Italy

Bressanelli Galli Gelpi Porta & C. S.r.l.

15,000 €

GDPR enforcement action by Italian Data Protection Authority (Garante) on 2026-02-12.

Rank · Sector

#182

of 322 in Finance, Insurance and Consulting

Rank · Italy

#236

of 543

Rank · All fines

#1,222

of 3,050

Case details

Authority: Italian Data Protection Authority (Garante)
Date: 2026-02-12
Controller / Processor: Bressanelli Galli Gelpi Porta & C. S.r.l.
Sector: Finance, Insurance and Consulting
Quoted Articles: Art. 5 (1) a) GDPR, Art. 6 (1) a) GDPR, Art. 7 GDPR, Art. 12 (3), (4) GDPR, Art. 13 GDPR, Art. 15 GDPR
Type of violation: Insufficient legal basis for data processing

Summary

The Italian DPA has imposed a fine of EUR 15,000 on Bressanelli Galli Gelpi Porta & C. S.r.l. The controller had been engaged in direct marketing activities without basing the processing on a sufficient legal basis. Specifically, the controller obtained consent to process the data for a third party, but then decided to repurpose the data for its own marketing activities, despite the fact that consent had not been given for these activities. The controller also failed to adequately respond to a data subject's request to exercise their rights.

Open original source Links to the regulator's original publication or another source.