Sanction RGPD Italian Data Protection Authority (Garante) — S.M. Trattamento Acqua di XX : 30 k€ (2026)
Le 26 février 2026, Italian Data Protection Authority (Garante) a prononcé une sanction RGPD de 30 k€ à l'encontre de S.M. Trattamento Acqua di XX (secteur : Industrie et commerce), sur le fondement de Art. 4, Art. 5, Art. 6, Art. 7, Art. 12, Art. 15, Art. 22, Art. 22, Art. 24, Art. 28, pour base légale insuffisante pour le traitement. Référence de décision : 10236228.
- Autorité de contrôle
- Italian Data Protection Authority (Garante)
- Pays
- Italie
- Entreprise / secteur
- S.M. Trattamento Acqua di XX
- Montant de l'amende
- 30 k€
- Date de la décision
- 26 février 2026
- Fondement juridique
- Art. 4, Art. 5, Art. 6, Art. 7, Art. 12, Art. 15, Art. 22, Art. 22, Art. 24, Art. 28
- Manquement
- Base légale insuffisante pour le traitement
- Référence de décision
- 10236228
Résumé des faits
The Italian DPA has imposed a fine of EUR 30,000 on S.M. Trattamento Acqua di XY. The controller had been active in direct marketing, using automated calls for this purpose. However, the controller failed to base the data processing on an adequate legal basis and failed to implement appropriate accountability measures. As a result, data subjects who had been registered in the Public Register of Objections were called. Furthermore, the controller failed to adequately respond to requests from data subjects. Lastly, the controller was involved in an unlawful processing chain.