[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f2yRce82A085ExbFDDpXukdMJy4gWK77vp5LWeslIX-w":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":19,"status":27,"created_at":28,"published_at":29,"article":30,"tags":34,"podcasts":47,"controls":48},"792ec740-405d-4ffb-8128-baefe26800e8","barbuti-spa-fined-5000-for-ignoring-gdpr-erasure-request","780a63e5-40ff-4371-9d9f-a4d42ffaf6c4","Barbuti S.p.A. Fined €5,000 for Ignoring GDPR Erasure Request","Barbuti S.p.A. failed to act on a customer's data erasure request submitted via the company's general contact email, continuing to send marketing messages without a valid legal basis. The root issue was an absence of internal processes to identify, route, and fulfil data subject rights requests in a timely manner. This matters because GDPR grants individuals enforceable rights over their personal data, and organisations that lack the operational infrastructure to honour those rights face regulatory fines, reputational damage, and loss of customer trust. Even a small procedural gap — such as not monitoring a general inbox for rights requests — can constitute a material GDPR violation.","**Immediate actions:**\n- Designate a dedicated, monitored email address (e.g., privacy@company.com) for all data subject rights requests and publicise it in the privacy notice.\n- Audit all current marketing contact lists to verify that a valid, current legal basis exists for every individual on them.\n\n**Process & governance improvements:**\n- Implement a documented Data Subject Rights (DSR) procedure covering intake, acknowledgement, fulfilment, and audit trail for erasure, access, and objection requests.\n- Assign clear ownership (e.g., DPO or Privacy Officer) for reviewing any email sent to general inboxes that could constitute a rights request.\n- Integrate DSR handling into CRM and marketing platforms so erasure requests automatically suppress contacts from future campaigns.\n\n**Detection & compliance monitoring:**\n- Schedule quarterly internal audits of marketing consent records and DSR fulfilment logs to identify gaps before regulators do.\n- Implement automated alerts when a data subject sends repeat communications, signalling an unresolved request.",[12,13,14,15,16,17,18],"GDPR Article 32","NIST SP 800-53 SI-2: Flaw Remediation","ISO\u002FIEC 27001:2022 Clause 7.2: Competence","CIS Control 14: Security Awareness and Skills Training","CIS Control 17: Incident Response Management","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","NIS2 Article 21(2)(b)",{"GDPR Article 32":20,"NIS2 Article 21(2)(b)":21,"NIST SP 800-53 SI-2: Flaw Remediation":22,"ISO\u002FIEC 27001:2022 Clause 7.2: Competence":23,"CIS Control 17: Incident Response Management":24,"CIS Control 14: Security Awareness and Skills Training":25,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":26},"Article 32 requires organisations to implement appropriate technical and organisational measures to ensure data processing complies with GDPR, including the ability to fulfil data subject rights; Barbuti lacked such measures.","NIS2 requires incident handling and business continuity measures, including policies that ensure personal data processing obligations (such as erasure) are embedded in operational procedures rather than left to ad-hoc inbox monitoring.","While typically applied to software flaws, the principle of identifying and correcting process deficiencies applies here — the company's broken DSR workflow was a known-category process flaw that should have been remediated before a complaint arose.","Staff handling general inboxes lacked the awareness and training to recognise an erasure request and route it appropriately, reflecting a competence gap that ISO 27001 Clause 7.2 requires organisations to address.","A defined response procedure for data subject rights requests — analogous to an incident response playbook — would have ensured the erasure request was escalated, tracked, and fulfilled within the statutory deadline.","Employees who process customer communications must be trained to identify data subject rights requests; the absence of this training directly caused the missed erasure request.","Broadly, A.8.8 and surrounding controls require organisations to maintain processes that protect personal data throughout its lifecycle, including honouring deletion obligations when consent or legal basis is withdrawn.","published","2026-11-10T12:21:45.627956+00:00","2026-11-10T12:21:45.559+00:00",{"id":7,"url":31,"slug":32,"title":33},"https:\u002F\u002Fwww.edpb.europa.eu\u002Fnews\u002Fitalian-dpa-fines-clothing-company-for-failing-to-handle-erasure-request_en","italian-dpa-fines-clothing-company-for-failing-to-handle-erasure-request-a18203","Italian DPA fines clothing company for failing to handle erasure request",[35,41],{"id":36,"name":37,"slug":38,"description":39,"color":40},"c0dcc566-3654-4d70-8ede-262a198e732f","Regulatory Compliance","regulatory-compliance","GDPR, NIS2, DORA, sector-specific violations","#ec4899",{"id":42,"name":43,"slug":44,"description":45,"color":46},"c8b843a5-d5a7-41d1-8d3b-cabded09d2ef","Data Protection","data-protection","Unencrypted data, missing DLP, poor classification","#3b82f6",[],[]]