Italy

Esselunga S.p.A.

5,000 €

GDPR enforcement action by Italian Data Protection Authority (Garante) on 2026-03-26.

Rank · Sector

#139

of 213 in Employment

Rank · Italy

#381

of 543

Rank · All fines

#1,848

of 3,050

Case details

Authority: Italian Data Protection Authority (Garante)
Date: 2026-03-26
Controller / Processor: Esselunga S.p.A.
Sector: Employment
Quoted Articles: Art. 12 GDPR, Art. 15 GDPR
Type of violation: Insufficient fulfilment of data subjects rights

Summary

The Italian DPA has imposed a fine of EUR 5,000 on Esselunga S.p.A. A former employee of the controller requested access to their attendance records. Rather than providing these records, the controller called the data subject to verify the reason for the request. It was only after the data subject had contacted the DPA that the controller provided him with the requested data.

Open original source Links to the regulator's original publication or another source.