Italy

Comune di Cassino

2,500 €

GDPR enforcement action by Italian Data Protection Authority (Garante) on 2026-03-26.

Rank · Sector

#297

of 357 in Public Sector and Education

Rank · Italy

#442

of 543

Rank · All fines

#2,192

of 3,050

Case details

Authority: Italian Data Protection Authority (Garante)
Date: 2026-03-26
Controller / Processor: Comune di Cassino
Sector: Public Sector and Education
Quoted Articles: Art. 5 (1) a), c) GDPR, Art. 6 (1) c), e), (2), (3) GDPR
Type of violation: Insufficient legal basis for data processing

Summary

The Italian DPA has imposed a fine of EUR 2,500 on the Comune di Cassino. The controller publishes its decisions for transparency purposes. However, the controller published a decision that included the personal data of a data subject, including income data. This was not covered by the purpose and therefore had no legal basis.

Open original source Links to the regulator's original publication or another source.