[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fzzgyiZAUCgbtulmI6sXjvoERKvZBzhZvyBTMwGiCBgc":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":22,"status":23,"created_at":24,"published_at":25,"article":26,"tags":30,"podcasts":49,"controls":50},"1a803657-c9b2-439b-9b32-9648a12327af","italian-dpa-fines-company-for-unlawful-email-marketing-under-gdpr-and-eprivacy","2048ed1f-ca9d-441e-ad55-3a0e7ec342a8","Italian DPA Fines Company for Unlawful Email Marketing Under GDPR and ePrivacy","A company was fined €1,500 by Italy's Garante after conducting an unsolicited email marketing campaign that improperly relied on 'legitimate interest' as its legal basis rather than obtaining explicit consent from recipients. The DPA also found the company failed to provide adequate transparency information, a fundamental GDPR requirement. Critically, the ruling reinforced that the ePrivacy Directive's marketing rules apply to B2B communications and can be enforced even when GDPR's personal data thresholds are not fully met. This case highlights that organizations often underestimate the legal complexity of digital marketing, assuming B2B outreach is exempt from strict privacy rules. Misclassifying the legal basis for processing is a common and costly compliance failure.","**Immediate actions:**\n- Audit all active marketing campaigns to confirm a valid legal basis (consent vs. legitimate interest) is correctly documented and applied.\n- Halt any unsolicited email campaigns until a legal basis review and transparency notice update have been completed.\n\n**Compliance & governance improvements:**\n- Establish a formal consent management process that captures, stores, and makes auditable all marketing opt-ins for both B2C and B2B contacts.\n- Train marketing and sales teams on the distinction between GDPR legal bases and ePrivacy Directive requirements, emphasizing that B2B campaigns are not automatically exempt.\n- Embed privacy-by-design reviews into campaign planning workflows so legal and DPO sign-off is required before any new outreach is launched.\n\n**Documentation & transparency measures:**\n- Update all marketing-related privacy notices to clearly disclose data sources, purposes, retention periods, and recipients as required by GDPR Articles 13 and 14.\n- Maintain a Records of Processing Activities (RoPA) entry specifically for marketing operations, reviewed quarterly to reflect any changes in channels or audiences.",[12,13,14,15,16,17,18,19,20,21],"GDPR Article 6 – Lawfulness of processing (legal basis)","GDPR Article 7 – Conditions for consent","GDPR Article 13 & 14 – Transparency and information obligations","GDPR Article 58 – Corrective powers of supervisory authorities","ePrivacy Directive 2002\u002F58\u002FEC Article 13 – Unsolicited communications","NIST Privacy Framework PR.CP-1 – Data processing policies","NIST SP 800-53 PT-2 – Authority to Process","CIS Control 3 – Data Protection","ISO\u002FIEC 27701:2019 – Privacy Information Management (PIMS)","ITIL Service Design – Compliance and legal requirements management",{},"published","2026-08-28T16:20:52.840699+00:00","2026-08-28T16:20:52.725+00:00",{"id":7,"url":27,"slug":28,"title":29},"https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=Garante_per_la_protezione_dei_dati_personali_(Italy)_-_351\u002F2026&diff=52825&oldid=52820","garante-per-la-protezione-dei-dati-personali-italy-351-2026-dc0860","Garante per la protezione dei dati personali (Italy) - 351\u002F2026",[31,37,43],{"id":32,"name":33,"slug":34,"description":35,"color":36},"7261eb8f-acd4-4d93-a489-7fdd652ec0ea","Security Awareness","security-awareness","Phishing, social engineering, human error","#22c55e",{"id":38,"name":39,"slug":40,"description":41,"color":42},"c0dcc566-3654-4d70-8ede-262a198e732f","Regulatory Compliance","regulatory-compliance","GDPR, NIS2, DORA, sector-specific violations","#ec4899",{"id":44,"name":45,"slug":46,"description":47,"color":48},"c8b843a5-d5a7-41d1-8d3b-cabded09d2ef","Data Protection","data-protection","Unencrypted data, missing DLP, poor classification","#3b82f6",[],[51,55],{"slug":52,"name":53,"problem":54},"email-authentication","Email authentication (DMARC)","Nobody can send email that pretends to come from your domain.",{"slug":56,"name":57,"problem":58},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes."]