Garante per la protezione dei dati personali (Italy) - 457/2026
Italian DPA fines Municipality of Vasto €5,000 for GDPR violations related to traffic cameras.
The Italian Data Protection Authority (Garante per la protezione dei dati personali) fined the Municipality of Vasto €5,000 for violating GDPR. The violations included processing more data than necessary by capturing more than just license plates with traffic cameras and failing to conduct a proper Data Protection Impact Assessment (DPIA) before processing began. The DPA also ordered the municipality to improve data subject information and update its DPIA.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Garante per la protezione dei dati personali?
Get an email when a new story names Garante per la protezione dei dati personali, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonThe Municipality of Vasto violated the GDPR data minimisation principle by capturing more personal data than necessary through its traffic camera system, going beyond the intended purpose of recording license plates. Additionally, the municipality failed to conduct a Data Protection Impact Assessment (DPIA) prior to deploying a high-risk processing activity, a mandatory requirement under GDPR Article 35. This case highlights how public sector bodies often underestimate the privacy implications of surveillance technologies. Non-compliance not only results in financial penalties but also erodes public trust in how governments handle citizen data.
What helps against this
How we list vendors- Compliance automation (GRC)
Evidence for NIS2, DORA and ISO 27001 is collected continuously, not in a rush before the audit.