Sign in

Info Other, enforcement EU

Italian DPA fines clothing company for failing to handle erasure request

Published
Source: edpb.europa.eu
Effective
Not stated
Deadline
Not stated
Framework: GDPR
Regulation (EU) 2016/679 (as corrected 2018) source
in 13 days
Indicative European Parliament plenary date (first reading) for the small mid-caps omnibus, COM(2025) 501, which would raise the Article 30 records exemption to organisations under 750 employees - a forecast, not a fixed date source
Also: Italy Privacy Code

Why it matters

The Italian Data Protection Authority fined Barbuti S.p.A. EUR 5,000 for failing to process a data subject's erasure request submitted via the company's general contact email and continuing to send promotional messages afterward. The DPA found that the company did not implement adequate organizational measures to handle requests through available communication channels, citing EDPB Guidelines 01/2022 which require that requests submitted through any channel provided by the controller should be treated as valid. The company must now adopt compliant measures for promotional communications as required by Article 130(5) of the Italian Data Protection Code and report on implementation within 30 days.

What changed

  • Barbuti S.p.A. was fined EUR 5,000 for violating Articles 5(2), 12, and 17 of GDPR and Article 130 of the Italian Data Protection Code by failing to handle an erasure request and continuing promotional communications
  • The company failed to implement adequate organizational measures to process data subject requests received through its general contact email, despite this being a communication channel it provided
  • Promotional messages sent by the company lacked suitable contact details enabling recipients to exercise their data protection rights, contrary to Article 130(5) of the Italian Data Protection Code
  • The company was ordered to adopt appropriate measures ensuring promotional communications comply with Article 130(5) requirements and to report to the DPA on these measures within 30 days of notification
  • The DPA confirmed that erasure requests submitted through any communication channel provided by the controller must be treated as valid and processed accordingly, per EDPB Guidelines 01/2022

Who is affected

Private companies in the EU (particularly those engaging in marketing) that receive data subject requests through multiple communication channels; organizations subject to GDPR and Italian Data Protection Code requirements for handling erasure requests and promotional communications

What to do

Open the official document

AI-assisted summary of the official document; the official text prevails. Not legal advice.

More changes in GDPR