Italian DPA fines clothing company for failing to handle erasure request
Background information
- Date of final decision: 23/09/2026
- National case
- Controller: Barbuti S.p.A.
- Legal References: Article 5 (Principles relating to processing of personal data), Article 12 (Transparent information, communication and modalities for the exercise of the rights of the data subject), Article 17 (Right to erasure (‘right to be forgotten’)
- Decision: Administrative fine, Compliance order
- Key words: Data subjects rights, Fines, Marketing
Summary of the Decision
Origin of the case
The Italian Data Protection Authority (DPA) received a complaint from an individual who continued to receive promotional text messages from Barbuti S.p.A., a clothing company, despite having requested the erasure of their personal data.
The individual had sent the request to the company's general contact email address, as the promotional messages did not provide information on how to exercise data protection rights. Although the company sent an automatic acknowledgement, it failed to respond to the request and continued sending promotional messages.
Key Findings
The Italian DPA found that the company had failed to implement adequate organisational measures to handle data subject requests received through its communication channels.
Referring to the EDPB Guidelines 01/2022 on data subject rights, the DPA stressed that requests submitted through a communication channel provided by the controller, even if different from the preferred channel indicated in its privacy notice, should generally be considered valid and handled accordingly.
The company should therefore have ensured that the request was appropriately addressed.
The DPA also found that the company had failed to respond to the erasure request and had continued sending promotional messages without a valid legal basis. Furthermore, the messages did not provide suitable contact details enabling recipients to exercise their rights, as required by Italian law.
The DPA concluded that the company had infringed Articles 5(2), 12 and 17 GDPR and Article 130 of the Italian Data Protection Code.
Decision
The Italian DPA imposed an administrative fine of EUR 5 000 on Barbuti S.p.A. and ordered the company to adopt appropriate measures to ensure that its promotional communications comply with the requirements of Article 130(5) of the Italian Data Protection Code.
The company was also required to report to the DPA on the measures adopted within 30 days of notification of the decision.
For further information: