Italy

Autonomous Region of Sardinia

3,000 €

GDPR enforcement action by Italian Data Protection Authority (Garante) on 2026-05-28.

Rank · Sector

#299

of 367 in Public Sector and Education

Rank · Italy

#461

of 573

Rank · All fines

#2,186

of 3,105

Case details

Authority: Italian Data Protection Authority (Garante)
Date: 2026-05-28
Controller / Processor: Autonomous Region of Sardinia
Sector: Public Sector and Education
Quoted Articles: Art. 5 (1) a) GDPR, Art. 6 GDPR
Type of violation: Insufficient legal basis for data processing

Summary

The Italian DPA has imposed a fine of EUR 3,000 on the Autonomous Region of Sardinia. The data subject is a former employee of the controller whose Directorate-General for Personnel and Reform had forwarded information regarding disciplinary proceedings against them to other regional bodies. Furthermore the Regional Directorate-General for Tourism, Crafts and Trade sent the reply to the data subject's request for access to documents to the administrative body that had recently employed them. This made the requested documentation accessible to the new employer.

Open original source Links to the regulator's original publication or another source.