[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fGge5-kPUU_G5q3C1aUxU54sfFCLSW3FtyVr6CJyIpfs":3},{"article":4,"iocs":40,"watch_terms":41,"solutions":42,"lesson":45},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":20,"category":21,"article_tags":24},"780a63e5-40ff-4371-9d9f-a4d42ffaf6c4","Italian DPA fines clothing company for failing to handle erasure request","italian-dpa-fines-clothing-company-for-failing-to-handle-erasure-request-a18203","Italian DPA fines clothing company for failing to handle erasure request ikerinar Tue, 10\u002F11\u002F2026 - 12:12","The Italian Data Protection Authority (DPA) has fined clothing company Barbuti S.p.A. €5,000 for failing to properly handle a customer's data erasure request. The customer, who continued to receive marketing messages, had sent their request to the company's general contact email. The DPA found Barbuti S.p.A. lacked adequate measures to process such requests and continued marketing without a valid basis, violating GDPR and Italian data protection laws.","Italian DPA fines clothing company Barbuti S.p.A. €5,000 for mishandling data erasure request.","https:\u002F\u002Fwww.edpb.europa.eu\u002Fnews\u002Fitalian-dpa-fines-clothing-company-for-failing-to-handle-erasure-request_en",null,"2026-11-10T11:12:56+00:00","2026-11-10T12:00:25.264474+00:00",7,[17],{"name":18,"type":19},"Barbuti S.p.A.","vendor","c5c77cdb-f7d7-4990-9436-c81dcbff1163",{"id":20,"icon":12,"name":22,"slug":23},"Policy","policy",[25,30,35],{"category":26},{"id":27,"icon":12,"name":28,"slug":29},"3f0f8451-91df-4b6c-9a73-ef3b2509b7f1","GDPR","gdpr",{"category":31},{"id":32,"icon":12,"name":33,"slug":34},"53f9c4b6-8bc6-4964-9169-d09e5cd41d72","Compliance","compliance",{"category":36},{"id":37,"icon":12,"name":38,"slug":39},"d95477d7-eb04-4fad-a2dc-be1428040ce7","Privacy Fines","privacy-fines",[],[18],{"controls":43,"vendors":44},[],[],{"slug":46,"title":47,"body":48,"framework_refs":49,"framework_notes":57},"barbuti-spa-fined-5000-for-ignoring-gdpr-erasure-request","Barbuti S.p.A. Fined €5,000 for Ignoring GDPR Erasure Request","Barbuti S.p.A. failed to act on a customer's data erasure request submitted via the company's general contact email, continuing to send marketing messages without a valid legal basis. The root issue was an absence of internal processes to identify, route, and fulfil data subject rights requests in a timely manner. This matters because GDPR grants individuals enforceable rights over their personal data, and organisations that lack the operational infrastructure to honour those rights face regulatory fines, reputational damage, and loss of customer trust. Even a small procedural gap — such as not monitoring a general inbox for rights requests — can constitute a material GDPR violation.",[50,51,52,53,54,55,56],"GDPR Article 32","NIST SP 800-53 SI-2: Flaw Remediation","ISO\u002FIEC 27001:2022 Clause 7.2: Competence","CIS Control 14: Security Awareness and Skills Training","CIS Control 17: Incident Response Management","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","NIS2 Article 21(2)(b)",{"GDPR Article 32":58,"NIS2 Article 21(2)(b)":59,"NIST SP 800-53 SI-2: Flaw Remediation":60,"ISO\u002FIEC 27001:2022 Clause 7.2: Competence":61,"CIS Control 17: Incident Response Management":62,"CIS Control 14: Security Awareness and Skills Training":63,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":64},"Article 32 requires organisations to implement appropriate technical and organisational measures to ensure data processing complies with GDPR, including the ability to fulfil data subject rights; Barbuti lacked such measures.","NIS2 requires incident handling and business continuity measures, including policies that ensure personal data processing obligations (such as erasure) are embedded in operational procedures rather than left to ad-hoc inbox monitoring.","While typically applied to software flaws, the principle of identifying and correcting process deficiencies applies here — the company's broken DSR workflow was a known-category process flaw that should have been remediated before a complaint arose.","Staff handling general inboxes lacked the awareness and training to recognise an erasure request and route it appropriately, reflecting a competence gap that ISO 27001 Clause 7.2 requires organisations to address.","A defined response procedure for data subject rights requests — analogous to an incident response playbook — would have ensured the erasure request was escalated, tracked, and fulfilled within the statutory deadline.","Employees who process customer communications must be trained to identify data subject rights requests; the absence of this training directly caused the missed erasure request.","Broadly, A.8.8 and surrounding controls require organisations to maintain processes that protect personal data throughout its lifecycle, including honouring deletion obligations when consent or legal basis is withdrawn."]