[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f-GMMAJAvJVoIDRCopwkPSG_E7pY-wfzLTNhB3uizotY":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"status":21,"created_at":22,"published_at":23,"article":24,"tags":28,"podcasts":47},"e261388f-5f38-43fe-8e43-863d1054e850","italian-dpa-fines-publisher-280k-for-marketing-emails-without-valid-consent","2fc559a9-d50e-4668-a927-8a37f7ac90d9","Italian DPA Fines Publisher €280K for Marketing Emails Without Valid Consent","Altroconsumo Edizioni sent marketing emails to a user who never completed account confirmation, relying on a flawed legal basis — claiming a contract existed upon mere form submission. Under GDPR Article 6(1)(b), no confirmed registration means no valid contractual basis for processing personal data, let alone sending commercial communications. This case highlights how misinterpreting lawful processing grounds can result in significant regulatory penalties. Compounding the violation, the controller's failure to respond to the DPA's inquiries demonstrated a systemic breakdown in accountability and cooperation obligations under GDPR Article 5(2).","**Immediate actions:**\n- Implement a confirmed opt-in (double opt-in) workflow that withholds all marketing communications until email verification is completed.\n- Audit your current lawful basis mapping for all marketing activities to ensure they align with the correct GDPR Article 6 ground.\n\n**Long-term improvements:**\n- Establish a formal Data Protection Impact Assessment (DPIA) process for any new marketing campaign or data collection workflow before launch.\n- Appoint or empower a Data Protection Officer (DPO) with clear authority to respond to regulatory inquiries within mandated timeframes.\n- Maintain auditable records of consent and registration events, including timestamps and confirmation status, to demonstrate accountability.\n\n**Detection & Response measures:**\n- Set up automated alerts to flag and suppress marketing sends to any account with an unconfirmed or unverified registration status.\n- Create a documented DPA inquiry response procedure with defined SLAs to ensure timely, compliant engagement with supervisory authorities.",[12,13,14,15,16,17,18,19,20],"GDPR Article 6(1)(b) — Lawfulness of processing: contractual necessity","GDPR Article 5(2) — Accountability principle","GDPR Article 7 — Conditions for consent","GDPR Article 12 — Transparent information and communication","GDPR Article 31 — Cooperation with supervisory authority","NIST SP 800-53 PT-2 (Authority to Process Personally Identifiable Information)","NIST SP 800-53 AC-2 (Account Management)","CIS Control 3 — Data Protection","ISO\u002FIEC 27701:2019 — Privacy Information Management (Clauses 7.2.1, 7.4.1)","published","2026-08-20T12:20:19.196191+00:00","2026-08-20T12:20:18.937+00:00",{"id":7,"url":25,"slug":26,"title":27},"https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=Garante_per_la_protezione_dei_dati_personali_(Italy)_-_10269624&diff=52740&oldid=0","garante-per-la-protezione-dei-dati-personali-italy-10269624-2698ed","Garante per la protezione dei dati personali (Italy) - 10269624",[29,35,41],{"id":30,"name":31,"slug":32,"description":33,"color":34},"1ec88fde-2d0f-4ed8-932a-33f5ccc0fdc7","Access Control","access-control","Excessive privileges, missing MFA, weak auth","#f97316",{"id":36,"name":37,"slug":38,"description":39,"color":40},"c0dcc566-3654-4d70-8ede-262a198e732f","Regulatory Compliance","regulatory-compliance","GDPR, NIS2, DORA, sector-specific violations","#ec4899",{"id":42,"name":43,"slug":44,"description":45,"color":46},"c8b843a5-d5a7-41d1-8d3b-cabded09d2ef","Data Protection","data-protection","Unencrypted data, missing DLP, poor classification","#3b82f6",[]]