Italy

Municipality of Rieti

6,000 €

GDPR enforcement action by Italian Data Protection Authority (Garante) on 2026-07-14.

Rank · Sector

#230

of 376 in Public Sector and Education

Rank · Italy

#380

of 595

Rank · All fines

#1,714

of 3,127

Case details

Authority: Italian Data Protection Authority (Garante)
Date: 2026-07-14
Controller / Processor: Municipality of Rieti
Sector: Public Sector and Education
Quoted Articles: Art. 5 (1) a), c), f), (2) GDPR, Art. 12 (1) GDPR, Art. 24 GDPR, Art. 25 GDPR, Art. 32 GDPR, Art. 34 GDPR
Type of violation: Non-compliance with general data processing principles

Summary

The Italian DPA has imposed a fine of EUR 6,000 on the Municipality of Rieti. A file containing the personal data of 2,000 citizens was published on the controller's website. This file contained the personal data of 50 employees and approximately 31,000 tax accounts belonging to both individuals and legal entities. The data included tax IDs, names, places of residence, and land registered in their name. The controller published details of the data breach in the local newspaper, but this failed to meet the standard by which data subjects affected by a breach should be informed. The authority stated that these incidents are to be regarded as a single act and that they no longer affect the data subjects..

Open original source Links to the regulator's original publication or another source.