Content type · 697 documents in this view · 3,813 in total
Enforcement
Regulatory actions, fines, warnings, and enforcement decisions
Country: Italy (50) Clear filter
Filter by Topic Supervisory Authorities 3594 Processing 2644 Personal Data 2403 Controllers 2026 Processing Agreement 1114 Security 1018 Supervision 854 Healthcare 622 Law Enforcement 568 Monitoring 553 Public Authority 542 Consent 508
€40,000 RCS Mediagroup S.p.a.: Non-compliance with general data processing principles The Italian DPA has imposed a fine of EUR 40,000 on RCS Mediagroup S.p.a. for publishing images of an individual without a valid legal basis. Art. 5 Jun 8, 2023
€300,000 Rinascente S.p.A.: Non-compliance with general data processing principles The Italian DPA has fined Rinascente S.p.A. EUR 300,000. The DPA acted on a complaint from a customer who, following an incident with a store employee, had her long-standing… Art. 5, 12, 32 +1 Jun 8, 2023
€5,000 Azienda Tutela della Salute della Sardegna: Insufficient legal basis for data processing The Italian DPA has imposed a fine of EUR 5,000 on Azienda Tutela della Salute della Sardegna. The health authority had placed a sign at the gate of a physician's practice… Art. 2, 5, 9 Jun 7, 2023
€20,000 Ew Business Machines S.p.A.: Non-compliance with general data processing principles The Italian DPA has imposed a fine of EUR 20,000 on Ew Business Machines S.p.A.. The controller had installed a video surveillance system that not only recorded images in real… Art. 5, 9, 13 +1 Jun 1, 2023
€3,000 Comune di Napoli: Insufficient legal basis for data processing The Italian DPA has imposed a fine of EUR 3,000 on Comune di Napoli. The municipality had sent three former employees, after termination of their employment an e-mail containing… Art. 2, 5, 6 Jun 1, 2023
€15,000 Thin Srl: Non-compliance with general data processing principles The Italian DPA has imposed a fine of EUR 15,000 on Thin Srl. The authority took action following a complaint from a GP who alleged that the company had breached data protection… Art. 5, 9, 13 Jun 1, 2023
€10,000 Camedi s.r.l.: Insufficient technical and organisational measures to ensure information security The Italian DPA has imposed a fine of EUR 10,000 on Camedi s.r.l. Medical Center. A person had filed a complaint with the DPA because they had received invoices as well as… Art. 5, 9, 32 Jun 1, 2023
€20,000 Azienda Usl Toscana Sud Est.: Non-compliance with general data processing principles The Italian DPA has imposed a fine of EUR 20,000 against Azienda Usl Toscana Sud Est. The controller had put up an information poster in the emergency room showing a healthcare… Art. 2, 5, 9 +1 Jun 1, 2023
€10,000 La Gazzetta di Parma S.r.l.: Non-compliance with general data processing principles The Italian DPA has fined La Gazzetta di Parma S.r.l. EUR 10,000. The controller had published photos in its newspaper of an individual accused of murder. The photos showed the… Art. 5 May 17, 2023
€10,000 Grizzaffi Management Srl: Insufficient fulfilment of data subjects rights The Italian DPA has imposed a fine of EUR 10,000 on Grizzaffi Management Srl for sending out marketing messages, despite the fact that the data subjects had exercised their right… Art. 5, 17, 21 May 17, 2023
€40,000 Volkswagen Leasing GmbH: Insufficient fulfilment of data subjects rights The Italian DPA has imposed a fine of EUR 40,000 on Volkswagen Leasing. A customer had filed a complaint with the DPA because the controller had not provided them with information… Art. 12, 15 May 17, 2023
€10,000 Azienda ULSS 6 Euganea: Insufficient technical and organisational measures to ensure information security The Italian DPA has imposed a fine of EUR 10,000 on Azienda ULSS 6 Euganea. The controller had mistakenly sent documents containing personal data to the wrong patients. The DPA… Art. 5, 6, 32 May 17, 2023
€60,000 Website operator: Non-compliance with general data processing principles The Italian DPA has imposed a fine of EUR 60,000 on a website operator. The controller had published unauthorized personal data on the website www.trovanumeri.com, which it had… Art. 5, 6, 12 +6 May 17, 2023
€10,000 Santander Consumer Bank S.p.a.: Insufficient fulfilment of data subjects rights The Italian DPA has fined Santander Consumer Bank S.p.a. EUR 10,000 for not sufficiently fulfilling its obligation to comply with a data subject's request for access to their data. Art. 12 May 17, 2023
€4,000 Università degli studi di Cassino e del Lazio Meridionale: Non-compliance with general data processing principles The Italian DPA has imposed a fine of EUR on Università degli studi di Cassino e del Lazio Meridionale. A professor at the university had filed a complaint against the university… Art. 2, 5, 6 +1 Apr 27, 2023
€176,000 Roma Capitale: Non-compliance with general data processing principles The Italian DPA imposed a fine of EUR 176,000 on Roma Capitale. The city had provided data of women who had abortions to the company in charge of the funeral, which included the… Art. 2, 5, 9 +3 Apr 27, 2023
€15,000 Ufficio Scolastico Regionale per la Puglia, Ufficio VI - Ambito Territoriale di Lecce: Insufficient legal basis for data processing The Italian DPA has imposed a fine of EUR 15,000 on Ufficio Scolastico Regionale per la Puglia, Ufficio VI - Ambito Territoriale di Lecce. The school board had published a… Art. 2, 5, 6 +1 Apr 27, 2023
€400 Private individual: Non-compliance with general data processing principles The Italian DPA has fined a private individual EUR 400 for unlawfully operating video surveillance cameras on their property. Art. 5, 6 Apr 27, 2023
€239,000 Ama S.p.a.: Insufficient legal basis for data processing The Italian DPA imposed a fine of EUR 239,000 on Ama S.p.a.. Ama is in charge of the administration of certain cemeteries in Rome. The city of Rome had provided data of women who… Art. 2, 28, 29 +1 Apr 27, 2023
€2,000 Store owner: Insufficient fulfilment of information obligations The Italian DPA has fined a store owner EUR 2,000 for failing to provide sufficient information pursuant to Art. 13 GDPR about CCTV surveillance in their premises. Art. 5, 13 Apr 27, 2023
€240,000 Benetton Group S.r.l.: Non-compliance with general data processing principles The Italian DPA has imposed a fine of EUR 240,000 on Benetton Group S.r.l.. The controller had stored a large amount of customer data indefinitely. The DPA also found that the… Art. 5, 32 Apr 27, 2023
€237,800 Green Network S.p.A.: Insufficient technical and organisational measures to ensure information security The Italian DPA has imposed a fine of EUR 237,800 against Green Network S.p.A.. The DPA had received several complaints from data subjects regarding unauthorized telemarketing.… Art. 5, 25 Apr 14, 2023
€676,956 Sorgenia S.p.a.: Insufficient technical and organisational measures to ensure information security The Italian DPA has imposed a fine of EUR 676,956 against Sorgenia S.p.a.. The DPA had received several complaints from data subjects regarding unauthorized telemarketing. During… Art. 5, 12, 25 Apr 14, 2023
€15,000 Citynews S.p.A.: Non-compliance with general data processing principles The Italian DPA has fined Citynews S.p.A. EUR 15,000. The controller had published an article in a newspaper reporting on the arrest of an individual, including health data of the… Art. 5, 9 Apr 14, 2023
€500,000 Mas s.r.l.: Non-compliance with general data processing principles The Italian DPA has imposed a fine of EUR 500,000 on Mas s.r.l.. As part of its investigation, the DPA found that the controller had acquired illegally created lists containing… Art. 5, 6, 7 +4 Apr 13, 2023
€13,000 Azienda socio sanitaria locale n. 3 di Nuoro: Insufficient legal basis for data processing The Italian DPA has imposed a fine of EUR 13,000 on Azienda socio sanitaria locale n. 3 di Nuoro. An individual had filed a complaint with the DPA because the health authority had… Art. 2, 5, 6 +1 Apr 13, 2023
€200,000 Mas s.r.l.s.: Non-compliance with general data processing principles The Italian DPA has imposed a fine of EUR 200,000 on Mas s.r.l.s.. During its investigation, the DPA found that the controller had acquired illegally created lists containing… Art. 5, 6, 7 +4 Apr 13, 2023
€7.6M TIM S.p.A.: Insufficient legal basis for data processing The Italian DPA has fined TIM S.p.A. EUR 7,631,175. The DPA had received numerous complaints about the telecommunications provider, mainly for unauthorized telemarketing… Art. 5, 6, 7 +5 Apr 13, 2023
€3,000 Comune di Cogollo del Cengio: Insufficient legal basis for data processing The Italian DPA has imposed a fine of EUR 3,000 on Comune di Cogollo del Cengio. A former employee had filed a complaint with the DPA due to the fact, that the municipality had… Art. 2, 5, 6 +1 Apr 13, 2023
€4,000 Azienda socio-sanitaria locale n. 1 di Sassari: Insufficient technical and organisational measures to ensure information security The Italian DPA has imposed a fine of EUR 4,000 on Azienda socio-sanitaria locale n. 1 di Sassari. The controller had mistakenly sent a document containing health data of the data… Art. 5, 9, 32 Mar 23, 2023
€30,000 Bolzano municipality: Insufficient technical and organisational measures to ensure information security The Italian DPA has imposed a fine of EUR 30,000 on Bolzano municipality. The Bolzano health authority had reported a data breach to the DPA involving unauthorized access to the… Art. 5, 25, 32 +1 Mar 23, 2023
€10,000 Informatica Alto Adige Spa: Insufficient technical and organisational measures to ensure information security The Italian DPA has fined Informatica Alto Adige Spa EUR 10,000. The municipality of Bolzano had reported a data protection breach to the DPA involving unauthorized access to the… Art. 5, 32 Mar 23, 2023
€40,000 La Risorsa Umana.it s.r.l.: Non-compliance with general data processing principles The Italian DPA has imposed a fine of EUR 40,000 on La Risorsa Umana.it s.r.l. An employee of the controller had filed a complaint against the controller. During its… Art. 5, 13, 28 Mar 23, 2023
€1,600 Deca s.r.l.: Insufficient fulfilment of data subjects rights The Italian DPA has imposed a fine of EUR 1,600 on Deca s.r.l.. Employees had filed a complaint with the DPA because the controller had not complied with their requests for access… Art. 12, 15 Mar 9, 2023
€3,000 Store owner: Non-compliance with general data processing principles The Italian DPA has fined a store owner EUR 3,000. The controller had operated video surveillance cameras in its premises without the required authorization. Furthermore, the DPA… Art. 5, 13, 114 Mar 9, 2023
€10,000 Banca Cambiano 1884 S.p.A.: Insufficient fulfilment of data subjects rights Failure to respond to the data subject's request for access to their data in a timely manner. Art. 12, 15 Mar 9, 2023
€3,000 Aesse S.r.l.s.: Insufficient legal basis for data processing The Italian DPA has imposed a fine of EUR 3,000 on Aesse S.r.l.s.. An individual had filed a complaint with the DPA due to the fact that the controller had made an unsolicited… Art. 5, 6, 7 +5 Mar 9, 2023
€2,000 Consorzio Concessioni Reti Gas S.c.a.r.l.: Non-compliance with general data processing principles The Italian DPA has fined Consorzio Concessioni Reti Gas S.c.a.r.l. EUR 2,000. The controller continued to leave the business email account of an intern active even after the… Art. 5, 12, 13 Mar 9, 2023
€5,000 Private individual: Insufficient legal basis for data processing The Italian DPA has imposed a fine of EUR 5,000 on a private individual. The individual had sent promotional messages to several data subjects without their consent. Art. 5, 6, 130 Mar 2, 2023
€50,000 Azienda sanitaria locale di Bari: Non-compliance with general data processing principles The Italian DPA has imposed a fine of EUR 50,000 on Azienda sanitaria locale di Bari. The healthcare facility had published reviews of former patients on the Internet and provided… Art. 5, 9, 25 Mar 2, 2023
€1,000 Razmataz Live s.r.l..: Non-compliance with general data processing principles The Italian DPA has imposed a fine of EUR 1,000 on Razmataz Live s.r.l.. Razmataz had contracted a processor to carry out marketing campaigns, which the processor failed to… Art. 5, 6, 28 Mar 2, 2023
€50,000 H&M Hennes & Mauritz s.r.l. EUR 50,000: Non-compliance with general data processing principles The Italian DPA has fined H&M Hennes & Mauritz s.r.l. EUR 50,000. H&M had installed numerous video surveillance systems in its Italian stores for the purpose of preventing theft… Art. 5, 114 Mar 2, 2023
€300,000 Ediscom S.p.a.: Non-compliance with general data processing principles The Italian DPA has imposed a fine of EUR 300,000 on Ediscom S.p.a.. The marketing company had collected data from 21 million individuals via various online portals in order to… Art. 5, 6, 7 +3 Feb 23, 2023
€7,000 Azienda Ospedaliera Bianchi Melacrino Morelli: Insufficient technical and organisational measures to ensure information security The Italian DPA has imposed a fine of EUR 7,000 on Azienda Ospedaliera Bianchi Melacrino Morelli. The controller had mistakenly sent a document containing health data of the data… Art. 5, 32, 75 Jan 26, 2023
€5,000 Azienda ULSS n.5 Polesana: Insufficient technical and organisational measures to ensure information security The Italian DPA has imposed a fine of EUR 5,000 on Azienda ULSS n.5 Polesana. The healthcare facility had mistakenly sent a patient medical record to the wrong patient. The DPA… Art. 5, 9, 32 Jan 26, 2023
€5,000 Misterbianco municipality: Insufficient legal basis for data processing The Italian DPA has imposed a fine of EUR 5,000 on Misterbianco municipality. An employee had filed a complaint with the DPA due to the fact, that the municipality had published a… Art. 2, 5, 6 Jan 26, 2023
€5,000 Azienda Ospedale-Università Padova: Non-compliance with general data processing principles The Italian DPA has imposed a fine of EUR 5,000 on Azienda Ospedale-Università Padova. The controller had sent an email containing consent forms for participation in a clinical… Art. 5, 9 Jan 11, 2023
€6,000 Ufficio Scolastico Regionale per la Lombardia, Ufficio IV - Ambito Territoriale di Brescia: Insufficient legal basis for data processing The Italian DPA has imposed a fine of EUR 6,000 on Ufficio Scolastico Regionale per la Lombardia, Ufficio IV - Ambito Territoriale di Brescia. The school board had published a… Art. 2, 5, 6 +1 Jan 11, 2023
€2,500 Azienda Sanitaria Locale di Brindisi: Insufficient fulfilment of data subjects rights The Italian DPA has imposed a fine of EUR 2,500 on Azienda Sanitaria Locale di Brindisi. A data subject had filed a complaint with the DPA due to the health authority's failure to… Art. 12, 15 Jan 11, 2023
€55,000 Azienda Universitaria Giuliano Isontina: Insufficient legal basis for data processing The Italian DPA has imposed a fine of EUR 55,000 on Azienda Universitaria Giuliano Isontina . The health authority has created patient profiles using algorithms and personal… Art. 2, 5, 9 +2 Dec 15, 2022