Italy

Azienda regionale per lo sviluppo e per i servizi in agricoltura (ARSAC)

50,000 €

GDPR enforcement action by Italian Data Protection Authority (Garante) on 2025-03-13.

Rank · Sector

#68

of 357 in Public Sector and Education

Rank · Italy

#120

of 543

Rank · All fines

#742

of 3,050

Case details

Authority: Italian Data Protection Authority (Garante)
Date: 2025-03-13
Controller / Processor: Azienda regionale per lo sviluppo e per i servizi in agricoltura (ARSAC)
Sector: Public Sector and Education
Quoted Articles: Art. 5 GDPR, Art. 6 GDPR, Art. 13 GDPR, Art. 25 GDPR, Art. 35 GDPR, Art. 88 GDPR
Type of violation: Non-compliance with general data processing principles

Summary

The Italian DPA imposed a fine of EUR 50,000 on the Regional agency for development and services in agriculture (ARSAC). The controller processed geographic data of its employees without sufficient legal basis. The controller also failed to provide sufficient informations in its internal documents regarding the data procession, breached the basic principles of lawfullness, fairness, transparency and purpose limitation and failed to conduct a data protection impact assesement.
The total sum of the fine can be reduced by 50% if paid within sixty days.

Open original source Links to the regulator's original publication or another source.