Italy

Comune di Aprilia

5,000 €

GDPR enforcement action by Italian Data Protection Authority (Garante) on 2026-09-03.

Rank · Sector

#268

of 385 in Public Sector and Education

Rank · Italy

#425

of 604

Rank · All fines

#1,932

of 3,170

Case details

Authority: Italian Data Protection Authority (Garante)
Date: 2026-09-03
Controller / Processor: Comune di Aprilia
Sector: Public Sector and Education
Quoted Articles: Art. 5 (1) a), b), c) GDPR, Art. 6 (1) c), e), (2), (3) b) GDPR
Type of violation: Insufficient legal basis for data processing

Summary

The Italian DPA has imposed a fine of EUR 5,000 on Comune di Aprilia. Following the dissolution of the town council due to Mafia infiltration, a special commission took over its former responsibilities. An employee complained to the commission about incidents of workplace bullying and "insane" company management. Rather than replying to the employee's complaint, the commission forwarded the data subject's email, including their name and description of events, to their employer. The employer subsequently launched disciplinary proceedings against the employee, resulting in their dismissal. The controller did not have a legal basis for forwarding the data subject's personal data.

Open original source Links to the regulator's original publication or another source.