Garante per la protezione dei dati personali (Italy) - 585/2026
Italy's Garante fines La Patria S.p.A. €20,000 for inadequate response to data access requests.
Italy's Garante per la protezione dei dati personali has fined La Patria S.p.A. €20,000 for failing to adequately respond to two data subject access requests. The company did not provide suitable or correct information, interpreting the requests under national labor law rather than GDPR. The Garante found violations of Articles 12, 13, and 15 GDPR, emphasizing that controllers must inform data subjects of refusal reasons and their right to judicial remedy, even if the request doesn't explicitly cite GDPR.
AI summary of the linked source. Not reviewed by an editor. How this works
Run La Patria S.p.A.?
Get an email when a new story names La Patria S.p.A., usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonLa Patria S.p.A. violated GDPR Articles 12, 13, and 15 by failing to properly respond to data subject access requests (DSARs), incorrectly interpreting them through the lens of national labor law rather than GDPR obligations. This misclassification led to inadequate or incorrect information being provided to data subjects, depriving them of their fundamental right to know how their personal data is being processed. The Garante reinforced that controllers must recognize DSARs regardless of whether the request explicitly cites GDPR, and must always communicate refusal reasons along with the data subject's right to judicial remedy. This case highlights the organizational risk of siloing privacy compliance within HR or legal teams unfamiliar with GDPR's broader obligations, rather than embedding it into a dedicated data protection function.