Italian DPA fines clothing company for failing to handle erasure request
Italian DPA fines clothing company Barbuti S.p.A. €5,000 for mishandling data erasure request.
The Italian Data Protection Authority (DPA) has fined clothing company Barbuti S.p.A. €5,000 for failing to properly handle a customer's data erasure request. The customer, who continued to receive marketing messages, had sent their request to the company's general contact email. The DPA found Barbuti S.p.A. lacked adequate measures to process such requests and continued marketing without a valid basis, violating GDPR and Italian data protection laws.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Barbuti S.p.A.?
Get an email when a new story names Barbuti S.p.A., usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonBarbuti S.p.A. failed to act on a customer's data erasure request submitted via the company's general contact email, continuing to send marketing messages without a valid legal basis. The root issue was an absence of internal processes to identify, route, and fulfil data subject rights requests in a timely manner. This matters because GDPR grants individuals enforceable rights over their personal data, and organisations that lack the operational infrastructure to honour those rights face regulatory fines, reputational damage, and loss of customer trust. Even a small procedural gap — such as not monitoring a general inbox for rights requests — can constitute a material GDPR violation.