a controller or processor intentionally or negligently, for the same or linked processing operations, infringes several provisions of this Regulation, the total amount of the administrative fine shall not exceed the amount specified for the gravest infringement. ### GDPR — gdpr-art-83-par-5-en Infringements of the following provisions shall, in accordance with paragraph 2, be subject to administrative fines up to 20 000 000 EUR, or in the case of an undertaking, up to 4 % of the total worldwide annual turnover of the preceding financial year, whichever is higher: ### GDPR — gdpr-art-1-en Subject-matter and objectives ### GDPR — gdpr-art-2-en Material scope ### GDPR — gdpr-art-5-en Principles relating to processing of personal data ### GDPR — gdpr-art-6-en Lawfulness of processing ### GDPR — gdpr-art-9-en Processing of special categories of personal data ### GDPR — gdpr-art-10-en Processing of personal data relating to criminal convictions and offences or related security measures based on Article 6(1) shall be carried out only under the control of official authority or when the processing is authorised by Union or Member State law providing for appropriate safeguards for the rights and freedoms of data subjects. Any comprehensive register of criminal convictions shall be kept only under the control of official authority. ### GDPR — gdpr-art-11-en Processing which does not require identification ### GDPR — gdpr-art-15-en Right of access by the data subject ### GDPR — gdpr-art-16-en The data subject shall have the right to obtain from the controller without undue delay the rectification of inaccurate personal data concerning him or her. Taking into account the purposes of the processing, the data subject shall have the right to have incomplete personal data completed, including by means of providing a supplementary statement. ### GDPR — gdpr-art-17-en Right to erasure (‘right to be forgotten’) ### GDPR — gdpr-art-18-en Right to restriction of processing ### GDPR — gdpr-art-27-en Representatives of controllers or processors not established in the Union ### GDPR — gdpr-art-35-en Data protection impact assessment ### GDPR — gdpr-art-37-en Designation of the data protection officer ### GDPR — gdpr-art-57-en Tasks ### GDPR — gdpr-art-58-en Powers ### GDPR — gdpr-art-78-en Right to an effective judicial remedy against a supervisory authority ### GDPR — gdpr-art-83-en General conditions for imposing administrative fines --- Generated by overview.legal · https://overview.legal/posts/615094 · 2026-11-14