--- title: "Italy — Enforcement & Redress | Data Protection Monitor" canonical: https://dataprotection.gi/jurisdictions/italy/enforcement-and-redress/ source_html: /jurisdictions/italy/enforcement-and-redress/index.html description: "Italy — Enforcement & Redress: enforcement_and_redress Enforcement & Redress 6 sub-modules 4 claims Green ▾ # High-volume, well-documented, and materially consequential enforcement activity with a functioning ju" generated_at: 2026-10-25T04:46:50Z content_sha256: 5d4d7006bf79f33c79e4a62828ed77667e01e7b9c0e39dd4ecbb95ec2414dc40 generator: "fe-fleet/md-twin@1.0" --- # Italy — Enforcement & Redress | Data Protection Monitor ### D10Enforcement & Redress6 sub-modules4 claimsGreen▾# High-volume, well-documented, and materially consequential enforcement activity with a functioning judicial-review channel; funding/headcount transparency is comparatively thin in public sources. Primary framework GDPR Arts. 58, 77-84, 83 + Codice Privacy Artt. 152, 154-bis, 166 + Reg. Garante 1/2019 and 2/2019 Supervisory authority [Garante per la protezione dei dati personali](https://www.garanteprivacy.it/) Traffic-light rationale — Green High-volume, well-documented, and materially consequential enforcement activity with a functioning judicial-review channel; funding/headcount transparency is comparatively thin in public sources. #### Sub-modules (6) #### Regulator Powers And PenaltiesGreen The Garante exercises full Art.58(2) GDPR corrective powers; internal Reg.1/2019 was amended in March 2026 to delegate certain time-barred/low-impact corrective measures to departmental directors, excluding journalistic, political/union, high-turnover, and major-public-body cases. Claims (1): - A March 2026 amendment to Garante Regulation 1/2019 delegates adoption of certain Art.58(2)(b) corrective measures to departmental directors for time-barred or fully-remedied conduct, expressly excluding journalistic-sector, political/union-rights, high-turnover (>EUR 500,000) and major public-body cases from the delegation. #### Enforcement Activity IndexGreen In 2025 the Garante adopted 807 collegial decisions and handled 4,288 complaints and 145,846 reports; 2026 saw multiple 7-figure fines (Poste Italiane/PostePay, Lusha) alongside smaller sanctions (Piaggio, Altroconsumo, Character.AI). Claims (1): - In 2025 the Garante adopted 807 collegial decisions, responded to 4,288 complaints and 145,846 reports, and issued 65 opinions on regulatory and administrative measures spanning public-administration digitalisation, healthcare, tax and justice. #### Regulator Funding And CapacityAmber Public information on current-year Garante staffing/budget levels is limited in this research pass; historically the Authority has supplemented its inspection capacity with seconded Guardia di Finanza personnel. Absence provenance: Current-year (2025/2026) headcount/budget figures were not located; only a historical (2008) administrative report referencing Guardia di Finanza secondment surfaced.. Searched: Garante privacy organico personale bilancio 2025 relazione annuale risorse. #### Collective Redress And Class ActionsAmber No GDPR-specific Italian collective-redress case was located in this cycle; general azione di classe mechanisms under the Codice del Consumo remain the available collective-litigation route. Absence provenance: No 2026 GDPR-specific class-action decision surfaced in this research pass.. Searched: Garante privacy azione di classe class action GDPR Italia 2026. #### Private Right Of ActionGreen Data subjects may oppose Garante sanction orders before the ordinary judiciary within 30 days (60 if residing abroad) under Art.152 Codice/Art.10 D.Lgs.150/2011 and Art.78 GDPR. Claims (1): - A Garante sanction order may be opposed before the ordinary courts, via petition filed within 30 days of notification (60 days if the appellant resides abroad), under Art.152 of the Codice, Art.10 of D.Lgs.150/2011 and Art.78 GDPR. #### Recent Developments 180DGreen Within the last 180 days: the Garante fined Character.AI (3 July 2026), gave a conditioned favourable opinion on the national AI Act implementing decree (29 July 2026) while flagging biometric-safeguard gaps, sanctioned Piaggio (EUR 460k) and Altroconsumo (EUR 280k), sanctioned Città Metropolitana di Sassari for a data breach, and presented its 2025 Annual Report to Parliament (2 July 2026). Claims (1): - On 29 July 2026 the Garante gave a favourable opinion on the AI Act national implementing decree while asking for clarified human-oversight rules, clearer research/experimentation responsibilities, its own involvement in the Italian AI regulatory sandbox, and strengthened guarantees on biometric-database quality. Category narrative 116 words The Garante wields full GDPR Art.58 corrective powers (warnings, orders, bans, fines up to EUR 20M/4% global turnover) and delegated internal procedures (Reg. 1/2019) for time-barred/low-impact cases. 2025 activity: 807 collegial decisions, 4,288 complaints and 145,846 reports handled, and 65 opinions issued on regulatory/administrative measures. Recent months show sustained high-value enforcement (Poste Italiane/PostePay EUR 12.5M, Character.AI EUR 158k, Lusha EUR 2M, Piaggio EUR 460k, Altroconsumo EUR 280k) and judicial pushback (a March 2026 sanction order was suspended by the Tribunale di Roma). No dedicated GDPR-based class-action/collective-redress statistic was identified distinct from the general Italian collective-action (azione di classe) mechanism under Art.140-bis Codice del Consumo; individual judicial opposition to Garante orders is available under Art.152 Codice/Art.78 GDPR. Periodic update · new data 2026-10-18 #### Enforcement & Redress The Garante per la protezione dei dati personali fined Cairo Editore 9,380 euros by provvedimento n.759 of 23 September 2026, published 16 October 2026, for publishing images of a crime scene found not essential to the informational purpose of the article in question. The fine was issued under the essentiality-of-information principle and dignity-protection rules applicable to journalistic activity, and concerns the same underlying case — the Garlasco case — that produced an earlier fine against RTI on 29 July 2026. The Garante is applying the same legal theory repeatedly across multiple publishers within a relatively short reporting period, which indicates a sustained enforcement line specific to this case rather than an isolated application of the essentiality-of-information principle. This pattern is significant for media organisations covering high-profile criminal cases generally: the Garante's recurring willingness to find that crime-scene or victim-related imagery exceeds what is essential to inform the public, even where the underlying facts being reported are themselves newsworthy, signals an active and specific enforcement posture on image selection in crime journalism rather than a generalised tightening of journalistic-exception rules as a whole. #### Outlook Given the recurring nature of this enforcement line — two fines against two different publishers over the same case within a roughly two-and-a-half-month span — further enforcement action against additional publishers that covered the same case with similar imagery is plausible. Watch for whether the Garante's approach in this case influences its treatment of image-publication decisions in other high-profile criminal matters going forward, which would indicate a durable shift in enforcement emphasis rather than a case-specific response. 3 earlier distinct update(s) Periodic update · new data 2026-10-11 #### Enforcement & Redress Italy's enforcement activity was notably active this cycle, anchored by the Garante's Eur7 million fine against IQVIA Solutions Italy S.r.l., provvedimento n. 710 of 23 September 2026, for the unlawful processing of health data belonging to approximately one million patients of around 800 general practitioners. This is among the larger fines the Garante has issued and reflects the seriousness with which the authority treated both the lawful-basis failure and the rejected anonymisation claim underlying the processing. On the same date, 23 September 2026, the Garante issued a second, much smaller enforcement decision, provvedimento n. 634, fining Fondazione Rome Technopole Eur8,000 for publishing online the personal data of 480 scholarship-award winners. Though modest in scale by comparison to the IQVIA fine, this decision is a reminder that the Garante's enforcement activity spans a wide range of controller types and data volumes, from large-scale health-data processing by a multinational data company to a more limited publication of award-recipient data by a research foundation. A third enforcement thread, the banking institution sanctioned under provvedimento 613/2026 for direct-marketing objection-right violations reported 14 September 2026, adds to the picture of a Garante actively pursuing enforcement across sectors in this window. The full texts of provvedimento n.710/2026 and n.634/2026 were not directly retrieved from the Garante's own publication channel this cycle; the findings rest on secondary press reporting and, for n.634, a direct Garante docweb reference. #### Outlook Direct retrieval of the full provvedimento texts for n.710/2026 (IQVIA) and n.634/2026 (Fondazione Rome Technopole) from garanteprivacy.it would firm up the precise legal reasoning and sanction calculation behind both decisions. The IQVIA decision's 120-day compliance deadline is the clearest concrete marker to track going forward. Periodic update · new data 2026-09-28 #### Enforcement & Redress Italy's enforcement and redress picture this cycle is defined by two concrete sanctions and one significant forward-looking programme. The Garante sanctioned Poste Italiane and its PostePay division in Provvedimento n. 237 of 17 April 2026, for unlawful monitoring of applications installed on users' Android devices, a matter addressed in detail under the controller/processor duties module. Separately, the Garante's 29 July 2026 newsletter recorded a EUR 280,000 fine against Altroconsumo Edizioni for a marketing-related violation, a finding that rests on a single source this cycle and should be treated as provisional pending corroboration. Beyond these two concluded matters, the Garante's inspection plan for the second half of 2026 represents a significant expansion of its forward enforcement pipeline: at least 35 inspections are planned for the August-to-December window, with sectoral scope expanding to include geomarketing, neuromarketing, dynamic pricing, DPO-supplier relationships, municipalities, local health authorities, and AI systems generally. This expanded inspection programme, considered alongside the two concrete sanctions already recorded this cycle, indicates the Garante is sustaining an active enforcement tempo across a widening set of sectors rather than concentrating attention on a narrow set of repeat targets. The combination of concrete sanctions with an expanding forward inspection programme is itself the significant structural fact for this module this cycle: it indicates the Garante's enforcement posture is both active in the present and set to broaden further in scope over the remainder of 2026. #### Outlook The 35-plus inspections planned for August-December 2026 should be watched closely, both for their outcomes and for whether the sectoral pattern (municipalities, ASL, geomarketing, neuromarketing, dynamic pricing, DPO-supplier relationships, AI systems) proves predictive of where the Garante's next concrete sanctions land. Corroboration of the Altroconsumo Edizioni fine through a primary Garante publication remains an open item for a future cycle. Periodic update · new data 2026-09-21 #### Enforcement & Redress Italy's enforcement and redress landscape this cycle is marked by both continued aggressive fining activity and a significant judicial check on the regulator's own reach. The Character Technologies fine of EUR 158,000, imposed 9 July 2026, is a Confirmed-confidence, Tier-1-sourced primary enforcement action. Separately, reporting indicates Intesa Sanpaolo was fined EUR 31.8 million in March 2026 for an insider data breach; however, this figure is sourced only from a Tier-4 secondary compilation and could not be corroborated against a Garante primary provvedimento this cycle, and is accordingly reported at Uncertain confidence with attribution limited to the secondary source rather than presented as an established fact. The most structurally significant development is the Court of Rome's annulment, on 18 March 2026, of the Garante's own December 2024 EUR 15 million fine and media-campaign order against OpenAI, on one-stop-shop jurisdiction grounds. This is a Confirmed-confidence finding, sourced at Tier 3, and represents a meaningful check on the scope of the Garante's enforcement jurisdiction in cross-border AI cases. Separately, the Garante is confirmed, at Probable confidence from a Tier-4 source, to act as competent authority for AI Act enforcement in areas overlapping data protection, particularly for high-risk AI systems processing personal data, expanding its effective enforcement remit even as the OpenAI annulment narrows its jurisdictional reach in one specific respect. #### Outlook Watch for primary-source corroboration of the reported Intesa Sanpaolo fine, which remains an open evidentiary gap, and for whether the Garante's expanded AI Act competent-authority role generates new enforcement activity distinguishable from its existing GDPR enforcement programme. Evidence 4 Sources and claims (4) - Confirmed[Garante Privacy](https://www.garanteprivacy.it/home/docweb/-/docweb-display/docweb/10239146) — A March 2026 amendment to Garante Regulation 1/2019 delegates adoption of certain Art.58(2)(b) corrective measures to departmental directors for time-barred or fully-remedied conduct, expressly excluding journalistic-sector, political/union-rights, high-turnover (>EUR 500,000) and major public-body cases from the delegation.observed 2026-08-03 - Confirmed[Garante Privacy](https://www.garanteprivacy.it/home/docweb/-/docweb-display/docweb/10266612) — In 2025 the Garante adopted 807 collegial decisions, responded to 4,288 complaints and 145,846 reports, and issued 65 opinions on regulatory and administrative measures spanning public-administration digitalisation, healthcare, tax and justice.observed 2026-08-03 - Confirmed[Garante Privacy](https://www.garanteprivacy.it/home/docweb/-/docweb-display/docweb/10225019) — A Garante sanction order may be opposed before the ordinary courts, via petition filed within 30 days of notification (60 days if the appellant resides abroad), under Art.152 of the Codice, Art.10 of D.Lgs.150/2011 and Art.78 GDPR.observed 2026-08-03 - Confirmed[Garante Privacy](https://www.garanteprivacy.it/home/docweb/-/docweb-display/docweb/10275843) — On 29 July 2026 the Garante gave a favourable opinion on the AI Act national implementing decree while asking for clarified human-oversight rules, clearer research/experimentation responsibilities, its own involvement in the Italian AI regulatory sandbox, and strengthened guarantees on biometric-database quality.observed 2026-08-03