Garante per la protezione dei dati personali (Italy) - 10269624
Italy's Garante fines publisher €280,000 for sending marketing emails without confirmed sign-up.
Italy's Garante per la protezione dei dati personali has fined Altroconsumo Edizioni S.r.l. €280,000 for sending marketing emails to a user who never confirmed their account registration. The publisher argued a contract was formed upon form submission, but the Garante found no confirmation meant no contractual basis under GDPR Article 6(1)(b). The user also denied ever visiting the site, and the controller failed to respond to the DPA's inquiries.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Altroconsumo Edizioni S.r.l.?
Get an email when a new story names Altroconsumo Edizioni S.r.l., usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonAltroconsumo Edizioni sent marketing emails to a user who never completed account confirmation, relying on a flawed legal basis — claiming a contract existed upon mere form submission. Under GDPR Article 6(1)(b), no confirmed registration means no valid contractual basis for processing personal data, let alone sending commercial communications. This case highlights how misinterpreting lawful processing grounds can result in significant regulatory penalties. Compounding the violation, the controller's failure to respond to the DPA's inquiries demonstrated a systemic breakdown in accountability and cooperation obligations under GDPR Article 5(2).
What helps against this
How we list vendors- Identity governance and single sign-on
People who leave or change roles lose access everywhere at once, and forgotten accounts stop piling up.
- Email authentication (DMARC)
Nobody can send email that pretends to come from your domain.
- Email security
Phishing, malware and invoice fraud are filtered out before they reach inboxes.