Italy

Comune di Sutri

2,000 €

GDPR enforcement action by Italian Data Protection Authority (Garante) on 2026-03-12.

Rank · Sector

#335

of 357 in Public Sector and Education

Rank · Italy

#498

of 543

Rank · All fines

#2,423

of 3,050

Case details

Authority: Italian Data Protection Authority (Garante)
Date: 2026-03-12
Controller / Processor: Comune di Sutri
Sector: Public Sector and Education
Quoted Articles: Art. 5 (1) a), c) GDPR, Art. 6 GDPR
Type of violation: Insufficient legal basis for data processing

Summary

The Italian DPA has imposed a fine of EUR 2,000 on the Communi di Sutri. The controller publishes its decisions for transparency purposes. However, the controller published a decision that included the personal and health data of an employee. This was not covered by the purpose and therefore had no legal basis.

Open original source Links to the regulator's original publication or another source.