Content type · 697 documents in this view · 3,813 in total
Enforcement
Regulatory actions, fines, warnings, and enforcement decisions
Country: Italy (50) Clear filter
Filter by Topic Supervisory Authorities 3594 Processing 2644 Personal Data 2403 Controllers 2026 Processing Agreement 1114 Security 1018 Supervision 854 Healthcare 622 Law Enforcement 568 Monitoring 553 Public Authority 542 Consent 508
€2,000 Provincia di Catanzaro: Insufficient involvement of data protection officer The Italian DPA has imposed a fine of EUR 2,000 on Provincia di Catanzaro for failing to provide the DPA with the contact details of their data protection officer in good time. Art. 37 Jan 31, 2024
€2,000 Provincia di Sassari: Insufficient involvement of data protection officer The Italian DPA has imposed a fine of EUR 2,000 on Provincia di Sassari for failing to provide the DPA with the contact details of their data protection officer in good time. Art. 37 Jan 31, 2024
€6,000 Municipality: Insufficient legal basis for data processing The Italian DPA has imposed a fine of EUR 6,000 on a municipality. The municipality had unlawfully published information on citizens' Covid cases on its Facebook page. The… Art. 2, 5, 6 +3 Jan 24, 2024
€8,000 Municipality of Salento: Insufficient cooperation with supervisory authority The Italian DPA has imposed a fine of EUR 8,000 on the municipality of Salento for failing to respond to an information request from the DPA in a timely manner. Art. 58, 157 Jan 24, 2024
€2,000 Istituto Comprensivo Statale “F.S. Cabrini: Insufficient legal basis for data processing The Italian DPA has imposed a fine of EUR 2,000 on Istituto Comprensivo Statale “F.S. Cabrini. The controller had published a document, which contained personal data of school… Art. 2, 5, 6 Jan 24, 2024
€2,000 Company: Insufficient fulfilment of information obligations The Italian DPA has fined a company s.r.l. EUR 2,000. The controller had installed video surveillance cameras in its premises without properly informing the data subjects about… Art. 5, 13 Dec 21, 2023
€1,000 Sirio S.p.A.: Insufficient legal basis for data processing The Italian DPA has imposed a fine of EUR 1,000 on Sirio S.p.A.. An employee filed a complaint with the DPA because the controller had passed on their personal data to a bank… Art. 5, 6, 13 Dec 7, 2023
€2,000 Mushtaq Rubina Kebabish: Insufficient fulfilment of information obligations The Italian DPA has fined Mushtaq Rubina Kebabish EUR 2,000. The controller had operated video surveillance cameras in one of their premises without properly informing about the… Art. 5, 13 Dec 7, 2023
€40,000 Azienda socio sanitaria territoriale nord Milano, C.F.: Non-compliance with general data processing principles The Italian DPA has imposed a fine of EUR 40,000 on Azienda socio sanitaria territoriale nord Milano, C.F.. During its investigation, the DPA found that a patient's spouse had… Art. 5, 9, 25 +1 Dec 7, 2023
€1,000 Techno Security s.r.l.: Insufficient fulfilment of data subjects rights The Italian DPA has imposed a fine of EUR 1,000 on Techno Security s.r.l.. A data subject had filed a complaint with the DPA due to the controller's failure to respond to a… Art. 12, 15 Nov 30, 2023
€3,000 A R.L Spartan Gym: Non-compliance with general data processing principles The Italian DPA has fined A R.L Spartan Gym EUR 3,000. The controller had operated video surveillance cameras in one of their premises without the required authorization.… Art. 5, 13, 114 Nov 30, 2023
€60,000 Limit Call S.r.l.s.: Insufficient legal basis for data processing The Italian DPA has imposed a fine of EUR 60,000 on Limit Call S.r.l.s. for unauthorized telemarketing. The controller had acquired lists of personal data without checking the… Art. 5, 6, 7 +6 Nov 30, 2023
€40,000 Amazon Italia Transport s.r.l.: Insufficient fulfilment of data subjects rights The Italian DPA has imposed a fine of EUR 40,000 on Amazon Italia Transport s.r.l. for failing to respond adequately to a data subject's request for access to their personal data. Art. 12, 15 Nov 16, 2023
€20,000 Comune di Lonato del Garda: Insufficient legal basis for data processing The Italian DPA has imposed a fine of EUR 20,000 on the municipality 'Comune di Lonato del Garda' for the unlawful use of audio-video recordings of a work interview. Art. 5, 6 Nov 16, 2023
€50,000 Comune di Castel Goffredo: Insufficient legal basis for data processing The Italian DPA has imposed a fine of EUR 50,000 on the municipality 'Comune di Castel Goffredo' for the unlawful use of audio-video recordings of a work interview. Art. 5, 6, 12 +2 Nov 16, 2023
€18,000 Cluster S.r.l.: Non-compliance with general data processing principles The Italian DPA imposed a fine of EUR 18,000 on Cluster S-r.l. A data subject had complained to the DPA because their son's health-related data and their own personal data had… Art. 5, 32 Nov 16, 2023
€100,000 Autostrade per l’Italia S.p.A.: Insufficient fulfilment of data subjects rights The Italian DPA has fined Autostrade per l’Italia S.p.A. EUR 100,000 for failing to adequately respond to requests from employees for access to their personal data. Art. 12, 15 Nov 16, 2023
€1,000 Homeowner administrator: Insufficient legal basis for data processing The Italian DPA imposed a fine of EUR 1,000 on a homeowner administrator who had installed a video surveillance system without a permit from the homeowners' association. Art. 5, 6 Oct 26, 2023
€20,000 Region of Lombardy: Insufficient legal basis for data processing The Italian DPA has imposed a fine of EUR 20,000 on the Region of Lombardy. In the context of the sale of company shares held by the region, personal data of employees of the… Art. 2, 5, 6 +1 Oct 26, 2023
€40,000 Azienda socio sanitaria territoriale di Lodi CF: Non-compliance with general data processing principles The Italian DPA has imposed a fine of ERU 40,000 on the health authority Azienda socio sanitaria territoriale di Lodi CF. Employees of the health authority had accessed the file… Art. 5, 9, 32 Oct 12, 2023
€70,000 Scionti Selezioni Superiori S.r.l.: Non-compliance with general data processing principles The Italian DPA has imposed a fine of EUR 70,000 on Scionti Selezioni Superiori S.r.l.. The controller had made unsolicited marketing calls, in some cases to individuals who were… Art. 5, 6, 7 +7 Oct 12, 2023
€5,000 Physician: Non-compliance with general data processing principles The Italian DPA has imposed a fine of EUR 5,000 on a physician for unlawfully disclosing patient data. Art. 5, 9 Sep 28, 2023
€3,000 Palombaro s.r.l.: Insufficient fulfilment of information obligations The Italian DPA has fined Palombaro s.r.l. EUR 3,000. The controller had installed video surveillance cameras in its premises without properly informing the data subjects about… Art. 5, 13 Sep 28, 2023
€50,000 Azienda Usl Toscana centro: Non-compliance with general data processing principles The Italian DPA has imposed a fine of EUR 50,000 on Azienda Usl Toscana centro. A person had reported that medical records containing sensitive patient data were still being… Art. 5, 32 Sep 28, 2023
€10M Axpo Italia Spa: Non-compliance with general data processing principles The Italian DPA has imposed a fine of EUR 10 million on electricity and gas supplier Axpo Italia Spa. The DPA had received numerous complaints from data subjects who complained… Art. 5, 24 Sep 28, 2023
€30,000 Asl Napoli 3 Sud: Insufficient technical and organisational measures to ensure information security The Italian DPA has fined Asl Napoli 3 Sud EUR 30,000. The healthcare facility had suffered a ransomware attack that used a virus to restrict access to the healthcare facility's… Art. 5, 25, 32 Sep 28, 2023
€60,000 Salvator Mundi International Hospital s.r.l: Non-compliance with general data processing principles The Italian DPA has imposed a fine of EUR 60,000 on Salvator Mundi International Hospital s.r.l. The hospital had restricted access to its services to people with a Covid-19 Green… Art. 5, 9 Sep 28, 2023
€5,000 Ministero dell'Ambiente e della Sicurezza Energetica: Non-compliance with general data processing principles The Italian DPA has imposed a fine of EUR 5,000 on Ministero dell'Ambiente e della Sicurezza Energetica. The controller had published a document on its website that contained… Art. 2, 5, 6 +1 Sep 28, 2023
€10,000 San Severo municipality: Insufficient legal basis for data processing The Italian DPA imposed a fine of EUR 10,000 on San Severo municipality. The municipality had published a document containing personal data of employees on its website without a… Art. 2, 5, 6 Sep 14, 2023
€42,000 Intesa Sanpaolo Spa: Insufficient fulfilment of data subjects rights Failure to respond to the data subject's request for access to their data in a timely manner. Art. 15 Sep 14, 2023
€5,000 Nimbus s.r.l.: Non-compliance with general data processing principles The Italian DPA has imposed a fine of EUR 5,000 on Nimbus s.r.l.. The controller had introduced a biometric attendance system at the workplace without adequately informing the… Art. 5, 9, 13 Sep 14, 2023
€90,000 GFB One s.r.l.: Insufficient legal basis for data processing The Italian DPA has imposed a fine of EUR 90,000 on GFB One s.r.l.. An individual had filed a complaint with the DPA because SIM cards were registered in their name, although they… Art. 5, 6, 13 +1 Sep 14, 2023
€20,000 Shardana Working Soc. Coop. a r.l.: Insufficient fulfilment of data subjects rights The Italian DPA has fined Shardana Working Soc. Coop. a r.l. EUR 20,000 for failing to respond adequately to requests from employees for access to information regarding their… Art. 12, 15 Sep 14, 2023
€10,000 Azienda Sanitaria dell'Alto Adige - Suedtiroler Sanitaetsbetrieb: Insufficient fulfilment of data subjects rights The Italian DPA has imposed a fine of EUR 10,000 on Azienda Sanitaria dell'Alto Adige - Suedtiroler Sanitaetsbetrieb for failing to adequately comply with its obligation to comply… Art. 12 Sep 14, 2023
€20,000 Bar association: Non-compliance with general data processing principles The Italian DPA has imposed a fine of EUR 20,000 on a bar association. Two individuals had filed a complaint with the DPA against the controller because documents relating to a… Art. 2, 5 Aug 31, 2023
€10,000 Mednow Medical Center di Giugni Marco: Non-compliance with general data processing principles The Italian DPA has fined Mednow Medical Center di Giugni Marco EUR 10,000. An individual had filed a complaint with the DPA because the controller had inadvertently sent the… Art. 5, 9, 12 +5 Aug 31, 2023
€25,000 Robin Srl: Non-compliance with general data processing principles The Italian DPA has imposed a fine of EUR 25,000 on Robin Srl. The controller had unlawfully published images of minors that were not sufficiently blurred in the context of… Art. 5, 6, 7 +2 Aug 31, 2023
€10,000 RCS Mediagroup Spa: Non-compliance with general data processing principles The Italian DPA has imposed a fine of EUR 10,000 on RCS Mediagroup Spa. A data subject had filed a complaint with the DPA due to the fact that their personal data had been… Art. 2, 5, 137 +1 Aug 31, 2023
€45,000 Municipality of Modica: Non-compliance with general data processing principles The Italian DPA has imposed a fine of EUR 45,000 on the municipality of Modica for monitoring waste disposal sites with CCTV without providing sufficient information to citizens.… Art. 5, 12, 13 +3 Jul 18, 2023
€40,000 Compara Facile S.r.l.: Non-compliance with general data processing principles The Italian DPA has imposed a fine of EUR 40,000 on Compara Facile S.r.l.. The controller had made unsolicited marketing calls, in some cases to individuals who were registered in… Art. 5, 6, 7 +8 Jul 18, 2023
€100,000 Tiscali Italia SpA: Non-compliance with general data processing principles The Italian DPA has imposed a fine of EUR 100,000 on Tiscali Italia SpA. The controller had sent advertising messages to more than 160,000 customers within four months, even… Art. 5, 12, 13 +2 Jul 18, 2023
€1,000 Prodav srl: Non-compliance with general data processing principles The Italian DPA has fined Prodav srl EUR 1,000. The controller had operated video surveillance cameras in one of their shops without the required authorization. Furthermore, the… Art. 5, 13, 114 Jul 18, 2023
€400 Private individual: Non-compliance with general data processing principles The Italian DPA has fined a private individual EUR 400 for unlawfully operating video surveillance cameras on their property. Art. 5, 6 Jul 18, 2023
€12,000 Azienda Socio Sanitaria Territoriale Ovest Milanese: Non-compliance with general data processing principles The Italian DPA has imposed a fine of EUR 12,000 on Azienda Socio Sanitaria Territoriale Ovest Milanese. The controller had suffered data breaches that affected the privacy of… Art. 5, 9, 32 Jul 18, 2023
€75,000 Università Telematica E-Campus: Non-compliance with general data processing principles The Italian DPA has imposed a fine of EUR 75,000 on Università Telematica E-Campus. The controller had sent advertising messages and made advertising calls without the consent of… Art. 5, 6, 7 +6 Jul 18, 2023
€10,000 Cat s.r.l.: Insufficient legal basis for data processing The Italian DPA has fined Cat s.r.l. EUR 10,000. Cat s.rl. had installed CCTV systems near waste garbage cans on behalf of the municipality of Modica in order to combat illegal… Art. 2, 5, 6 Jul 18, 2023
€5,000 Ermeslink di Giovanni Di Stefano: Insufficient legal basis for data processing The Italian DPA has fined Ermeslink di Giovanni Di Stefano EUR 5,000. Ermeslink had installed CCTV systems near waste garbage cans on behalf of the municipality of Modica in order… Art. 5, 6 Jul 18, 2023
€5,000 Ristorante Francesco srl: Non-compliance with general data processing principles The Italian DPA has fined Ristorante Francesco srl EUR 5,000. The controller had operated video surveillance cameras in its premises without the required authorization.… Art. 5, 13, 114 Jul 6, 2023
€10,000 AcegasApsAmga SpA: Insufficient fulfilment of data subjects rights The Italian DPA has imposed a fine of EUR 10,000 on AcegasApsAmga SpA. A former employee had filed a complaint with the DPA due to the controller's failure to respond to their… Art. 5, 12, 15 Jul 6, 2023
€1M Autostrade per l'Italia spa: Non-compliance with general data processing principles The Italian DPA has fined Autostrade per l'Italia spa ('ASPI') EUR 1 million for unlawfully processing the data of approx. 100,000 registered users of the toll reimbursement app… Art. 5, 13, 28 Jun 22, 2023