- Enforcing jurisdiction
- Italy · Geography does not establish applicable law.
- Confirmed applicable legislation
- Privacy topics
Comune di Siracusa – €5,000 Fine (Italy, 2024)
The Comune di Siracusa was fined €5,000 for not appointing a Data Protection Officer (DPO) and failing to communicate their contact details to the Italian data protection authority. This ruling underscores the necessity for public entities to comply with data protection laws. It serves as a reminder that even municipalities must follow these regulations.
What happened
Comune di Siracusa did not designate a Data Protection Officer or communicate their contact details to the authority.
Who was affected
The Comune di Siracusa, a local government entity.
What the authority found
The authority found that the Comune violated GDPR by not fulfilling its obligation to appoint a DPO and inform the authority.
Why this matters
This case shows that public entities must comply with data protection laws just like private companies. It highlights the importance of appointing a DPO and communicating necessary information to authorities.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Secondary-source text retrieved.
Automated check recorded — 6 April 2026.
No issues were reported by that automated check.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
The Italian DPA conducted an investigation into the compliance of the Municipality of Siracusa (the controller) with data protection laws, pursuant to Article 58(1)(b) GDPR. During the investigation, it was discovered that the controller had failed to fulfil its obligation to designate a DPO and communicate their contact details to the DPA. Considering the findings, the DPA informed the controller of the start of a sanctioning procedure under Article 58(2) GDPR. The DPA also invited the controller to provide its defence in writing. The Italian DPA noted that Article 37(7) GDPR not only mandates the controller to publish the contact details of the DPO but also to communicate them to the DPA. Furthermore, it cited the “[https://ec.europa.eu/newsroom/article29/items/612048/en Guidelines on Data Protection Officers]”, adopted by the Article 29 Working Party, which outline the requirements for designating a DPO and communicating their contact details to the DPA. The Italian DPA even established in another [https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9589467 document] the dedicated online procedure for entities to use in communicating the DPO's contact details. This procedure served as the solely authorised channel for such communications and was designed to ensure the efficient and secure transfer of information between entities and the DPA. Therefore, although the controller had published the contact details of the DPOs on its website, it had not officially communicated this information via established procedures to the DPA, violating Article 37(7) GDPR. The controller's attempts to rectify the situation, such as contacting the DPA by phone and submitting the contact details of the DPOs through the designated online form, were deemed insufficient by the DPA since the details were provided after the start of the proceedings. As a consequence, the DPA imposed a pecuniary administrative sanction of €5,000 on the controller for its failure to comply with Article 37(7) GDPR.
Related Enforcement Actions (0)
No other enforcement actions found for Comune di Siracusa in IT
This is the only recorded action for this entity in this jurisdiction.
Details
Fine Date
11 January 2024
Authority
Garante per la protezione dei dati personali
Fine Amount
€5,000
GDPRhub ID
gdprhub-7588About this data
Cite as: Cookie Fines. Comune di Siracusa - Italy (2024). Retrieved from cookiefines.eu
Last updated: