Italy

S.M. Trattamento Acqua di XX

30,000 €

GDPR enforcement action by Italian Data Protection Authority (Garante) on 2026-02-26.

Rank · Sector

#138

of 597 in Industry and Commerce

Rank · Italy

#174

of 543

Rank · All fines

#927

of 3,050

Case details

Authority: Italian Data Protection Authority (Garante)
Date: 2026-02-26
Controller / Processor: S.M. Trattamento Acqua di XX
Sector: Industry and Commerce
Quoted Articles: Art. 4 GDPR, Art. 5 GDPR, Art. 6 GDPR, Art. 7 GDPR, Art. 12 GDPR, Art. 15 GDPR, Art. 22 GDPR, Art. 22 GDPR, Art. 24 GDPR, Art. 28 GDPR
Type of violation: Insufficient legal basis for data processing

Summary

The Italian DPA has imposed a fine of EUR 30,000 on S.M. Trattamento Acqua di XY. The controller had been active in direct marketing, using automated calls for this purpose. However, the controller failed to base the data processing on an adequate legal basis and failed to implement appropriate accountability measures. As a result, data subjects who had been registered in the Public Register of Objections were called. Furthermore, the controller failed to adequately respond to requests from data subjects. Lastly, the controller was involved in an unlawful processing chain.

Open original source Links to the regulator's original publication or another source.