Garante per la protezione dei dati personali (Italy) - 10266250
Italian DPA fines processor €15,300 for GDPR violations related to unsolicited marketing.
The Italian Data Protection Authority (Garante) has fined Green Partner, a data processor, €15,300 for violating GDPR. The violations stemmed from unsolicited promotional calls and emails sent to a data subject whose number was on the Public-Opt-Out Registry. The processor also failed to properly handle data subject rights requests and engaged a sub-processor without authorization, contradicting its contractual agreement with the controller.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Green Partner?
Get an email when a new story names Green Partner, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonGreen Partner violated GDPR by sending promotional communications to an individual registered on Italy's Public Opt-Out Registry, demonstrating a failure to screen contact lists against do-not-contact databases before launching marketing campaigns. Compounding this, the company failed to adequately respond to data subject rights requests, a fundamental GDPR obligation. Most critically, Green Partner engaged a sub-processor without authorization from the data controller, breaching both contractual terms and Article 28 GDPR, which strictly governs processor-to-sub-processor relationships. This case illustrates how GDPR liability can cascade when processors operate beyond their sanctioned boundaries and neglect core compliance controls. Organizations acting as data processors must treat their contractual and regulatory obligations as non-negotiable operational constraints, not administrative formalities.