Who was sanctioned, and for what?

For seven months (October 2025 to May 2026), the bank continued to send a customer advertising via its app, although he had objected several times. The Italian data protection authority (Garante per la protezione dei dati personali) also found deficient systems for implementing objections and inaccurate information about the processing, and imposed 5,508,000 EUR (Provvedimento No. 613).

Authority / court

Garante per la protezione dei dati personali

Area of law

Data protection · Marketing and consent

Legal basis

Art. 5 Abs. 1 lit. a, Art. 12, 21, 24 DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Financial services and insurance

Published

11 Sep 2026

Checked against the official source on 25 Sep 2026 · Direct link

Hospital staff opened a colleague's electronic health record to organise duty rosters during Covid rather than for treatment purposes. Technical barriers limiting access to treating staff were lacking; the Italian data protection authority (Garante per la protezione dei dati personali) imposed 24,000 EUR (Provvedimento No. 616).

Authority / court

Garante per la protezione dei dati personali

Area of law

Data protection · Employee data

Legal basis

Art. 5 Abs. 1 lit. a, b, c, f, Art. 9, 25, 32 DSGVO; Art. 75 Codice privacy; Linee guida dossier sanitario

Action

Fine

Status of proceedings

unknown

Sector

Healthcare

Published

11 Sep 2026

Checked against the official source on 25 Sep 2026 · Direct link

Since 2007, the municipal sports facilities operator had had cameras in the changing rooms of a swimming pool that recorded the locker area. The Italian data protection authority (Garante per la protezione dei dati personali) found no sound legal basis, incomplete notices and a 72-hour retention period not justified by a necessity assessment, and imposed 8,000 EUR (Provvedimento No. 619); the cameras were removed during the proceedings.

Authority / court

Garante per la protezione dei dati personali

Area of law

Data protection · Video surveillance

Legal basis

Art. 5 Abs. 1 lit. a, Art. 6 Abs. 1 lit. c und e DSGVO; Art. 2-ter Codice privacy

Action

Fine

Status of proceedings

unknown

Sector

Public sector

Published

11 Sep 2026

Checked against the official source on 25 Sep 2026 · Direct link

The three sharing providers made it difficult for holders of a Metrebus annual pass to access the free-ride passes promised when the concessions were awarded, through inadequate organisation, cumbersome activation and long waiting times, which shortened the usable time; Bird also deactivated accounts without prior notice. The AGCM imposed fines totalling 2.675 million EUR in three proceedings (Lime 1.4 million, Dott 525,000, Bird 750,000 EUR).

Authority / court

Autorità Garante della Concorrenza e del Mercato (AGCM)

Area of law

Consumer protection and online retail · Information duties in online retail

Legal basis

Codice del Consumo (pratiche commerciali scorrette), Verfahren PS13028, PS13029, PS13030

Action

Fine

Status of proceedings

unknown

Sector

Transport, logistics and shipping

Published

6 Aug 2026

Checked against the official source on 25 Sep 2026 · Direct link

For refunds in the event of delays of 60 minutes or more or cancellations, Trenitalia required prior written confirmation from the call centre or ticket office. The AGCM accepted binding commitments: abolition of the confirmation requirement, strengthened refund channels, an information page on disruptions and an implementation report within three months; no infringement was found.

Authority / court

Autorità Garante della Concorrenza e del Mercato (AGCM)

Area of law

Consumer protection and online retail · Information duties in online retail

Legal basis

Codice del Consumo (impegni); EU-Fahrgastrechte im Eisenbahnverkehr

Action

Order

Status of proceedings

final

Sector

Transport, logistics and shipping

Mitigating circumstances

Binding commitments, no finding of an infringement.

Published

30 Jul 2026

Checked against the official source on 25 Sep 2026 · Direct link

The Garante (Italian data protection authority) fined TIM 9,516,000 EUR because call centres outside the official sales network made promotional calls on the company's behalf using numbers not recorded in the operators' register ROC or falsified numbers (spoofing), often to lines entered in the do-not-call register, and the contacts obtained in this way reached its systems as apparently lawful leads via fictitious call-back requests on sales partners' web forms. The authority found that TIM had selected and supervised its sales partners inadequately and had systematically failed to answer, or answered late, requests for access, erasure and objection. In addition, TIM must secure its lead process, strengthen oversight of the sales chain and adapt its procedures for data subject rights.

Authority / court

Garante per la protezione dei dati personali

Area of law

Data protection · Marketing and consent

Legal basis

Art. 5, 6, 7, 12, 15–22, 24, 25, 28 und 32 DSGVO; Art. 130 Codice in materia di protezione dei dati personali (D.Lgs. 196/2003)

Action

Fine

Status of proceedings

unknown

Sector

Telecoms, IT and software

Employees

10,000 or more

Culpability

negligent

Repeat case

yes

Mitigating circumstances

Taken into account as mitigating: short period and limited number of data subjects, measures taken during the proceedings (including checks on and termination of contracts with partners), a high level of cooperation, no special categories of personal data, adherence to the telemarketing code of conduct and substantial investment in controlling the sales chain.

Published

31 Jul 2026

Checked against the official source on 28 Sep 2026 · Direct link

The Garante (Italian data protection authority) fined the US operator of the generative AI service Character.AI, on which users – including minors – chat with virtual characters, 158,000 EUR, among other things for deficient privacy information, a data protection impact assessment prepared late and the late appointment of a representative in the EU. It also criticised weaknesses in the protection of minors and in age verification; within 120 days the company must ensure working age verification, an effective cooling-off period preventing blocked minors from re-registering and private-by-default profiles for minors.

Authority / court

Garante per la protezione dei dati personali

Area of law

Data protection · Data subject rights and transparency

Legal basis

Art. 5 Abs. 2, 12 Abs. 1, 13 Abs. 1 und 2, 14 Abs. 1 und 2, 24 Abs. 1, 25 Abs. 2, 27 Abs. 1 und 35 Abs. 1 DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Telecoms, IT and software

Culpability

negligent

Repeat case

no

Mitigating circumstances

Mitigating: progressively strengthened age checks (a dedicated service for minors, age verification by a third-party provider), no previous relevant infringements, cooperation and amendments to the privacy policy during the proceedings.

Published

9 Jul 2026

Checked against the official source on 28 Sep 2026 · Direct link

From January 2024 to December 2025, the online retailer advertised time-limited discounts with countdown timers which, once they had expired, restarted with a new timer on identical terms. The AGCM classified this artificial scarcity as a particularly insidious dark pattern and imposed a fine of 2 million EUR.

Authority / court

Autorità Garante della Concorrenza e del Mercato (AGCM)

Area of law

Consumer protection and online retail · Misleading advertising and pricing

Legal basis

Codice del Consumo (pratiche commerciali scorrette)

Action

Fine

Status of proceedings

unknown

Sector

Retail and e-commerce

Published

25 Jun 2026

Checked against the official source on 25 Sep 2026 · Direct link

Following an on-site inspection from February to April 2025, the Bank of Italy (Banca d'Italia) found deficiencies in customer due diligence, active cooperation (suspicious transaction reporting) and anti-money laundering controls, and imposed an administrative fine of 40,000 EUR. The duration of the deficiencies and the corrective measures initiated were taken into account.

Authority / court

Banca d'Italia

Area of law

Money laundering and terrorist financing · Customer due diligence

Legal basis

Art. 62 d.lgs. 231/2007; Verstöße gegen Art. 7, 16–19, 24, 25, 35, 36 d.lgs. 231/2007

Action

Fine

Status of proceedings

unknown

Sector

Financial services and insurance

Mitigating circumstances

Corrective measures initiated

Checked against the official source on 25 Sep 2026 · Direct link

The CONSOB (Italian securities regulator) fined Banco BPM S.p.A. 370,000 EUR, of which 170,000 EUR for late disclosure of inside information under Art. 17(1) MAR and 200,000 EUR for obstructing supervision under Art. 187-quinquiesdecies of the Consolidated Law on Finance (TUF), and fined its subsidiary Banco BPM Vita S.p.A. 200,000 EUR, 570,000 EUR in total. In connection with BPM Vita's tender offer for Anima Holding S.p.A., the bank disclosed an ECB letter of 21 March 2025 rejecting the application of the so-called Danish Compromise to CONSOB and the market only four days later, after two trading days of the acceptance period. Both companies had previously informed CONSOB only incompletely about their discussions with the ECB.

Authority / court

CONSOB (Commissione Nazionale per le Società e la Borsa)

Area of law

Capital markets and financial supervision · Disclosure and reporting obligations

Legal basis

Art. 17 Abs. 1 Verordnung (EU) 596/2014 (MAR); Art. 187-ter.1 und Art. 187-quinquiesdecies Abs. 1 und 1-ter D.Lgs. 58/1998 (TUF)

Action

Fine

Status of proceedings

unknown

Sector

Financial services and insurance

Culpability

negligent

Repeat case

yes

Published

23 Jun 2026

Checked against the official source on 28 Sep 2026 · Direct link

Philip Morris Italia widely promoted heated tobacco devices, e-cigarettes and nicotine products for oral use with phrases such as "senza fumo" (smoke-free) and a "smoke-free future"; the AGCM considered this misleading because it suggested that the products were harmless or less harmful, although they can endanger health and safety. The authority imposed a fine of 7,000,000 EUR and prohibited continuation; the proceedings were triggered by a report from the Ministry of Health.

Authority / court

Autorità Garante della Concorrenza e del Mercato (AGCM)

Area of law

Consumer protection and online retail · Misleading advertising and pricing

Legal basis

Art. 20, 21 Abs. 1 und 3, 22 Codice del consumo (D.lgs. 206/2005)

Action

Fine

Status of proceedings

unknown

Sector

Other

Published

10 Jun 2026

Checked against the official source on 28 Sep 2026 · Direct link

Attackers posed as technical support, induced staff at points of sale to grant system access and obtained data on more than 365,000 customers, including payment data for 41,359 of them. The Italian data protection authority (Garante per la protezione dei dati personali) criticised deficient management of access credentials and digital certificates as well as inadequate security assessments, and imposed 1,715,600 EUR.

Authority / court

Garante per la protezione dei dati personali

Area of law

Data protection · Data breaches and data security

Legal basis

DSGVO (Integrität und Vertraulichkeit, Art. 32)

Action

Fine

Status of proceedings

unknown

Sector

Telecoms, IT and software

Published

16 Jul 2026

Checked against the official source on 25 Sep 2026 · Direct link

In a secret, continuing agreement, three manufacturers of salty snacks and crisps divided up among themselves the supply of private-label snacks to food retailers. Fines: Amica Chips 8,239,210 EUR, Pata 7,555,387 EUR, Preziosi Food 7,503,550 EUR; this was the first time Italy's competition authority (Autorità Garante della Concorrenza e del Mercato, AGCM) applied its settlement procedure.

Authority / court

Autorità Garante della Concorrenza e del Mercato (AGCM)

Area of law

Competition law · Cartels and collusion

Legal basis

Art. 101 AEUV; Art. 14-quater Gesetz 287/1990 (Settlement)

Action

Fine

Status of proceedings

unknown

Sector

Food and agriculture

Mitigating circumstances

Leniency reduction for Pata and Amica Chips; 10 % settlement discount for all

Published

28 Apr 2026

Checked against the official source on 25 Sep 2026 · Direct link

IVASS (Italian insurance supervisor) imposed a fine of 900,000 EUR on Ara 1857 S.p.A. under Art. 310(1) of the Private Insurance Code (CAP). The company had not adequately implemented the preventive and corrective measures required by the supervisor, so serious shortcomings persisted in corporate governance, remuneration systems, risk management and control, and in the current and forward-looking solvency assessment. According to IVASS sanctions statistics, the company had already received a fine of 380,000 EUR in 2023.

Authority / court

IVASS (Istituto per la Vigilanza sulle Assicurazioni)

Area of law

Capital markets and financial supervision · Organisational requirements

Legal basis

Art. 188 Abs. 3-bis lit. d, Art. 30, 30-bis, 30-ter, 30-quater, 30-septies und 310 Abs. 1 D.Lgs. 209/2005 (CAP); IVASS-Verordnung 38/2018

Action

Fine

Status of proceedings

unknown

Sector

Financial services and insurance

Repeat case

yes

Published

29 May 2026

Checked against the official source on 28 Sep 2026 · Direct link

The AGCM objected to three unfair commercial practices by Revolut: unclear information that investors sometimes acquire only fractional shares, together with misleading "0% commission" advertising; unclear information on account blocks and their aggressive implementation without adequate prior notice or support; and missing information on the requirements and time needed to obtain an Italian IBAN. Fines of 5,000,000 EUR against Revolut Group Holdings Ltd and Revolut Securities Europe UAB, and of 5,000,000 and 1,500,000 EUR against Revolut Group Holdings Ltd and Revolut Bank UAB, each jointly and severally, were imposed, totalling 11,500,000 EUR.

Authority / court

Autorità Garante della Concorrenza e del Mercato (AGCM)

Area of law

Consumer protection and online retail · Misleading advertising and pricing

Legal basis

Art. 20, 21, 22, 24, 25 Codice del consumo (D.lgs. 206/2005)

Action

Fine

Status of proceedings

unknown

Sector

Financial services and insurance

Mitigating circumstances

For the IBAN practice, the AGCM took into account measures that Revolut took on its own initiative during the proceedings.

Published

2 Apr 2026

Checked against the official source on 28 Sep 2026 · Direct link

The AGCM found that, within its selective distribution system for jewellery and watches, Morellato set its retailers' online resale prices and prohibited them from using third-party marketplaces and intermediation platforms from 20 July 2018 to 23 December 2025; by way of retaliation, Morellato blocked orders (Art. 101(1) TFEU). The fine amounts to 25,895,043 EUR.

Authority / court

Autorità Garante della Concorrenza e del Mercato (AGCM)

Area of law

Competition law · Cartels and collusion

Legal basis

Art. 101 Abs. 1 AEUV; Art. 15 Legge n. 287/1990

Action

Fine

Status of proceedings

unknown

Sector

Retail and e-commerce

Mitigating circumstances

Because treating the marketplace ban as a restriction of competition was novel, the AGCM calculated the fine solely on the basis of the online resale price maintenance.

Published

31 Mar 2026

Checked against the official source on 28 Sep 2026 · Direct link

According to the AGCM, the review platform did not adequately check whether reviews – including those labelled as "verified" – were genuine, and allowed companies to invite specifically selected customers to leave reviews via paid services, which undermined the representativeness of the star ratings. In addition, information on how the platform works and on paid services was lacking; the authority also saw dark pattern elements in this.

Authority / court

Autorità Garante della Concorrenza e del Mercato (AGCM)

Area of law

Consumer protection and online retail · Fake reviews

Legal basis

Artt. 20, 21, 22 e 23, comma 1, lett. bb-ter Codice del Consumo

Action

Fine

Status of proceedings

unknown

Sector

Media and online platforms

Published

23 Mar 2026

Checked against the official source on 25 Sep 2026 · Direct link

During an inspection at the Passo Corese logistics centre (around 1,800 employees), the Garante (Italian data protection authority) found that, after return-to-work interviews, information on illnesses, participation in strikes, trade union activities and family circumstances of employees – irrelevant to their professional aptitude – was recorded in free-text fields of a platform linked to time recording and accessible to many managers. With immediate effect it ordered the definitive restriction of processing of these entries – also at all other sites using the platform – and of four cameras at the entrances to toilets and break areas; the investigation was continuing.

Authority / court

Garante per la protezione dei dati personali

Area of law

Data protection · Employee data

Legal basis

Art. 5 Abs. 1 lit. a, c und e, Art. 6, 9 und 88 DSGVO; Art. 113 Codice privacy (D.Lgs. 196/2003); Maßnahme nach Art. 58 Abs. 2 lit. f DSGVO

Action

Order

Status of proceedings

unknown

Sector

Transport, logistics and shipping

Employees

10,000 or more

Published

24 Feb 2026

Checked against the official source on 28 Sep 2026 · Direct link

According to the AGCM, eDreams misled consumers about the alleged benefits of its "Prime" subscription using deceptive design elements and manipulative techniques and pushed them into membership (practice A); it also made it hard to leave the subscription (practice B). Vacaciones eDreams S.L., eDreams International Network S.L. and eDreams S.r.l. were jointly and severally fined 6,000,000 and 3,000,000 EUR, a total of 9,000,000 EUR.

Authority / court

Autorità Garante della Concorrenza e del Mercato (AGCM)

Area of law

Consumer protection and online retail · Information duties in online retail

Legal basis

Art. 20, 21, 22, 23 Abs. 1 lit. g, 24, 25, 26 lit. f Codice del consumo (D.lgs. 206/2005)

Action

Fine

Status of proceedings

unknown

Sector

Retail and e-commerce

Published

4 Feb 2026

Checked against the official source on 28 Sep 2026 · Direct link

From 2004 to June 2024, foundries coordinated their pricing strategies via the association Assofond: they exchanged sensitive information and developed joint indexation mechanisms ("Assofond indicators") in order to push through price increases including margins. The AGCM imposed fines of 70 million EUR (maximum around 600 million EUR), taking the crisis in the sector into account as a mitigating factor. Addressees: C2MAC Group, Fonderia Corrà, Fonderie De Riccardis, Fonderie Guido Glisenti/Lead Time, Pilenga Baldassarre/E.F. Group, Fonderie Mora Gavardo/Camozzi Group, Zanardi Fonderie, VDP Fonderia, Fonderie Ariotti, Ironcastings, Fonderia Zardo, ZML Industries/Cividale, Assofond.

Authority / court

Autorità Garante della Concorrenza e del Mercato (AGCM)

Area of law

Competition law · Cartels and collusion

Legal basis

Art. 101 AEUV

Action

Fine

Status of proceedings

unknown

Sector

Steel and metals

Mitigating circumstances

The severe crisis in the foundry sector was taken into account in setting the fines

Published

31 Dec 2025

Checked against the official source on 25 Sep 2026 · Direct link