Garante per la protezione dei dati personali (Italy) - 351/2026
Italy's DPA fines a company €1,500 for GDPR and ePrivacy violations in B2B marketing.
Italy's Garante per la protezione dei dati personali (DPA) has fined a company €1,500 for violating GDPR and the ePrivacy Directive. The violations stemmed from an unsolicited marketing email campaign, where the company unlawfully relied on legitimate interest instead of consent and failed to provide adequate transparency information. The DPA clarified that the ePrivacy Directive's marketing provisions can apply even to B2B campaigns and when personal data is not processed under GDPR.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Apollo?
Get an email when a new story names Apollo, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonA company was fined €1,500 by Italy's Garante after conducting an unsolicited email marketing campaign that improperly relied on 'legitimate interest' as its legal basis rather than obtaining explicit consent from recipients. The DPA also found the company failed to provide adequate transparency information, a fundamental GDPR requirement. Critically, the ruling reinforced that the ePrivacy Directive's marketing rules apply to B2B communications and can be enforced even when GDPR's personal data thresholds are not fully met. This case highlights that organizations often underestimate the legal complexity of digital marketing, assuming B2B outreach is exempt from strict privacy rules. Misclassifying the legal basis for processing is a common and costly compliance failure.
What helps against this
How we list vendors- Email authentication (DMARC)
Nobody can send email that pretends to come from your domain.
- Email security
Phishing, malware and invoice fraud are filtered out before they reach inboxes.