- Enforcing jurisdiction
- Italy · Geography does not establish applicable law.
- Confirmed applicable legislation
- Privacy topics
Roma Capitale – €350,000 Fine (Italy, 2021)
Privacy enforcement record
This record is classified outside cookie consent. Subject classification does not confirm an applicable law. It is not included in cookie statistics or the Risk Calculator.
Roma Capitale was fined EUR 350,000 for inadequate security measures regarding data of citizens with traffic permits. This ruling is significant because it highlights the responsibility of public entities to protect personal data. It serves as a reminder that poor data protection can lead to hefty fines.
What happened
The city of Rome failed to secure data related to traffic permits, allowing unauthorized access.
Who was affected
Citizens who held permits to access restricted traffic areas in Rome.
What the authority found
The Italian data protection authority found that Roma Capitale did not take necessary security measures and lacked proper agreements with service providers.
Why this matters
This case sets a precedent for public entities, stressing the need for stringent data protection practices to avoid significant penalties.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Linked-source text retrieved.
Automated check recorded — 6 March 2026.
Processing notes: articles corrected, national law identified.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
The Italian DPA (Garante) fined the city of Rome EUR 350,000 for failing to take adequate technical and organizational measures regarding the data of citizens who had obtained permits to access restricted traffic areas. The permits were verified by scanning QR codes located on badges affixed to windshields. This allowed city staff to verify in real time whether the particular vehicle was allowed to be in the zone and to whom the permit had been issued. However, according to the DPA, not only city staff, but anyone could scan the codes and access the information, as it only required an ordinary QR scanner. The information stored in the system, included, for example, the name of the user or the license plate number of the vehicle. In addition, the DPA found that the city of Rome had used the services of a provider for the hosting and maintenance of databases without a proper agreement as required by Art. 28 GDPR.
Related Enforcement Actions (2)
Other enforcement actions involving Roma Capitale in IT
Fine
€350K
Details
Fine Date
11 February 2021
Authority
Garante per la protezione dei dati personali
Fine Amount
€350,000
Enforcement Tracker ID
ETid-617
About this data
Cite as: Cookie Fines. Roma Capitale - Italy (2021). Retrieved from cookiefines.eu
Last updated: