Rinascente – €300,000 Fine (Italy, 2023)

The data subject was a client of La Rinascente store, the controller, and had a loyalty card, the "Rinascentecard". In July 2021, she visited a store and had an argument with an employee. Later on that same day, she received an e-mail notifying her of the successful activation of a new loyalty card. The new card, that she never requested, had her personal details modified and her name was changed to "Donzella Svampita" (approximately, "Ditzy damsel"). Then, she contacted the Customer Service, which informed her that the Rinascentecard, activated years ago, had been canceled and replaced by the new one, with the new name indicated above. She felt offended and filed a complaint with the Italian DPA. The DPA first requested some information form the controller about the possible data breach. Later, it decided to further investigate the facts and carry out an on-site inspection. In this inspection, the DPA identified other issues, namely: a) the lack of information regarding the transfer of personal data of website visitors to Facebook-Meta for advertising and profiling purposes; b) the lack of a DPIA performed prior to profiling activities; c) the lack of information regarding the storage period of personal data from clients registered in the loyalty program. In its defense, the controller argued that as soon as it learned about the activation of the new card, it opened an investigation and find out that an employee acted in violation of the company's procedures and modified the name and surname of the data subject without authorization. According to the controller, there was no further processing of her personal data, nor any data loss. Moreover, the controller stated that the name of the data subject was corrected in its systems. On the other hand, when presenting its defense, the controller admitted that it had detected another personal data breach caused by a misalignment of its systems. In this second data breach, 5 customers erroneously received communications