Italy

Municipality of San Genesio and Uniti

2,000 €

GDPR enforcement action by Italian Data Protection Authority (Garante) on 2026-07-03.

Rank · Sector

#348

of 376 in Public Sector and Education

Rank · Italy

#544

of 595

Rank · All fines

#2,490

of 3,127

Case details

Authority: Italian Data Protection Authority (Garante)
Date: 2026-07-03
Controller / Processor: Municipality of San Genesio and Uniti
Sector: Public Sector and Education
Quoted Articles: Art. 5 (1) a) GDPR, Art. 6 GDPR, Art. 9 GDPR
Type of violation: Insufficient legal basis for data processing

Summary

The Italian DPA has imposed a fine of EUR 2,000 on the Municipality of San Genesio and Uniti. The data subject, a former employee of the municipality, stated in their complaint that, during the process of requesting a transfer of employment to another public body, the controller had revealed special categories of personal data, including their trade union membership. The controller did not have a legal basis for sharing those details; however, only one instance of such a breach is known.

Open original source Links to the regulator's original publication or another source.