Italian Data Protection Authority (Garante) · 23 July 2026
Municipality of Terralba
Insufficient legal basis for data processing
- Regulator
- Italian Data Protection Authority (Garante)
- Decided
- 23 July 2026
- Country
- Italy
- Sector
- Public Sector and Education
- Regulator’s reference
- Not recorded
- Fino case number
- 2026/IT/101
What happened
The Italian DPA has imposed a fine of EUR 8,000 on the Municipality of Terralba. The data subject is an employee of the controller. While they were on sick leave, the controller changed the password to their computer in order to access it and arrange payment for all the municipality's employees. The controller did not inform its employees of the possibility of forced access to their computers. The controller failed to implement measures to ensure that accessing the computers of sick employees would not be necessary, thereby neglecting the security of personal data.
Summary from the CMS Enforcement Tracker, not by Fino. CC BY-NC-SA 4.0.
Rules involved
- Art. 6Lawfulness of processingRead →
- Art. 24Responsibility of the controllerRead →
- Art. 25Data protection by design and by defaultRead →
- Art. 88Processing in the context of employmentRead →
- Accountability
- Unlawful processing
Sources
The facts on this page come from the sources above, as they recorded them. Nothing has been estimated or filled in. Not legal advice.
Spotted a mistake? Write to angelillolorenzo@gmail.com and quote 2026/IT/101.