Italy

Ministero della Cultura

12,000 €

GDPR enforcement action by Italian Data Protection Authority (Garante) on 2026-01-29.

Rank · Sector

#82

of 213 in Employment

Rank · Italy

#252

of 543

Rank · All fines

#1,293

of 3,051

Case details

Authority: Italian Data Protection Authority (Garante)
Date: 2026-01-29
Controller / Processor: Ministero della Cultura
Sector: Employment
Quoted Articles: Art. 5 (1) a) GDPR, Art. 6 GDPR, Art. 12 (1) GDPR, Art. 13 GDPR, Art. 35 GDPR, Art. 88 (1) GDPR
Type of violation: Non-compliance with general data processing principles

Summary

The Italian DPA has imposed a fine of EUR 12,000 on the Ministero della Cultura. The controller, who is operating the Archaeological Museum of Campobasso, used video surveillance in the museum, with the purpose of protecting the museums assets. But the controller also used the footage for disciplinary purposes against employees. Additionally the controller failed to adequatly inform data subjects regarding the processing.

Open original source Links to the regulator's original publication or another source.