Sanction RGPD Italian Data Protection Authority (Garante) — Comune di Velletri : 2 k€ (2026)
Le 12 février 2026, Italian Data Protection Authority (Garante) a prononcé une sanction RGPD de 2 k€ à l'encontre de Comune di Velletri (secteur : Secteur public et éducation), sur le fondement de Art. 5 (1) a), Art. 6 Art. 12, Art. 13, Art. 28 (1), pour non-respect des principes de traitement. Référence de décision : 10225225.
- Autorité de contrôle
- Italian Data Protection Authority (Garante)
- Pays
- Italie
- Entreprise / secteur
- Comune di Velletri
- Montant de l'amende
- 2 k€
- Date de la décision
- 12 février 2026
- Fondement juridique
- Art. 5 (1) a), Art. 6 Art. 12, Art. 13, Art. 28 (1)
- Manquement
- Non-respect des principes de traitement
- Référence de décision
- 10225225
Résumé des faits
The Italian DPA has imposed a fine of EUR 2,000 on the Commune di Velletri. The controller provided a cemetery app containing data on deceased persons for use within the app. The app combined public and institutional cemetery information, such as names and places of burial, with social and commercial features. In order to view the data of deceased persons, data subjects had to install the app, create a profile, and enter their personal details. Therefore, data processed for institutional public purposes was used for more than the municipality could have used it for. Additionally, the controller failed to adequately control the app provider, who acted as a processor, and to adequately inform data subjects.