Italy

Pianeta S.r.l.

34,000 €

GDPR enforcement action by Italian Data Protection Authority (Garante) on 2026-04-29.

Rank · Sector

#130

of 608 in Industry and Commerce

Rank · Italy

#159

of 555

Rank · All fines

#885

of 3,085

Case details

Authority: Italian Data Protection Authority (Garante)
Date: 2026-04-29
Controller / Processor: Pianeta S.r.l.
Sector: Industry and Commerce
Quoted Articles: Art. 5 (1) a), b) GDPR, Art. 6 GDPR, Art. 12 GDPR, Art. 13 GDPR, Art. 14 GDPR, Art. 15 GDPR, Art. 17 GDPR, Art. 28 (3) GDPR
Type of violation: Non-compliance with general data processing principles

Summary

The Italian DPA has imposed a fine of EUR 34,000 on Pianeta S.r.l. The data subject held a loyalty card for which the controller acted as data processor. The data subject was an employee of the controller. The controller used information from their role as data processor to launch disciplinary proceedings against the data subject. The purpose of the data collected through the loyalty card was limited to that loyalty programme and was labelled as anonymous. However because the data was being processed for disciplinary purposes the processor is regarded as a controller. Therefore the controller did not have a legal basis for processing the data subject's personal data relating to the loyalty card. Furthermore the controller failed to adequately inform the data subject that data had not been obtained from them. Pianeta s.rl. also did not comply with the data subject's requests to exercise their rights.

Open original source Links to the regulator's original publication or another source.