Italy

Università Telematica e-Campus

50,000 €

GDPR enforcement action by Italian Data Protection Authority (Garante) on 2026-01-29.

Rank · Sector

#69

of 357 in Public Sector and Education

Rank · Italy

#123

of 543

Rank · All fines

#746

of 3,051

Case details

Authority: Italian Data Protection Authority (Garante)
Date: 2026-01-29
Controller / Processor: Università Telematica e-Campus
Sector: Public Sector and Education
Quoted Articles: Art. 5 (1) c), e) GDPR, Art. 6 (1) c), e), (2), (3) GDPR, Art. 9 (1) g) GDPR, Art. 25 GDPR
Type of violation: Insufficient legal basis for data processing

Summary

The Italian DPA has imposed a fine of EUR 50,000 on Università Telematica e-Campus. The controller used facial recognistion system to controll the attendance in online classes, but failed to base the processing on a sufficient legal basis. Additionally the processor failed to comply with the prinicples of data minimisation, storage limitiation and data protection by default.

Open original source Links to the regulator's original publication or another source.