Garante per la protezione dei dati personali (Italy) - 554/2026
Italian DPA fines company €6,500 for failing to deactivate accounts and inadequate privacy information.
The Italian Data Protection Authority (Garante per la protezione dei dati personali) has fined Top Secret Investigazioni e sicurezza s.r.l. €6,500 for violating GDPR. The company failed to deactivate former employees' company accounts and provide adequate information about data processing operations. An investigation revealed that email forwarding was not functioning correctly for eight months, leading to a violation of data minimization and storage limitation principles.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Garante per la protezione dei dati personali?
Get an email when a new story names Garante per la protezione dei dati personali, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonTop Secret Investigazioni e sicurezza s.r.l. failed to deactivate former employees' company accounts in a timely manner, a fundamental access control failure that left personal data exposed and processing operations non-compliant with GDPR. Compounding the issue, email forwarding was misconfigured and non-functional for eight months, meaning the organization had no clear oversight of data flows during that period. These failures directly violated GDPR's data minimization and storage limitation principles, which require that personal data is only processed to the extent necessary and not retained beyond its purpose. This case underscores that even small investigative firms handling sensitive personal data must maintain rigorous offboarding procedures and data governance controls.
What helps against this
How we list vendors- Identity governance and single sign-on
People who leave or change roles lose access everywhere at once, and forgotten accounts stop piling up.