The Italian Data Protection Authority (Garante) has fined Lusha Systems, a US-based data broker, 2 million euros. The case provides interesting compliance lessons for any company evaluating [...]
The Italian data protection authority (Garante) has fined Piaggio & C. S.p.A. €460,000 over its handling of two former employees' company email. The decision is relevant under many aspects […]
The AI Act classifies AI systems into four risk categories. One of them covers systems that pose transparency risks, and those systems are governed by Article 50. The obligations apply [...]
On 26 March 2026, the Italian data protection authority (Garante per la protezione dei dati personali, "Garante") fined Intesa Sanpaolo S.p.A. €31,800,000. This is one of the largest fines the Garante has ever imposed, and it carries clear lessons for a [...]
The Court of Justice of the European Union (CJEU) has clarified in Brillen Rottler (C-526/24) that, in exceptional circumstances, even a first data subject access request (DSAR) may be refused as “manifestly unfounded or excessive” under Article 12 para. [...]
The Italian Data Protection Authority (Garante) has imposed a €17.6 million fine on Intesa Sanpaolo, one of the largest banking groups in Italy, for unlawful processing of personal data affecting approximately 2.4 million customers in the context of their [...]
The Spanish Data Protection Authority (AEPD) recently imposed a €500,000 fine on Fútbol Club Barcelona for failing to properly conduct a Data Protection Impact Assessment (DPIA) when implementing biometric systems used during the club’s membership censu [...]
The Spanish Data Protection Authority (AEPD) recently imposed a €950,000 fine on a company offering digital identity and age verification services that rely on facial analysis technology. The decision is particularly relevant for organisations deploying fac [...]
