Italian Data Protection Authority (Garante) · 29 April 2025
Regione Lombardia
Insufficient legal basis for data processing
Fine€50,000Fine issued
- Regulator
- Italian Data Protection Authority (Garante)
- Decided
- 29 April 2025
- Country
- Italy
- Sector
- Employment
- Regulator’s reference
- Not recorded
- Fino case number
- 2025/IT/066
What happened
The DPA fined the Region of Lombardia €50,000 for several violations related to the processing of employees' data, including the unlawful retention of navigation logs and email metadata.
Summary from the GDPRhub page for this decision, written by its volunteers, not by Fino. CC BY-NC-SA 4.0.
Rules involved
- Art. 6Lawfulness of processingRead →
- Art. 25Data protection by design and by defaultRead →
- Art. 28ProcessorRead →
- Art. 35Data protection impact assessmentRead →
- Art. 88Processing in the context of employmentRead →
- Accountability
- DPIA
- Processor obligations
- Unlawful processing
Sources
The facts on this page come from the sources above, as they recorded them. Nothing has been estimated or filled in. Not legal advice.
Spotted a mistake? Write to angelillolorenzo@gmail.com and quote 2025/IT/066.