Italy

Municipality of Terralba

8,000 €

GDPR enforcement action by Italian Data Protection Authority (Garante) on 2026-07-23.

Rank · Sector

#206

of 376 in Public Sector and Education

Rank · Italy

#346

of 595

Rank · All fines

#1,578

of 3,127

Case details

Authority: Italian Data Protection Authority (Garante)
Date: 2026-07-23
Controller / Processor: Municipality of Terralba
Sector: Public Sector and Education
Quoted Articles: Art. 5 (1) a), (2) GDPR, Art. 6 GDPR, Art. 24 GDPR, Art. 25 GDPR, Art. 88 GDPR
Type of violation: Insufficient legal basis for data processing

Summary

The Italian DPA has imposed a fine of EUR 8,000 on the Municipality of Terralba. The data subject is an employee of the controller. While they were on sick leave, the controller changed the password to their computer in order to access it and arrange payment for all the municipality's employees. The controller did not inform its employees of the possibility of forced access to their computers. The controller failed to implement measures to ensure that accessing the computers of sick employees would not be necessary, thereby neglecting the security of personal data.

Open original source Links to the regulator's original publication or another source.