Italy

Esselunga S.p.A.

5,000 €

GDPR enforcement action by Italian Data Protection Authority (Garante) on 2026-03-26.

Rank · Sector

#142

of 219 in Employment

Rank · Italy

#424

of 613

Rank · All fines

#1,954

of 3,223

Case details

Authority: Italian Data Protection Authority (Garante)
Date: 2026-03-26
Controller / Processor: Esselunga S.p.A.
Sector: Employment
Quoted Articles: Art. 12 GDPR, Art. 15 GDPR
Type of violation: Insufficient fulfilment of data subjects rights

Summary

The Italian DPA has imposed a fine of EUR 5,000 on Esselunga S.p.A. A former employee of the controller requested access to their attendance records. Rather than providing these records, the controller called the data subject to verify the reason for the request. It was only after the data subject had contacted the DPA that the controller provided him with the requested data.

Open original source Links to the regulator's original publication or another source.