What Changed
- The Italian DPA fined Barbuti S.p.A. EUR 5 000 for infringing GDPR Articles 5(2), 12, and 17 and Italian law.
- The authority ruled that erasure requests sent to general business email addresses are valid under EDPB Guidelines 01/2022.
- Barbuti S.p.A. was ordered to align promotional communications with Article 130(5) of the Italian Data Protection Code and report within 30 days.
The Italian Data Protection Authority (DPA) has issued an administrative fine of EUR 5 000 against clothing company Barbuti S.p.A. and ordered the business to bring its direct marketing practices into compliance after failing to execute a data subject's request for personal data erasure.
**Factual Background and Legal Violations**
The case originated from an individual complaint regarding persistent promotional text messages received from Barbuti S.p.A. Because the marketing messages contained no information on how to exercise data protection rights, the individual submitted an erasure request to the company's general contact email address. Although Barbuti S.p.A. issued an automated acknowledgement, it failed to respond to or act upon the request and continued to send marketing text messages.
The Italian DPA determined that Barbuti S.p.A. lacked adequate organisational measures to handle data subject rights requests submitted through its general communication channels. Referencing European Data Protection Board (EDPB) Guidelines 01/2022 on data subject rights, the DPA highlighted that requests submitted through a communication channel provided by a controller must generally be treated as valid and handled accordingly, even if the channel differs from the preferred route specified in the privacy notice.
Consequently, the DPA found Barbuti S.p.A. in violation of Articles 5(2), 12, and 17 of the General Data Protection Regulation (GDPR), as well as Article 130 of the Italian Data Protection Code, due to processing personal data for promotional purposes without a valid legal basis and failing to provide recipient contact details to exercise rights.
**Regulatory Sanctions and Corrective Measures**
In addition to the EUR 5 000 administrative fine, the Italian DPA issued a compliance order instructing Barbuti S.p.A. to adopt measures ensuring its promotional communications comply with Article 130(5) of the Italian Data Protection Code. The company must report the measures it adopts to the DPA within 30 days of notification of the decision.
Who May Be Affected
Data controllers, marketing teams, and compliance officers operating in Italy or handling data subjects in the EU.
Cross-Border Context
Applies EU GDPR principles and EDPB Guidelines 01/2022 within Italy, creating compliance precedents for cross-border EU marketing practices.
What to check next
- Review the full decision published by the Italian Data Protection Authority (Garante per la protezione dei dati personali).
- Consult EDPB Guidelines 01/2022 on data subject rights regarding accepted communication channels for GDPR requests.
This article provides general information and does not constitute legal advice. Consult the official text and obtain advice appropriate to your circumstances where needed.