Italy

Sole Trader

2,000 €

GDPR enforcement action by Italian Data Protection Authority (Garante) on 2026-02-12.

Rank · Sector

#60

of 100 in Accomodation and Hospitality

Rank · Italy

#494

of 543

Rank · All fines

#2,418

of 3,050

Case details

Authority: Italian Data Protection Authority (Garante)
Date: 2026-02-12
Controller / Processor: Sole Trader
Sector: Accomodation and Hospitality
Quoted Articles: Art. 5 (1) a), c), e) GDPR, Art. 6 GDPR, Art. 13 GDPR, Art. 88 GDPR
Type of violation: Insufficient legal basis for data processing

Summary

The Italian DPA has imposed a fine of EUR 2,000 on a sole trader. The controller, who operated a pizza restaurant, had installed a video surveillance system that had been authorised by the authorities. However, the controller operated the system in ways that were not included in the authorisation. The system was installed in such a way that the controller could view the footage remotely on his mobile phone, and the retention period exceeded the authorised 24 hours. Additionally, the controller failed to install appropriate information signs.

Open original source Links to the regulator's original publication or another source.