Garante per la protezione dei dati personali (Italy) - 10195379

Garante per la protezione dei dati personali - 10195379

Authority:	Garante per la protezione dei dati personali (Italy)
Jurisdiction:	Italy
Relevant Law:	Article 37(1) GDPR Article 37(7) GDPR Article 58(2) GDPR Article 83(1) GDPR Article 83(2) GDPR Article 83(4) GDPR Guidelines on Data Protection Officers
Type:	Investigation
Outcome:	Violation Found
Started:
Decided:
Published:	23.10.2025
Fine:	2,000 EUR
Parties:	Municipality of Avola
National Case Number/Name:	10195379
European Case Law Identifier:	n/a
Appeal:	Appealed - Confirmed
Original Language(s):	Italian
Original Source:	garante per la Protezion dei dati personali (in IT)
Initial Contributor:	Ariel Bassano

The DPA imposed a 2,000 euro fine on a municipality for a violation of Article 37(7) GDPR. The municipality had forgotten to communicate its deisgnated DPO to the authority.

English Summary

Facts

The Italian DPA began an ex-officio Investigation in the Municipality of Avola in order to determine the compliance with the privacy regulations. During the process, it was determined a breach concerning the DPO’s designation, as the Municipality had not notified the DPA, in accordance with local regulations. It was also missing the contact details of the designated DPO on its webpage.

The Municipality, when asked by the DPA to provide further clarification, stated that the DPO had been designated prior to the investigation and published on its webpage and informed that they had simplified the contact details. It also stated that the lack of notification to the DPA was due to a simple oversight, and that they had rectified it.

Holding

The DPA upheld the complaint and found a violation of Article 37(7) GDPR. During the process, the DPA stated that the DPO had been previously designated on July 2nd 2019. Nevertheless, the failure to communicate the contact details of the DPO to the Authority adversely affected the possibility of the DPA to contact the same DPO easily and directly, reflecting the negligence of the Municipality.

Following this, the DPA imposed a €2,000 fine. In defining the amount, the DPA took into account that the fine was effective, proportionate, and dissuasive (art. 83, par. 1) and its lack of cooperation.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Italian original. Please refer to the Italian original for more details.

[web doc. no. 10195379]

Measure of October 23, 2025

Register of Measures
no. 615 of October 23, 2025

THE ITALIAN DATA PROTECTION AUTHORITY

IN today's meeting, attended by Professor Pasquale Stanzione, President, Professor Ginevra Cerrina Feroni, Vice President, Dr. Agostino Ghiglia and Guido Scorza, members, and Councillor Angelo Fanizza, Secretary General;

CONSIDERING Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC, "General Data Protection Regulation" (hereinafter, the Regulation);

SEEN Legislative Decree No. 196 of June 30, 2003, establishing the Personal Data Protection Code (hereinafter, the Code);

SEEN Regulation No. 1/2019 concerning internal procedures of external relevance, aimed at carrying out the tasks and exercising the powers delegated to the Italian Data Protection Authority, approved by Resolution No. 98 of April 4, 2019, published in the Official Journal No. 106 of May 8, 2019, and on www.gpdp.it, web doc. No. 9107633 (hereinafter, Italian Data Protection Authority Regulation No. 1/2019);

SEEN the documentation in the file;

SEEN the observations made by the Acting Secretary General pursuant to Article 15 of the Italian Data Protection Authority Regulation No. 1/2000 on the organization and functioning of the Office of the Italian Data Protection Authority, doc. Web no. 1098801;

Rapporteur: Attorney Guido Scorza;

WHEREAS

1. Introduction

As part of a series of official checks conducted by this Authority, an inspection conducted on XX found that the Municipality of Avola (hereinafter, the Municipality) did not communicate the contact details of the Data Protection Officer (hereinafter, the DPO) to the Authority—using the dedicated channel available at https://servizi.gpdp.it/comunicazionerpd/s/—as required by Article 37, paragraph 7, of the Regulation.

Furthermore, a contextual check of the Municipality's institutional website did not locate the DPO's contact details, thus failing to find any evidence that the Municipality had designated the DPO.

Therefore, with note dated XX (ref. no. XX), the Office, on the basis of the information acquired and the checks carried out, notified the Municipality, pursuant to art. 166, paragraph 5, of the Code, of the initiation of the procedure for the adoption of the provisions referred to in art. 58, paragraph 2, of the Regulation, as it had neither published nor communicated to the Authority the contact details of the DPO, in violation of art. 37, paragraph 7, of the Regulation, and since, on the basis of this, it was not proven that the Municipality had actually designated the DPO, in violation of art. 37, paragraph 1, of the Regulation. With the same notice, the aforementioned data controller was invited to submit written defenses or documents to the Guarantor or to request a hearing with the Authority (Article 166, paragraphs 6 and 7, of the Code, as well as Article 18, paragraph 1, of Law No. 689 of November 24, 1981).

In a letter sent on XX (ref. no. XX), to which reference is made in full, the Municipality submitted its defense pleadings, in which it stated:

- "that it has already fulfilled its obligation to designate a Data Protection Officer (DPO) [...] as per Resolution No. XX of XX, attaching the relevant documentation;

- "that the aforementioned DPO's contact information is available on the Municipality's website at: http://www.comune.avola.sr.it/zf/index.php/trasparenza/index/index/categoria/318 or can be found via the Home->Transparent Administration->Privacy and Personal Data Protection Officer" path;

- "that due to sheer forgetfulness, the designation and contact details of the DPO were not communicated to the Guarantor";

- that it has provided "the contact details of the Data Protection Officer (DPO) (Article 37, paragraph 7, GDPR and art. 28, paragraph 4 of Legislative Decree 51/2018) on XX through the specific link provided by the Guarantor";

- to have simplified "the traceability of the DPO's contact details by directly inserting the link "Privacy and Data Protection Officer" on the website's home page.

Based on the Municipality's submission, a check was carried out on its website on XX, where the presence of a resolution designating the DPO, signed on July 2, 2019, was confirmed.

2. Outcome of the investigation

Pursuant to art. 37 of the Regulation, the data controller (and processor) "shall systematically designate a data protection officer whenever: (a) processing is carried out by a public authority or body, except for courts acting in their judicial capacity" (paragraph 1, letter a)) and "shall publish the contact details of the data protection officer and communicate them to the supervisory authority" (paragraph 7).

Furthermore, the Guidelines on Data Protection Officers (DPOs), adopted by the Article 29 Working Party on Personal Data Protection on December 13, 2016, and amended on April 5, 2017, specifically add that "Article 37, paragraph 7, of the GDPR requires the controller or processor to publish the contact details of the DPO and to communicate the DPO's contact details to the relevant supervisory authorities. These provisions aim to ensure that both data subjects (inside or outside the controller or processor) and supervisory authorities can contact the DPO easily and directly without having to contact another entity operating within the controller or processor" (section 2.6).

The Guidance Document on the Designation, Position, and Tasks of the Data Protection Officer (DPO) in the Public Sector, adopted by the Garante on April 29, 2021, with Decision No. 186 (web doc. no. 9589104), specifies, in particular, that "Regarding publication, this must be done on the administration's website, within a section easily recognizable by the user and accessible from the homepage, as well as within the section dedicated to the organization chart of the entity and its contact details", and that "Regarding communication to the Authority, it is highlighted that the Guarantor has made available a specific online procedure not only for communication, but also for changing and revoking the name of the designated DPO. This procedure represents the only contact channel usable for this specific purpose and can be found at https://servizi.gpdp.it/comunicazionerpd/s/, where the specific instructions and related FAQs are also provided. Furthermore, the attention of the entities is drawn to correctly enter the required data, such as the identification of the data controller (the entity as a whole, and not the legal representative) and the completion of the administration's tax code. (and not the VAT number, or tax code of another entity)” (paragraph 7).

Considering this, it should be noted that the declarations made by the Municipality during the investigation – the veracity of which may be held accountable pursuant to Article 168 of the Code – only partially address the concerns notified by the Office with the document initiating the proceedings. This proceeding can be dismissed, pursuant to the combined provisions of Articles 11 and 14 of the Guarantor Regulation No. 1/2019, only with regard to the violation of Article 37, paragraph 1, letter a) of the Regulation, in relation to the failure to appoint a DPO, and paragraph 7 in relation to the publication of the DPO's contact details.

This is due to the fact that, during the investigation, it emerged that the Municipality had already appointed a DPO as of July 2, 2019. Considering that, pursuant to Article 22, paragraph 13, of Legislative Decree No. 101/2018, which contains provisions for the adaptation of national legislation to the provisions of the Regulation, "for the first eight months from the date of entry into force of this decree, the Data Protection Authority shall take into account, for the purposes of applying administrative sanctions [...] the phase of initial application of the sanctions provisions," it is noted that the procedure for initiating the appointment in question had been initiated during that phase and that it had concluded, with the designation of the DPO, shortly after its conclusion.

It also emerged that the DPO's contact details were published on the Municipality's institutional website, despite the latter subsequently deciding to do so via another link to simplify traceability. Nor were any elements found to prove a failure to comply prior to the initiation of the procedure.

For the rest, the Office's preliminary assessments regarding the violation of Article 37, paragraph 7, of the same article are confirmed, solely with regard to the communication of contact information to the Authority.

This is because the first communication of contact information recorded in the Authority's records is dated XX (ref. no. XX), thus it is established in the documents that it occurred several years after the Authority's appointment, i.e., following the Authority's sending of the notice contesting the aforementioned breach.

It is therefore confirmed that the Municipality had not communicated the relevant contact information to the Authority until XX, in violation of Article 37, paragraph 7, of the Regulation.

Since the Municipality has nevertheless fulfilled the aforementioned obligation, the conditions for adopting the specific corrective measures referred to in Article 58, paragraph 2, letter d), of the Regulation are not met.

3. Adoption of the injunction order for the application of the administrative pecuniary sanction (Article 58, paragraph 2, letter i), and Article 83 of the Regulation; Article 166, paragraph 7, of the Code)

The Guarantor, pursuant to Article 58, paragraph 2, letter i), and Article 83 of the Regulation, as well as Article 166 of the Code, has the power to "impose a pecuniary administrative sanction pursuant to Article 83, in addition to the [other] corrective measures referred to in this paragraph, or in place of such measures, depending on the circumstances of each individual case." Within this framework, "the [Garante] Panel shall adopt the injunction order, by which it also orders the application of the additional administrative sanction, its publication, in full or in extract, on the Garante's website pursuant to Article 166, paragraph 7, of the Code" (Article 16, paragraph 1, of the Garante's Regulation No. 1/2019).

In this regard, in this case, violation of the aforementioned provisions is subject to the application of the pecuniary administrative sanction provided for in Article 83, paragraph 4, of the Regulation.

The aforementioned administrative fine, imposed based on the circumstances of each individual case, must be determined with due consideration of the factors set forth in Article 83, paragraph 2, of the Regulation, with respect to which the following is noted:

The failure to communicate the DPO's contact details to the Authority negatively impacted the Authority's ability to contact the DPO easily and directly. Conversely, it is noted that the Municipality has taken steps to remedy this latest violation and that it has not been charged with any previous relevant violations or measures pursuant to Article 58 of the Regulation. The negligent nature of the violation is also noted.

Based on the aforementioned factors, assessed as a whole, it is deemed appropriate to determine the fine of €2,000 (two thousand) for the violation of Article 37, paragraph 2, of the Regulation. 7 (limited to the provision of the DPO's contact details) of the Regulation as an administrative pecuniary sanction deemed, pursuant to Art. 83, paragraph 1, of the Regulation, to be effective, proportionate, and dissuasive.

It is also believed that the additional sanction of publication of this provision on the Garante's website, provided for by Art. 166, paragraph 7, of the Code and Art. 16 of the Garante's Regulation No. 1/2019, should apply, given that this concerns the delayed fulfillment of obligations that have been mandatory since 2018.

Finally, it is believed that the conditions set out in Art. 17 of the Garante's Regulation No. 1/2019 are met.

NOW WITH ALL THE ABOVE STATEMENTS, THE GUARANTOR

pursuant to Art. 57, paragraph 1, letter a) of the Regulations, declares the conduct of the Municipality of Avola, as described in the grounds, to be unlawful and constitutes a violation of Article 37, paragraph 7 (limited to the disclosure of the DPO's contact details) of the Regulations;

ORDERS

the Municipality of Avola, with registered office at Corso Garibaldi, no. 82 - 96012 Avola (SR) – VAT no. 00090570896, pursuant to Article 58, paragraph 2, letter i), and Article 83 of the Regulations, to pay the sum of €2,000 (two thousand) as an administrative fine for the violations indicated in the grounds;

ORDER

The Municipality of Avola to pay the sum of €2,000 (two thousand), according to the methods indicated in the attachment, within 30 days of notification of this order, under penalty of the adoption of the subsequent enforcement proceedings pursuant to Article 27 of Law 689/1981.

In this regard, it is recalled that the offender retains the right to settle the dispute by paying, again according to the methods indicated in the attachment, an amount equal to half the fine imposed, within 30 days of notification of this order, pursuant to Article 166, paragraph 8, of the Code (see also Article 10, paragraph 3, of Legislative Decree No. 150 of September 1, 2011);

ORDERS

- pursuant to the combined provisions of Articles 11 and 14 of the Guarantor's Regulation No. 1/2019, dismissal of the proceedings with reference to the violation of Article 37, paragraph 7, of the Regulation, limited to the publication of the DPO's contact details.

- Pursuant to Article 166, paragraph 7, of the Code and Article 16, paragraph 1, of the Garante's Regulation No. 1/2019, publication of the injunction order on the Garante's website;

- Pursuant to Article 154-bis, paragraph 3, of the Code and Article 37 of the Garante's Regulation No. 1/2019, publication of this provision on the Garante's website;

- Pursuant to Article 17 of the Garante's Regulation No. 1/2019, recording of the violations and measures adopted in accordance with Article 58, paragraph 2, of the Regulation in the Authority's internal register provided for by Article 57, paragraph 1, of the Regulation. 1, letter u) of the Regulations.

Pursuant to Article 78 of the Regulations, Article 152 of the Code, and Article 10 of Legislative Decree 150/2011, an appeal against this decision may be lodged before the ordinary judicial authority, under penalty of inadmissibility, within thirty days of the date of notification of the decision itself, or within sixty days if the appellant resides abroad.

Rome, October 23, 2025

THE PRESIDENT
Stanzione

THE RAPPORTEUR
Scorza

THE SECRETARY GENERAL
Fanizza

[web doc. no. 10195379]

Decision of October 23, 2025

Register of Decisions
no. 615 of October 23, 2025

THE ITALIAN DATA PROTECTION AUTHORITY

IN today's meeting, attended by Professor Pasquale Stanzione, President, Professor Ginevra Cerrina Feroni, Vice President, Dr. Agostino Ghiglia and Guido Scorza, members, and Councillor Angelo Fanizza, Secretary General;

SEEN Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC, "General Data Protection Regulation" (hereinafter, the Regulation);

SEEN Legislative Decree No. 196 of June 30, 2003, establishing the Personal Data Protection Code (hereinafter, the Code);

SEEN Regulation No. 1/2019 concerning internal procedures with external relevance, aimed at carrying out the tasks and exercising the powers delegated to the Italian Data Protection Authority, approved by Resolution No. 98 of April 4, 2019, published in the Official Journal No. 106 of May 8, 2019, and on www.gpdp.it, web doc. No. 9107633 (hereinafter, Italian Data Protection Authority Regulation No. 1/2019);

SEEN the documentation in the file;

SEEN the observations made by the Acting Secretary General pursuant to Article 15 of Italian Data Protection Authority Regulation No. 1/2000 on the organization and functioning of the Office of the Italian Data Protection Authority, web doc. No. 1098801;

Rapporteur: Guido Scorza;

WHEREAS

1. Introduction

As part of a series of official checks conducted by this Authority, an inspection conducted on XX found that the Municipality of Avola (hereinafter, the Municipality) did not communicate the contact details of the Data Protection Officer (hereinafter, the DPO) to the Authority—using the dedicated channel available at https://servizi.gpdp.it/comunicazionerpd/s/—as required by Article 37, paragraph 7, of the Regulation.

Furthermore, a contextual check conducted on the Municipality's institutional website failed to locate the DPO's contact details, thus failing to find any evidence that the Municipality had designated the DPO.

Therefore, with a note dated XX (ref. no. XX), the Office, based on the information acquired and the checks carried out, notified the Municipality, pursuant to Article 37, paragraph 7, of the Regulation. 166, paragraph 5, of the Code, the initiation of the procedure for the adoption of the measures referred to in Article 58, paragraph 2, of the Regulation, as it had neither published nor communicated to the Authority the contact details of the DPO, in violation of Article 37, paragraph 7, of the Regulation, and because, on this basis, it was not proven that the Municipality had actually designated the DPO, in violation of Article 37, paragraph 1, of the Regulation. With the same notice, the aforementioned data controller was invited to submit written defenses or documents to the Guarantor or to request a hearing by the Authority (Article 166, paragraphs 6 and 7, of the Code, as well as Article 18, paragraph 1, of Law No. 689 of 24 November 1981).

In a letter sent on XX (ref. no. XX), to which reference is made in full, the Municipality submitted its defense pleadings, in which it stated:

- "that it has already fulfilled its obligation to designate a Data Protection Officer (DPO) [...] as per Resolution No. XX of XX, attaching the relevant documentation;

- "that the aforementioned DPO's contact information is available on the Municipality's website at: http://www.comune.avola.sr.it/zf/index.php/trasparenza/index/index/categoria/318 or can be found via the Home->Transparent Administration->Privacy and Personal Data Protection Officer" path;

- "that due to sheer forgetfulness, the designation and contact details of the DPO were not communicated to the Guarantor";

- that it has provided "the contact details of the Data Protection Officer (DPO) (Article 37, paragraph 7, GDPR and art. 28, paragraph 4 of Legislative Decree 51/2018) on XX through the specific link provided by the Guarantor";

- to have simplified "the traceability of the DPO's contact details by directly inserting the link "Privacy and Data Protection Officer" on the website's home page.

Based on the Municipality's submission, a check was carried out on its website on XX, where the presence of a resolution designating the DPO, signed on July 2, 2019, was confirmed.

2. Outcome of the investigation

Pursuant to Article 37 of the Regulation, the data controller (and processor) "shall systematically designate a data protection officer whenever: (a) processing is carried out by a public authority or body, except for courts acting in their judicial capacity" (paragraph 1, letter a)) and "shall publish the contact details of the data protection officer and communicate them to the supervisory authority" (paragraph 7).

Furthermore, the Guidelines on Data Protection Officers (DPOs), adopted by the Article 29 Working Party on Personal Data Protection on December 13, 2016, and amended on April 5, 2017, specifically add that "Article 37, paragraph 7, of the GDPR requires the controller or processor to publish the contact details of the DPO and to communicate the DPO's contact details to the relevant supervisory authorities. These provisions aim to ensure that both data subjects (inside or outside the controller or processor) and supervisory authorities can contact the DPO easily and directly without having to contact another entity operating within the controller or processor" (section 2.6).

The Guidance Document on the Designation, Position, and Tasks of the Data Protection Officer (DPO) in the Public Sector, adopted by the Garante on April 29, 2021, with Decision No. 186 (web doc. no. 9589104), specifies, in particular, that "Regarding publication, this must be done on the administration's website, within a section easily recognizable by the user and accessible from the homepage, as well as within the section dedicated to the organization chart of the entity and its contact details", and that "Regarding communication to the Authority, it is highlighted that the Guarantor has made available a specific online procedure not only for communication, but also for changing and revoking the name of the designated DPO. This procedure represents the only contact channel usable for this specific purpose and can be found at https://servizi.gpdp.it/comunicazionerpd/s/, where the specific instructions and related FAQs are also provided. Furthermore, the attention of the entities is drawn to correctly enter the required data, such as the identification of the data controller (the entity as a whole, and not the legal representative) and the completion of the administration's tax code. (and not the VAT number, or tax code of another entity)” (paragraph 7).

Considering this, it should be noted that the declarations made by the Municipality during the investigation – the veracity of which may be held accountable pursuant to Article 168 of the Code – only partially address the concerns notified by the Office with the document initiating the proceedings. This proceeding can be dismissed, pursuant to the combined provisions of Articles 11 and 14 of the Guarantor Regulation No. 1/2019, only with regard to the violation of Article 37, paragraph 1, letter a) of the Regulation, in relation to the failure to appoint a DPO, and paragraph 7 in relation to the publication of the DPO's contact details.

This is due to the fact that, during the investigation, it emerged that the Municipality had already appointed a DPO as of July 2, 2019. Considering that, pursuant to Article 22, paragraph 13, of Legislative Decree No. 101/2018, which contains provisions for the adaptation of national legislation to the provisions of the Regulation, "for the first eight months from the date of entry into force of this decree, the Data Protection Authority shall take into account, for the purposes of applying administrative sanctions [...] the phase of initial application of the sanctions provisions," it is noted that the procedure for initiating the appointment in question had been initiated during that phase and that it had concluded, with the designation of the DPO, shortly after its conclusion.

It also emerged that the DPO's contact details were published on the Municipality's institutional website, despite the latter subsequently deciding to do so via another link to simplify traceability. Nor were any elements found to prove a failure to comply prior to the initiation of the procedure.

For the rest, the Office's preliminary assessments regarding the violation of Article 37, paragraph 7, of the same article are confirmed, solely in relation to the communication of contact information to the Authority.