GDPR Fines Tracker & Statistics

A social cooperative in Lentini, Sicily, left unanswered a man's November 2024 request for access to his data, including those in a sworn declaration. It also ignored the Garante's invitation to reply to him and the later notice opening proceedings, breaching its duty to cooperate. Fine of €1,000.

After a school support worker was dismissed on disciplinary grounds, the Ministry's Monza and Brianza district office emailed her name, birth details, job and the sanction to every regional school office in Italy and all local state schools. Blocking her rehiring did not justify so wide a circulation, and no rule allowed it. €10,000 fine.

Bologna's Sant'Orsola university hospital posted in its transparency section, open to Google indexing, a list of 95 job-centre referrals marked fit or unfit for posts filled from employment-office lists, which can point to disability or hardship. Rules on publishing competition results did not apply; data were later removed. €10,000.

A private investigation and security firm kept two ex-employees' personal work email accounts alive after they left in February 2020, redirecting incoming mail until at least October 2020. Its staff privacy notices dated from 2010-2011 and were never updated for the GDPR. Consent claimed via the exit deal was no defence. Fine: €6,500.

Inspections with the Finance Police, prompted by complaints including some from a TV show, found rogue call centres spoofing numbers to reach people on the opt-out register, texting a link to a TIM partner's form to fake callback requests, then calling back officially. TIM failed to vet leads, monitor partners or honour objections. €9,516,000.

Emilia-Romagna's regional employment agency put online, indexed by search engines, a ranking of about 700 jobseekers from job-centre lists for posts at Bologna's university hospital, names in clear. No rule required this, and such lists can hint at disability or low income; anonymised positions would have sufficed. Fine of €30,000.

A comprehensive school in Castelnuovo Cilento excluded a nursery pupil over missing compulsory vaccinations and copied the exclusion letter to the town mayor, wrongly treating him as the local health authority; the mayor then went to the father's workplace to tell him. Vaccination status is health data and no law allowed the disclosure. €2,000.

When its payroll officer was on prolonged sick leave in 2024, Terralba council reset his computer password and opened his work email and files to pay staff salaries. Although it consulted its DPO and tried to warn him, it had no prior policy telling staff such access could happen and made no use of shared folders. Fine: €8,000.

During a February 2026 inspection, Ravenna local police found that cameras at a business called 'La Terrazza' also filmed nearby private land and the public road, and that its signs named the wrong controller. The owner's claim that the system was idle for maintenance was rejected. Fine of €700, mitigated by later fixes.

Rieti city council mistakenly posted a resolution with all its annexes, including a waste-collection contract listing names, tax codes and property details of over 31,000 waste-tax payers; its publishing software attached files by default. A press release echoed by local outlets did not properly inform those affected. Fine: €6,000.

Bologna consultancy NIER Ingegneria was hit by Black Basta ransomware in October 2024. Attackers probably entered its VPN with credentials leaked online, created a new admin account and later posted stolen staff and trainee data on the dark web. Multi-factor authentication covered only a few accounts and not the VPN. Fine: €120,000.

For a month Villaputzu kept on its online notice board and transparency pages a decision ending a worker's employment after a failed probation. Her name was withheld, but her staff number and the context made her identifiable, and no rule required those details to be published. The decision was taken down promptly. €2,000 fine.

Replying to an employee's request for clearance to transfer to another public body, a small municipality of about 4,000 residents copied its letter to that body, revealing the trade union affiliation of the employee and of a second person. Its belief that the recipient already knew was no defence. A one-off, negligent disclosure: €2,000.

Character Technologies, US developer of the Character.AI chatbot launched in Italy in April 2024, gave users incomplete, poorly translated privacy information, did not explain that data was used to pre-train its models, relied on a self-declared age gate minors could bypass, and adopted its DPIA and EU representative late. Fine: €158,000.

Il Fatto Quotidiano's publisher ran a 2024 article on the May 2021 cable-car disaster naming an operator employee who was only a witness, reporting her hospital admission days after the crash and quoting remarks made in distress. Her identity was not essential to the story; the piece came down only after proceedings began. Fine: €23,750.

Cerved Group computed the 'Score Retail Utilities' that two Hera Group retailers combined with Experian's score to accept or reject customers. Answering access requests, it only confirmed whether it held a record, omitting the score, sub-scores tied to age, birthplace and residence, and their logic; revised templates stayed incomplete. €400,000.

Trieste-based EstEnergy refused energy contracts after credit checks run by its parent Hera S.p.A. When a rejected applicant sought his file, it sent the report with the sub-scores deliberately blacked out. It kept scoring data with no time limit, hid arrears sharing with Hera Comm and gave its parent incomplete instructions. €1.4 million.

Hera Comm, the Hera Group's main energy retailer, credit-checked about one million applicants but stored all sub-scores without a retention policy and reused them to refine group rating models. Its access replies concealed the scores and logic, and it swapped arrears data with sister firm EstEnergy without telling customers. Fine: €5.8 million.

A faulty API update on the University of Pisa's exam-booking platform mixed up logged-in users for under an hour, letting students see other students' names and email addresses and cancel their bookings: 137 students and 221 registrations were affected, 156 of them cancelled and later restored. Missing validation checks led to a €15,000 fine.

At the Giuliano Isontina University Health Authority, two doctors and two nurses from paediatrics used the dossier's self-declared override to view an adult patient's records and those of three people close to him. Such overrides were routine, about 18% of accesses, and triggered no alerts. €10,000 fine; appeal pending.

Experian Italia supplied one of two scores that Hera Group energy retailers combined to vet applicants, some of whom were refused supply. Its access-request replies omitted the score, sub-scores and logic, even for people scored solely by address, and it sent the platform provider sub-scores the calculation did not need. Fine: €120,000.

The state-owned operator of Italy's energy-market information system met every request to correct its customer register by referring people to suppliers, leaving errors such as contracts in dead people's names; as processor it also ignored the regulator's instructions. An accuracy charge was dropped. €90,000 fine, under appeal.

Docplanner Italy, processor for outpatient clinics, suffered a ransomware attack on its legacy clinic software. Intruders moved laterally and disabled antivirus unnoticed; the firm used shared admin accounts and had not patched a known firewall flaw. A drive holding data of 26 client facilities was accessed. Fined €10,000.

A sole-trader online news publisher in Agrigento ignored a woman's request to remove a 2017 article naming and picturing her as a missing minor. The Garante also found it never notified a hack of its newsroom mailbox holding ID and banking data, had weak security and offered no privacy notice from 2020 until 2026. Fine: €2,075.

The Enna Provincial Health Authority posted a procurement resolution whose annex revealed a complainant's criminal-proceedings data. After his lawyer objected it blanked the notice-board copy, but the file stayed visible in its website's tenders section until the Garante intervened. Fined €20,000 for unlawful disclosure and failure to erase.

After a temp worker's assignment ended and he postponed several visits, Cosmint cut the padlock on his locker the day before his last appointment, filmed the contents, including intimate items, and threw them away without telling him. It had no locker rules or notice and first ignored the Garante's questions. Fine: €6,600.

A driver fined by Vasto's red-light camera complained of no signs and unmasked images. The Garante found the signs and online notice vague on purposes, retention and rights, the full notice hard to find, other cars left unmasked in his photos and the DPIA done late and incomplete. Fine of €5,000, plus orders to fix notices and DPIA.

A health police probe at the urology ward of a Lecce hospital found patient files in a trolley left open because its key was missing, staff never formally authorised or given written instructions, none of the 44 staff trained, and an outsider let in to work alongside them by a doctor. Fine: €4,500.

A door-to-door sales agency for Sorgenia called and e-mailed a lawyer whose number was on the opt-out register, then dismissed his access request as a scam. Its claim of a misdialled number did not hold up, and it had used a sub-agent without the supplier's written authorisation. As processor, it was fined €15,300.

A teacher at a hotel and catering school in Abano Terme posted a critical note about a pupil's unprepared remedial work in the class agenda of the e-register, forgetting to limit who could see it, so classmates and their parents could read it for several days. The school, as controller, was fined €1,000.

At a Red Cross facility in Florence, a patient who told ward staff she had HIV and HCV then received meal trays with a slip stating her conditions, her name on one, so kitchen staff were told without need. The Red Cross also ignored a request for information. Penalties of €500 and €200 make €700.

Answering a former employee's request for access to documents, a department of the Sardinian regional government also sent the reply, with her performance appraisal attached, to the certified e-mail of the body she had just joined. Marking it confidential did not make this disclosure to a third party lawful. Fine: €3,000.

Sciacca published on its website a managerial act recording a former employee's voluntary resignation and payment in lieu of notice, with his name in the title, and a link kept it reachable long after the 15-day notice-board period. No law required publishing it, and a previous similar breach weighed against the town. Fine: €6,000.

Officers visiting a 26-square-metre artisan bakery in Rome's Trastevere found a working camera system with no notice to customers or staff. The company, which had applied for Labour Inspectorate approval and cited financial hardship, put signs up straight after the visit. That cooperation kept the penalty to €700.

Police checking a Trastevere restaurant found seven CCTV cameras covering its dining rooms and outside area with no warning signs. The owner said a window sticker had been hidden by a linen cupboard moved for cleaning, but the Garante relied on the police report and held that one sticker would not have sufficed anyway. Fine: €1,400.

Liguria's regional health agency tracked its cars by GPS every 60 seconds, in effect monitoring drivers all shift, without a prior DPIA, and after an anonymous tip used one driver's location history in disciplinary action. Data gathered so disproportionately could not lawfully be reused that way. Readings are now every 15 minutes. Fine: €6,000.

A former member of a Milan gym kept getting promotional e-mails, at least six, though he had never consented, and both the unsubscribe links and a formal objection by certified e-mail were ignored. The company also left the Garante's request for information unanswered. Penalties of €2,050 and €1,880 make €3,930, plus orders to honour his objection.

Mirabella Imbaccari kept council resolutions online that named a resident, or gave her initials, as party to a building-violation dispute with the town, and ignored her request to fix it. It had also not appointed a new DPO or updated the contact details lodged with the Garante. Separate penalties of €1,200 and €600 add up to €1,800.

An inspection at a Naples hospital group found that its electronic health dossier let doctors search any past patient across all wards and logged edits but not views. The patient notice was inaccurate and silent on retention, and no consent was sought to add earlier records. Prompt fixes were credited and the fine set at €15,000.

Almost 50 people reported calls steering them into Energia Sostenibile supply deals, with agents inventing bonuses, tariff changes or faults or posing as rival firms; most were on the opt-out register. The supplier disowned the calls but never vetted or monitored its agents, used a flawed web form and botched an access request. Fine: €100,000.

Vortika took over a five-site dental clinic chain by leasing the business from a company in liquidation, acquiring its patient records, but never told former patients. Its later notice wrongly cited consent as the basis for treatment, and no DPO was named despite large-scale health processing. Fines of €20,000 and €10,000 total €30,000.

After a row with staff at its Arco store ended with police being called, a customer asked Lidl Italia within hours, and twice more, for the CCTV footage and for it to be kept. Lidl insisted on its own form, let the images be deleted, replied by registered post instead of e-mail and omitted the right to complain. Fine: €43,000.

Ventasso published online the list of twelve candidates admitted to the written test for a job reserved for disabled workers, indirectly revealing their health status, and the file stayed reachable by link long afterwards. Blaming the mountain union that ran the selection did not help: as employer the municipality was controller. Fine: €8,000.

A passenger with reduced mobility objected to Emirates making her fill in its MEDIF medical form. After consulting the civil aviation authority ENAC, the Garante accepted that the health data could be collected, but found the information on the form unclear and seven-year retention excessive. Fine: €180,000, plus orders to trim form and storage.

A newly formed M&A advisory firm with one employee pulled about 700 phone numbers and 400 e-mail addresses through the Lusha plug-in for LinkedIn and cold-called a man whose number was not public. It had neither consent nor any notice to the people contacted and sent no defence. Fine of €1,000, plus a ban on using and an order to erase the data.

A sole trader selling B2B lead generation bought 2,500 business contacts from Apollo.io for $224 and e-mailed them adverts on a legitimate-interest basis, never checking the data's origin or securing the consent Italian law requires for e-mail marketing. The €1,500 fine covers the missing consent; the sketchy footer notice drew a reprimand.

An alpine hunting reserve set camera traps beside salt licks in remote woodland to study wildlife but put up no signs. One trap captured a man, and the footage was later used in criminal proceedings against him. Even incidental filming of people requires notice, so the reserve, which has since removed the traps, was fined €1,000.

An agent for energy supplier Nuova Corrente phoned a woman hinting at a double-billing error, and an in-house operator then pushed a new contract. Her number came from a lead site with non-granular consent and no identity checks; the firm left list sourcing to the agency unvetted and ignored her access request. Fine: €15,000.

A supermarket operator running a retail chain's loyalty scheme as processor matched prize redemptions on an anonymous card with a cashier's shifts, till and credit card to bring disciplinary charges that led to her dismissal. Acting beyond its processor role, it had no legal basis, gave no notice and ignored her later rights request. Fine: €34,000.

Rhysida ransomware hit the Matera health authority, encrypting on-site servers and backups and stealing 600 GB from a shared drive with data on about 95,000 people, including health records. The SIEM ignored firewall logs, there was no SOC, the network was flat, systems were outdated and remote access lacked MFA. Fine: €8,600.

At Cosenza prison, a service order reassigning an officer in line with the occupational doctor's advice, citing his physical condition, health needs and need to alternate posture, was pinned up in the staff canteen and TV room and sent to unions. Collective agreements are no legal basis for sharing health data, and the ministry was fined €12,000.

A state school near Rome posted on its website a call for teachers to provide home tuition, giving a pupil's initials, noting medical records on file and favouring teachers of his class. Together these details identified the child and revealed his health. The school blamed staff turnover, removed the circular and was fined €4,000.

A hospital neonatologist uploaded to a paediatrics congress an e-poster on a case of neonatal Marfan syndrome, showing a full-body photo of the baby, who later died, with only the eyes masked, beside clinical and family details; it was then posted online. The father agreed only to anonymous use, so there was no valid basis. Fine: €5,000.

Lepida, a regional in-house firm issuing SPID digital IDs to 1.5 million people, let any desk operator browse any user's data and log-ins and download ID and health cards; one took 258 users' files out of curiosity. Copies lingered on local PCs, database checks were weak, logs exceeded 24 months and controllership was misstated. Fine: €100,000.

Campo Calabro posted on its online notice board the rankings of an internal pay-progression selection, naming eleven staff members with their performance scores, and kept the act available for five years. Transparency rules require only aggregate bonus data and a call for applications cannot create a legal basis: fine of €6,000.

Tax police inspecting a small shop in Cuneo found a CCTV camera aimed at the till, meant to settle payment disputes, which the sole trader could watch on his phone. It filmed an employee yet had neither signs nor Labour Inspectorate clearance. He ignored the Garante, which fined him €2,000, ordered signs and barred use until authorised.

In the same proceedings as its parent group, Postepay was fined €5,877,000 because the compulsory fraud-detection software in its payment app over-collected device information, with further breaches on lawfulness, user information, processor terms, the DPIA and storage periods. Enforcement is on hold after a Rome judge granted interim relief.

Poste Italiane made users of its app accept the ThreatMetrix anti-fraud tool, set up to gather more device data than fraud prevention required. Other failings: legal basis, transparency, processor contracts, impact assessment, privacy by design, security and retention. Fine: €6,624,000, suspended by a Rome court in July 2026 pending appeal.

After an employee left, Framos Italia kept his two personal work mailboxes running for six months without a prior balancing test or proper notice, ignored his erasure request for the same period citing litigation that never came, and gave IT staff no written instructions. Taking its liquidation into account, the Garante set the fine at €5,000.

Local police visiting a clothing shop in Jesi found a working camera whose live feed the owner watched on his phone, with no warning signs and no Labour Inspectorate approval for filming staff. That employees knew of it did not cure the missing procedure. Given the roughly three-month use and prompt removal, the fine was €2,000.

A former patient said his GP refused to erase his records and used an incomplete privacy notice. The Garante accepted that the records could be kept for possible legal claims, but found the notice lacked details of recipients, retention, data subject rights and the right to complain. The doctor, who has revised it, was fined €2,000.

A municipality left a council resolution and a payment decision in its online notice-board archive long past the 15-day limit. Only initials were used, yet its secretary general was easily identified, and the acts revealed her pregnancy, maternity, parental leave and sick absence. Health data may never be disseminated: fine of €5,000.

Seeking approval for a stand-in while its municipal secretary was off sick, a small municipality attached her full INPS sickness certificate to the request sent to the prefecture and to the substitute secretary. The certificate showed no diagnosis, but sharing it was unnecessary and lacked a legal basis for health data. Fine: €3,000.

The Piacenza Bar Association kept a lawyer on its online list of suspended members after his two-month disciplinary suspension had ended. Although it later updated the list, the old PDF stayed reachable through a search engine until September 2024. Publishing the expired sanction had no legal basis, and the Garante imposed €3,000.

A bank employee looked up the account records of some 3,500 customers, including public figures and colleagues, thousands of times over almost three years with no work reason. Intesa Sanpaolo first reported only nine victims and lacked controls to stop this. Fined €31.8 million; a Turin court suspended enforcement in July 2026 pending appeal.

Facing a climate lawsuit brought by Greenpeace, ReCommon and 12 citizens, Eni posted the full writ of summons on a web page about the case, exposing the private claimants' birth details, tax codes and home addresses. The Garante rejected legitimate interest, as masking those details would have served Eni's defence equally well. Fine: €96,000.

The Municipality of Cassino posted a council resolution and its annex online, naming the operator of a municipal service and listing his taxable and projected income for a planned asset sale. No law required this, the income data went beyond what transparency needed and stayed online for over 18 months, so the Garante fined it €2,500.

The Garante fined supermarket chain Esselunga €5,000 for failing to answer in writing a former worker's request for his attendance records since 1997, phoning him instead to ask why he wanted them, and supplying the data only after the Garante stepped in.

The Garante fined the owner of a Rome greengrocer's €2,000 after municipal police found four cameras, one trained on the till, with no information signs and no labour inspectorate approval for filming staff; it ordered signs and limited use until authorised.

The Garante fined Copacabana, which runs a Rome restaurant, €2,000 for CCTV fitted after a theft that had no signs and lacked labour inspectorate approval although staff worked there; it ordered signage and barred use during opening hours pending authorisation.

The Garante fined a minimarket in Jesi €1,000 after local police found six CCTV cameras operating where staff worked without labour inspectorate authorisation, and banned use of the system during opening hours until approval is granted.

The Garante fined the municipality of Sutri €2,000 for publishing online, on its notice board and transparency pages, a decision and council resolutions on an employee's transfer request, one citing the disability employment law and thus revealing health data.

The Garante fined Hanako, a restaurant operator in the Padua area, €2,000 for five CCTV cameras covered by a single sign, run without labour inspectorate approval at the time of a tax police check, and viewable without any login credentials.

The Garante fined INPS €40,000 as its pre-filled ISEE service loaded household data from the ANPR register, exposing names and tax codes of 47,464 residents of care homes and other institutions to 2,919 third parties; it also reprimanded INPS for letting minors file alone.

The Garante fined a Rome secondary school €2,000 after scrap paper handed out at a sex and relationships education session turned out to be a list of pupils with disabilities, naming a student with a specific learning disorder and so revealing health data.

The Garante fined a barber's shop €800 after a police inspection found two working cameras, one by the till and one covering the entrance, viewable on the owner's phone but with no warning signs; it ordered proper signage within 30 days.

The Garante fined broadcaster La7 €40,000 after a TG La7 report on the Paragon spyware case aired stock footage showing unrelated people's phone numbers, names, labels such as 'lover of' and call-log details, also posted on YouTube; it barred further dissemination.

The Garante fined insurer ITAS Mutua €50,000 for screening a former employee's work mailbox and releasing only private emails in reply to his access request, and for keeping staff email backups for five years and web logs for a year without proper notice or safeguards.

The Garante fined Enel Energia €563,052 because service calls to customers who had refused marketing were used to pitch offers, web call-back requests relied on a weak SMS opt-out instead of confirmation, and sales partners' compliance was poorly vetted and enforced.

The Garante found that a water-treatment sole trader had leads bought and cold-called for it via Flamel without appointing processors, valid consent or opt-out register checks, and ignored an access request; it banned use of the unlawfully obtained data.

The Garante fined software provider Dedalus Italia €32,000 after a faulty update to its HR portal, used by 11 Emilia-Romagna health trusts, let staff see colleagues' leave requests for some hours, including disability-related leave revealing health data.

The Garante fined the publisher of news site Lunanotizie.it €10,000 because a 2023 erasure request about a 2016 arrest article went unanswered, one listed contact address being long defunct, and because it ignored the Garante's own request for information.

The Garante fined Groupharma €3,000 for ignoring a former collaborator's request for a copy of her last contract and for removal of her photo and contact details from the company website's 'about us' page, which stayed online after she left.

The Garante fined the Ministry of Economy and Finance €12,000 after its processor Formez PA put online, via a link on the ministry's site, the names of over 300 candidates who passed a managerial competition's pre-selection test; the ministry also failed to oversee the processor.

The Garante fined a technical school in Correggio €2,000 for posting teachers' named timetables and break-duty rotas on its website without a legal basis, and for showing staff absences and cover arrangements to pupils, parents and support staff via the e-register.

The Garante fined the Ministry of Enterprises and Made in Italy €15,000 after Formez PA, its processor for a 225-post recruitment competition, published a ranking online with candidates' tax codes and scores; the ministry lacked an adequate processor agreement and oversight.

The Garante fined Flamel €15,000 for running a water-purifier telemarketing campaign as a processor with no written Art. 28 appointment, using an unauthorised sub-processor and leads with invalid consent, which led to calls to a number on the opt-out register.

Social cooperative Depac was fined €15,000 for logging six cleaning and maintenance workers' attendance at a municipality with fingerprint readers, without legal basis, notice, record or DPIA, and for ignoring the Garante. It must delete the biometric data.

The Ministry of Enterprises was fined €15,000 for publishing a recruitment ranking of winners and eligible candidates with tax codes, scores and preference entitlements; it stayed reachable after removal, was copied elsewhere, and an access request went unanswered in time.

The Garante fined a music conservatory €5,000 after its director emailed over 100 staff that their ex-administrative director was removed from post because of a criminal court's ban from public office, disclosing criminal-conviction data without legal basis.

The Garante fined Ciemme €1,000 for ignoring its information request after a complaint about unwanted calls from someone wanting to know where the company got her data. It was also ordered to deal with her access, erasure and objection requests.

The Garante fined a restaurant-pizzeria owner on Procida €2,000 for running CCTV beyond its labour inspectorate permit, viewing images remotely by phone and keeping them about ten days instead of 24 hours, with signs not naming the controller or purpose.

Legal training firm Lex Iuris was fined €15,000 and reprimanded after two lawyers, whose addresses it had found online for possible teaching work, were mistakenly put on its promotional mailing list and their access requests went unanswered.

Sportitalia (GetFIT gyms) was fined €30,000 for continuing to send marketing emails to an ex-member who had objected and asked for deletion, as lists given to email providers were synced by hand, and for not replying to the Garante's information request.

A sole trader running a venue in Varese was fined €1,000 by the Garante after police found three indoor CCTV cameras operating with no signs telling customers that the premises were under video surveillance.

Mazara del Vallo was fined €4,000 for using street cameras not approved for traffic enforcement to spot vehicles lacking a valid roadworthiness test and fine drivers remotely, without a legal basis, adequate signage and information, or a DPIA.

The Garante fined insurance agency Bressanelli Galli Gelpi Porta €15,000 for emailing clients, whose data it held as an insurer's agent, its own promotions for insurance and a pension fund without consent or a privacy notice, and ignoring an access request.

Water purifier seller Depurazione Acqua was fined €15,000 after a sales call reached a number on Italy's opt-out register, using leads bought via a list provider without valid consent; it also failed to appoint that partner as processor. Further use was banned.

The Garante fined lead generator Unleadmited €5,000: its website took contacts with one tick covering its own and third-party marketing under an outdated notice, it could not prove consent (no double opt-in) and it replied late to the Garante. Further use was banned.

Based s.r.l. was fined €12,000 by the Garante for brushing off a former collaborator's request to access and then delete his work email account, calling it 'alleged personal data', while the account stayed active; he had also never received a privacy notice.

A sole trader running a pizzeria in Calabria was fined €1,500 by the Garante: its five unsigned cameras also filmed the public road, and footage of a road accident showing the complainant was handed to another party involved in the crash.

After a local police inspection, the Garante fined a grocery shop in Monterotondo €2,000: its four cameras, one filming the public street, had no warning signs and covered an employee without labour inspectorate authorisation. It must add signs and re-aim the cameras.

The Garante fined the Macerata medical association €4,000 for copying a doctor's suspension for not being vaccinated against Covid-19 to the city's mayor and a local health authority director, recipients for whom no legal provision allowed disclosure.

Coccaglio was fined €6,000 by the Garante for using footage from CCTV at its municipal warehouse, installed against theft, in disciplinary proceedings against a worker, without labour-law safeguards, a privacy notice or a DPIA.

The Garante fined Velletri €2,000 as cemetery records it supplied fed the 'Aldilàpp' app, which made users register to locate graves and added social and commercial features beyond its public task; it also failed to supervise its processors and inform people.

At the National Archaeological Museum of Campobasso, the Ministry of Culture ran CCTV without a union agreement and used footage to discipline an employee, with inadequate notices for staff and visitors and no DPIA. The Garante fined the ministry €12,000.

Università Telematica e-Campus used biometric face recognition to check attendance at online teacher-training webinars from March to November 2024, relying on consent presented as compulsory. The Garante found no valid basis, excess data and no DPIA, fining it €50,000.

The Garante fined the congregation running Milan's Istituto San Giuseppe La Salle €12,000: CCTV had run since 2019 without labour-law safeguards, and a teacher filmed footage of a pupil's accident on a phone for an insurer's investigator. Notices were poor and no DPIA was done.

A Catania technical school posted on its website a circular naming 51 students with disabilities with their classes, support teachers and inclusion-meeting times; the PDF stayed findable via Google. The Garante imposed €10,000, halved if paid within 30 days.

The Garante found that FNOPI, the nurses' federation, unlawfully published names of candidates in a recruitment competition, including those not admitted to the oral exam, which stayed indexed by search engines after removal. The published decision is under court challenge.

The Garante fined a plastic surgeon €5,000 for posting a patient's rhinoseptoplasty photos on Instagram. Her consent covered anonymised images, but she remained recognisable, so her health data was disclosed unlawfully. Paying within 30 days would halve the fine.

After dismissing its managing director, LTL kept his individual work email account active for about two months and forwarded incoming mail to another company account, and it never answered his rights request. The Garante fined the company €40,000 and ordered a reply.

Anticimex ignored a former employee's access request and kept his work mailbox running for well over a year after he left, having it forensically examined for evidence of a non-compete breach. The Garante fined it €40,000 and banned access to staff email content.

Seed firm Pioneer Hi-Bred Italia fitted leased company cars with telematics logging private and business trips and scoring staff driving. The Garante found no valid legal basis, poor information and no processor agreements, ordered private-trip data deleted and fined it €120,000.

A self-employed professional sent a message about a dispute with the complainant, including her home address, to the shared institutional inbox of the ministry office where she worked, then ignored the Garante's requests for information. The Garante fined the professional €1,000.

A catering distributor on Elba had outdoor cameras filming the public road, poorly visible signs lacking key details, no labour inspectorate approval for filming staff and no processor contract with the installer, who could view footage remotely. The Garante fined it €2,000.

The town of Nave used a camera gate to read the plates of all vehicles leaving town, storing transit data for seven days to check insurance, without a proper legal basis, notice or DPIA, and ignored a driver's erasure request. The Garante fined it €6,000.

A comprehensive school emailed a reminder about missing compulsory vaccinations to about 37 parents with all addresses visible, so each learned that the others' children were not up to date. The Garante treated this as unlawful disclosure of health data and fined it €1,000.

A state high school in Sicily filed a staff member's labour-court appeal, containing data about a serious illness, in its general records system where 14 staff could open it. It also informed and instructed employees late. The Garante fined it €1,000.

The Garante fined the town of Tuscania €12,000 over about 50 CCTV and plate-reading cameras plus cameras at waste points: no signs or notice, no legal basis for plate reading, no DPIA or processor contracts, a refused access request and incomplete replies to the authority.

A school near Bologna left a teachers' ranking list on its website for about two years showing the home addresses, phone numbers, personal emails and tax codes of 1,333 teachers, with no legal basis. The Garante imposed €2,000, noting the error was unintentional.

The Garante fined multi-utility Aimag €300,000: anyone could open a customer portal account with only a tax code and any email, exposing bills and usage history, marketing consent boxes were pre-ticked, the privacy notice was unclear and marketing data were kept five years.

The Garante fined Verisure Italy €400,000 after complaints that sales calls and texts continued despite objections. Consent taken via its website quote form was bundled, teleselling data were kept 12 months, and notices for former clients set no retention period.

The Garante ruled that producer Quarantadue unlawfully used, in a Netflix true-crime series, dozens of intercepted calls and voicemails of a murdered girl's parents that were never used at trial; it banned further distribution and imposed a €40,000 fine, now under challenge.

The Garante fined Orte €6,000: €5,000 for running 43 street cameras without a specific legal basis, with inadequate signs and privacy notices and no prior DPIA, plus €1,000 for answering the authority's information requests late and incompletely.

The Garante fined the Latina Bar Council €15,000 for publishing on its website a court hearing list naming 18 defendants with their charges and case details; the PDF, posted during Covid-era court restrictions, came up in web searches of a complainant's name.

The Garante fined Multimedia News, publisher of the online paper Lombardianews, €20,000 for ignoring a man's request to remove and de-index an old court report, running its site with no privacy notice or contact channel, and not answering the authority's questions.

Geturhotels kept sending promotional texts to a former hotel customer whose data it had held since 2015, relying on legitimate interest rather than consent, and failed to log his erasure request, so messages resumed in 2024. The Garante fined it €6,000.

The Garante fined the then mayor of Calvi Risorta €1,000 for posting on his public Facebook profile and page the names of residents, including minors, who had tested positive for Covid-19, and photos of children being vaccinated, without any legal basis.

The Garante fined Curtarolo €15,000: €5,000 for street CCTV lacking a proper legal basis, signage and DPIA, and €10,000 for filming staff at the town hall entrance and having a collaborator film an employee on sick leave, footage later used to dismiss her.

The Garante fined the Municipality of Avola €2,000 because, although it had designated a DPO in 2019 and published the contact details, it only notified them to the authority years later, after the Garante's ex officio checks had flagged the omission.

The Garante fined a secondary school in Fara Sabina €4,000: a circular calling a disciplinary class council was posted on its website with the pupil's surname in the file name (€2,000), and it had failed to appoint a DPO until after the proceedings began (€2,000).

The Garante fined FT Solutions €5,000 over its CercanumeriPro platform, which sold contact lists obtained from a list provider to estate agencies for marketing without checking consent, while wrongly posing as a processor and falling short on transparency.

The Garante fined the Pisa nursing order €16,000 for putting its professional register online with the home addresses of some 3,600 nurses, exposing them to fraud and safety risks. Its poor cooperation, first defending the practice, weighed against it.

The Garante fined a regional order of radiology and allied health technicians €6,000: €3,000 for showing a member's suspension in its online register though her appeal had suspended it, and €3,000 for not appointing a DPO since 2018.

The Garante fined Officine Serena, which absorbed Green.mec, €1,000 because the firm ignored a former worker's access request for his training certificates and the reports behind his dismissal, later sending only the certificates. It must supply the rest.

The Garante fined solar installer E-Power €35,000 after 22 reports and a complaint about promotional calls made without consent, using lists from a Moldovan provider wrongly cast as its processor, ignoring a rights request and running a flawed web form.

The Garante fined the Municipality of Pazzano €3,960 (three fines of €1,320) for ignoring a 2021 order to redact online documents and register its DPO, failing to answer the authority's information request and lacking a privacy notice on its website.

The Garante fined Vimar €15,000 for setting up an email account in a worker's name without telling him and letting many staff share it for over three years at its Marostica warehouse, login details on a sticker. Security charges were dropped.

The Garante fined the Autonomous Province of Bolzano €32,000 over cameras reading vehicle number plates for mobility planning and crime prevention that breached core GDPR principles. Bolzano's court upheld the Province's challenge in March 2026; litigation is pending.

The Garante fined La Prima, a Milan estate agency in the Tecnocasa network, €10,000 for sending marketing emails without consent, ignoring the recipient's erasure request and disregarding a 2021 order to stop marketing without a legal basis.

The Garante fined the Municipality of Isola del Gran Sasso €3,000 for publishing council resolutions on an employee's work situation, including criminal proceedings against her, and for ignoring her erasure request even though its DPO advised redaction.

The Garante fined Giada FM €1,000 for refusing a former employee's request for copies of her training certificates, arguing they belonged to the company, and leaving her access request unanswered until January 2025, well into the authority's proceedings.

The Garante fined the City of Nichelino €18,000: €10,000 for keeping online decisions naming a former employee and her dismissal for failing probation and ignoring her request to correct them, and €8,000 for posting full recruitment competition rankings.

The Garante fined a company €6,000 after finance police found seven working CCTV cameras at its two shops in Carmagnola with no warning signs and no labour inspectorate approval, required where cameras can monitor staff. The firm filed no defence.

The Garante fined the Municipality of Buccino €6,000: €4,000 for posting identifiable photos of children and psychiatric patients on its Facebook page without a legal basis and not removing all of them, and €2,000 for failing to publish its DPO's contact details.

The Garante fined the Migliarino San Rossore Massaciuccoli Regional Park €8,000 for mistakenly posting selection-board minutes for its director post online, revealing data on 45 candidates and self-declared criminal proceedings or convictions of seven of them.

The Garante fined the Interior Ministry's fire service department €12,000 after the Florence fire command shared a spreadsheet on about 60 firefighters' Covid vaccination status, doses and exemptions in a staff social channel with roughly 260 members.

The Garante fined Casa di Cura Città di Roma €12,000 after inspecting its electronic health dossier: consent automatically covered past care, doctors, nurses and admin staff could see patients across all wards, and views of the dossier were neither logged nor monitored.

The Garante fined Careggi university hospital €80,000 for letting staff search patients' past records through its electronic health dossier since 2011 without proper information, consent or access limits. A Florence court cut the fine to €20,000 in April 2026.

The Garante fined Venice €10,000 over the portal for its day-visitor access fee: exempt visitors had to pre-register and reveal too much about why they were exempt, residents' guests were recorded, and kiosk browser settings could be changed, exposing other users' data.

The Garante fined the publisher of the Linea Libera news site €2,000 for articles exposing complainants' names, home addresses, tax codes, photos, car plates and part of a medical certificate, and for refusing erasure. It banned the processing and ordered deletion.

The Garante fined transport company SATI €10,000 for showing codes for reasons of absence, such as sickness, injury, disability-care leave, union leave or blood donation, on shift rotas pinned up at depots and emailed to all staff.

The Garante fined Viterbo's Order of Nursing Professions €10,000 because a control panel left online by its web provider from 2020 to 2024 let anyone with the URL view, edit or delete the records of about 2,500 members without logging in.

The Garante fined BBVA €100,000 after a customer who had suffered a fraud asked for recordings of his calls to customer service; the bank first sent one silent recording and only released the others after the authority stepped in, months later.

The Garante fined the nursery 'La Combricola Dei Birichini Di Betty' €10,000: its notice made photo consent look like a condition of enrolment, children's pictures went online, CCTV filmed staff and children without a lawful basis or impact assessment, and DPO duties were unmet.

The Garante fined a Monopoli comprehensive school €4,000 for posting on its website a circular that listed, by surname, initial and class, pupils with disabilities called to inclusion meetings, unlawfully revealing health-related data about children.

The Garante fined the University of Cassino and Southern Lazio €8,000: €4,000 for keeping a former contract lecturer's mailbox active and storing his emails long after he left, and €4,000 for mishandling his rights requests and leaving his data online.

The Garante fined the Municipality of Conversano €3,000 because for a period it could not prove it had designated a data protection officer; its notice to the authority even named an IT supplier instead of the council. A related publication charge was dropped.

The Garante fined automotive supplier Magna PT €50,000 over 'return to work' interviews after sickness, injury or hospital stays: the forms gathered health-related details without a legal basis or proper notice and were kept for over 10 years. Their deletion was ordered.

The Garante fined Poste Vita €80,000 after staff answered emailed requests from an impostor between 2021 and 2023, sending details of a customer's life policies to an unverified address; the data was then used in court. The breach was notified nearly four months late.

Noi Compriamo Auto outsourced email marketing to partners without proper processor contracts or checks, so a complainant got repeated unsolicited emails without valid consent and his rights requests were caught by spam filters. The Garante fined it €45,000.

Menarini Silicon Biosystems trained an AI cell-counting tool on data from about 98 multiple myeloma patients, but its privacy notice blurred the purpose and gave a misleading 25-year retention period not tied to that purpose. The Garante fined it €21,000.

When chasing a hotel over protective equipment for a cook, Milan's health protection agency mistakenly attached his medical records, including an occupational disease certificate and a work-stress assessment. The Garante fined it €7,000, halved if paid within the appeal period.

Autostrade per l'Italia brought disciplinary charges against an employee using her posts in a closed Facebook group and Messenger and WhatsApp chats forwarded by others. The Garante held this use of private communications unlawful and fined it €420,000; an appeal is pending.

Bologna's nursery-school office sent files with disabled children's health details to 67 schools, 26 coordinators and six district heads, and one school e-mailed a file to 53 parents. Finding no legal basis and excessive disclosure, the Garante fined the city €40,000.

San Francesco al Campo council posted online a resolution with an administrative court appeal and powers of attorney naming ten people who challenged its ordinances, some with birth dates, addresses and tax codes, beyond the legal period. The Garante fined it €1,200.

Cooperativa Quadrifoglio, running school inclusion services for Bologna, e-mailed strike-notice spreadsheets still holding a sheet with disabled children's names, conditions and ICD-10 codes. Acting as processor, it broke its instructions and security duties: fine €20,000.

The Garante fined Energia Verde €100,000 over energy telemarketing calls made without valid consent through a sales chain with undefined roles and no processor appointments, poor handling of rights requests, and late, inadequate answers to the authority.

Tirrenia Hospital, a private clinic, answered a patient's data access request only after the Garante intervened, blaming a hard-disk failure on the PC of the employee handling certified e-mail. A €2,000 fine followed for the late reply.

MA Immobiliare cold-called about a hundred people from lists bought from Realmaps without verifying consent, giving notice or checking the opt-out register, and redirected rights requests to Realmaps. The Garante banned use of the lists and fined it; the firm has gone to court.

Estate agency Versilmagra messaged people on WhatsApp from a list of 4,501 owners' numbers bought from Realmaps without checking notices or consent, and sent rights requests back to the supplier. The Garante fined it €2,000 for unlawful marketing and poor accountability.

The Garante fined Lombardy Region €50,000 for keeping staff e-mail metadata for 90 days and logging all employees' web browsing without a union agreement or impact assessment, and for keeping old helpdesk tickets too long without processor contracts covering them.

The Garante fined Lombardy's Order of Psychologists €30,000 after a 2023 NoEscape ransomware attack via an exposed RDP server on an outdated system leaked data, including disciplinary files, on the dark web. It lacked MFA and automatic alerts for unusual access.

Undici used Realmaps-sourced data for direct marketing without verifying it had been lawfully obtained or honouring data subjects' requests; the Garante fined it €8,000.

The municipality of Ponte nelle Alpi published staff performance scores with names without a legal basis; the Garante fined it €4,000.

A citizens' assistance body kept a person's data beyond the retention period set by national law; the Garante fined it €5,000.

A mountain community's camera outside a police station filmed staff and passers-by in breach of data protection rules; the Garante fined it €8,000.

Estate agency Immobiliare Valdalpone used property-owner data bought from Realmaps for marketing without checking its lawfulness, informing people or honouring rights requests; fine €15,000.

Five agencies and firms making calls for Acea Energia lacked a legal basis and broke other core principles; the Garante's individual fines ranged from €30,000 to €500,000, totalling €850,000.

Acea Energia ran a network of call centres making aggressive customer win-back and sales calls using lists of data processed without a legal basis; the Garante fined it €3m.

Luka Inc., developer of the Replika companion chatbot, had no valid legal basis for its processing, an inadequate privacy policy and no age verification to protect children; the Garante fined it €5m, which can be halved if paid within 60 days.

Three companies running a gym chain used customers' phone numbers for marketing without consent and ignored erasure requests; the Garante fined each €6,000, totalling €18,000.

A Tropea secondary school used staff biometric data for attendance checks in a way that was unlawful and opaque. The decision sets €4,000.

The municipality of Palma di Montechiaro neither appointed a DPO nor notified one to the Garante; fine €3,000.

The municipality of Roccaraso posted a worker's personal data on its online notice board without a legal basis; fine €2,000.

Interflora used customer data for direct marketing without valid consent and ignored an objection until a complaint was filed. The decision sets €40,000.

Encore Thermoengineering acquired a bankrupt company's employee data but never hired those people, kept the data indefinitely and ignored their erasure requests; the Garante fined it €20,000.

A hotel-management school posted a Christmas video featuring minor pupils on YouTube without parental consent; the Garante fined it €2,000.

A telecoms retailer processed customer data without a legal basis and did not tell the person concerned how their data was used; the Garante fined it €15,000.

Agricultural development agency ARSAC processed employees' geolocation data without a legal basis, explained it poorly and carried out no DPIA; the Garante fined it €50,000, which can be halved if paid within 60 days.

A butcher's shop used CCTV with no information signs and cameras that also covered public areas; the Garante imposed €1,500.

The municipality of Cori listed the names of people receiving food cards for those in need on its website; the Garante fined it €2,000.

Bar Gioia ran two cameras without warning signs, one also filming the public area outside; the Garante fined it €600.

A Como high school published state exam results, with pupils' names and oral exam dates, on its public website; the Garante fined it €2,000.

A tourist association in Cittareale posted its members' personal data on its website without a legal basis and was fined €600.

San Pio Hospital in Benevento let staff with no need to know see technical consultancy reports containing an employee's sensitive data; the Garante fined it €6,000.

Realmaps compiled data on property owners and sold it for direct marketing without a demonstrable legal basis, without informing people or enabling their rights, collecting more than needed and designating its DPO incorrectly; the Garante fined it €100,000.

The Garante imposed €2,000 on the municipality of Torre Annunziata for late notification of its DPO's contact details.

Maddaloni municipality did not tell the Garante its DPO's contact details in time and was fined €2,000.

A doctor posted images of a cosmetic-surgery patient on social media without consent and was fined €20,000 by the Garante.

E.ON Energia recorded marketing consents wrongly when activating supplies, so telemarketing calls lacked a legal basis, and it ignored a complainant's rights request. The Garante fined it €892,738.

Delivery platform Foodinho tracked about 35,000 riders' locations even outside shifts, shared their data without a legal basis, used facial recognition, and ran automated rating and task-assignment systems without safeguards such as human review. The Garante fined it €5m.

Energy supplier Illumia was fined €678,897 after complaints about unsolicited sales calls from call centres working for it. The Garante found calls made without a legal basis, weak oversight of the telemarketing chain and security measures adopted too late.

The Garante fined OpenAI €15m over ChatGPT for training on users' data without a legal basis, poor transparency, no age checks and an unreported 2023 breach, and ordered a six-month information campaign. The Court of Rome upheld OpenAI's appeal in March 2026.