Barbuti S.p.A. Fined €5,000 for Ignoring GDPR Erasure Request
Written by AI from the linked story. Not reviewed by an editor. How this works
Barbuti S.p.A. failed to act on a customer's data erasure request submitted via the company's general contact email, continuing to send marketing messages without a valid legal basis. The root issue was an absence of internal processes to identify, route, and fulfil data subject rights requests in a timely manner. This matters because GDPR grants individuals enforceable rights over their personal data, and organisations that lack the operational infrastructure to honour those rights face regulatory fines, reputational damage, and loss of customer trust. Even a small procedural gap — such as not monitoring a general inbox for rights requests — can constitute a material GDPR violation.
Tactical Insight
Immediate actions
- Designate a dedicated, monitored email address (e.g., privacy@company.com) for all data subject rights requests and publicise it in the privacy notice.
- Audit all current marketing contact lists to verify that a valid, current legal basis exists for every individual on them.
Process & governance improvements
- Implement a documented Data Subject Rights (DSR) procedure covering intake, acknowledgement, fulfilment, and audit trail for erasure, access, and objection requests.
- Assign clear ownership (e.g., DPO or Privacy Officer) for reviewing any email sent to general inboxes that could constitute a rights request.
- Integrate DSR handling into CRM and marketing platforms so erasure requests automatically suppress contacts from future campaigns.
Detection & compliance monitoring
- Schedule quarterly internal audits of marketing consent records and DSR fulfilment logs to identify gaps before regulators do.
- Implement automated alerts when a data subject sends repeat communications, signalling an unresolved request.