Garante per la protezione dei dati personali (Italy) - 10269624
Italian DPA fines a publisher €280,000 for unlawful marketing emails and data processing.
Italy's Garante has fined a publishing company €280,000 for sending marketing emails without valid consent or a contract. The data subject never confirmed their account, but the company proceeded with sending promotional emails and making calls. The DPA found violations of GDPR articles related to lawful processing, consent, and the right to object, also noting the company's lack of cooperation and previous infringements.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Garante per la protezione dei dati personali?
Get an email when a new story names Garante per la protezione dei dati personali, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonThe publishing company processed personal data for marketing purposes without a lawful basis, sending promotional emails and making calls to a user who never confirmed their account registration. This violates the GDPR's core principle that processing must have a valid legal ground — such as explicit consent or a legitimate contract — before any communication occurs. The company compounded the violation by ignoring the data subject's right to object and failing to cooperate with the Garante during the investigation. This case illustrates that automated marketing pipelines must have consent verification gates built in, not treated as optional steps. Repeat infringements and non-cooperation significantly increase regulatory penalties, making a culture of compliance essential.
What helps against this
How we list vendors- Email authentication (DMARC)
Nobody can send email that pretends to come from your domain.
- Email security
Phishing, malware and invoice fraud are filtered out before they reach inboxes.