[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fNMnORzyI6gs-uODq3jiyzMncLQI06wg88_28biz7EZQ":3},{"article":4,"iocs":43,"watch_terms":44,"solutions":45,"lesson":48},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":20,"category":21,"article_tags":25},"a006ca1f-7edc-4c4e-a8ee-503fc90fb22e","Garante per la protezione dei dati personali (Italy) - 585\u002F2026","garante-per-la-protezione-dei-dati-personali-italy-585-2026-9ca496","Created page with \"{{DPAdecisionBOX |Jurisdiction=Italy |DPA-BG-Color= |DPAlogo=LogoIT.png |DPA_Abbrevation=Garante per la protezione dei dati personali |DPA_With_Country=Garante per la protezione dei dati personali (Italy) |Case_Number_Name=585\u002F2026 |ECLI= |Original_Source_Name_1=Garante per la protezione dei dati personali |Original_Source_Link_1=https:\u002F\u002Fwww.garanteprivacy.it\u002Fweb\u002Fguest\u002Fhome\u002Fdocweb\u002F-\u002Fdocweb-display\u002Fdocweb\u002F10297306 |Original_Source_Language_1=Italian |Original_Source_L...\" Show changes","Italy's Garante per la protezione dei dati personali has fined La Patria S.p.A. €20,000 for failing to adequately respond to two data subject access requests. The company did not provide suitable or correct information, interpreting the requests under national labor law rather than GDPR. The Garante found violations of Articles 12, 13, and 15 GDPR, emphasizing that controllers must inform data subjects of refusal reasons and their right to judicial remedy, even if the request doesn't explicitly cite GDPR.","Italy's Garante fines La Patria S.p.A. €20,000 for inadequate response to data access requests.","https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=Garante_per_la_protezione_dei_dati_personali_(Italy)_-_585\u002F2026&diff=53118&oldid=0","https:\u002F\u002Fgdprhub.eu\u002Fimages\u002Fe\u002Fec\u002FLogoIT.png","2026-09-21T12:35:22+00:00","2026-09-21T14:00:18.544802+00:00",7,[17],{"name":18,"type":19},"La Patria S.p.A.","vendor","c5c77cdb-f7d7-4990-9436-c81dcbff1163",{"id":20,"icon":22,"name":23,"slug":24},null,"Policy","policy",[26,31,36,38],{"category":27},{"id":28,"icon":22,"name":29,"slug":30},"3f0f8451-91df-4b6c-9a73-ef3b2509b7f1","GDPR","gdpr",{"category":32},{"id":33,"icon":22,"name":34,"slug":35},"53f9c4b6-8bc6-4964-9169-d09e5cd41d72","Compliance","compliance",{"category":37},{"id":20,"icon":22,"name":23,"slug":24},{"category":39},{"id":40,"icon":22,"name":41,"slug":42},"d95477d7-eb04-4fad-a2dc-be1428040ce7","Privacy Fines","privacy-fines",[],[18],{"controls":46,"vendors":47},[],[],{"slug":49,"title":50,"body":51,"framework_refs":52,"framework_notes":62},"italian-dpa-fines-la-patria-20000-for-mishandling-gdpr-data-subject-access-requests","Italian DPA Fines La Patria €20,000 for Mishandling GDPR Data Subject Access Requests","La Patria S.p.A. violated GDPR Articles 12, 13, and 15 by failing to properly respond to data subject access requests (DSARs), incorrectly interpreting them through the lens of national labor law rather than GDPR obligations. This misclassification led to inadequate or incorrect information being provided to data subjects, depriving them of their fundamental right to know how their personal data is being processed. The Garante reinforced that controllers must recognize DSARs regardless of whether the request explicitly cites GDPR, and must always communicate refusal reasons along with the data subject's right to judicial remedy. This case highlights the organizational risk of siloing privacy compliance within HR or legal teams unfamiliar with GDPR's broader obligations, rather than embedding it into a dedicated data protection function.",[53,54,55,56,57,58,59,60,61],"GDPR Article 12 – Transparent information and communication","GDPR Article 13 – Information to be provided where personal data are collected from the data subject","GDPR Article 15 – Right of access by the data subject","GDPR Article 77 – Right to lodge a complaint with a supervisory authority","NIST SP 800-53 IP-1 (Individual Access)","NIST SP 800-53 IP-2 (Individual Redress)","CIS Control 14 – Security Awareness and Skills Training","ISO\u002FIEC 27701:2019 – Privacy Information Management (PIMS)","ITIL Service Operation – Request Fulfilment Process",{}]