Bakeca S.r.l. – €5,000 Fine (Italy, 2026)

An unknown person published two offers on an online board for classified ads, including an explicit offer for sex work. The ads contained the phone number of another person (the data subject). The data subject did not engage in sex work and was entirely unaware of the publication of her number. After receiving calls from prospective customers, the data subject reached out to the company that managed the board (the controller) and managed to get the ads removed. The data subject later filed a complaint against the controller, claiming that her data were published without her consent. The DPA held that the controller processed the subject’s data with no legal basis and failed to implement sufficient measures to prevent the users of its website from non-consensually disclosing personal data of third parties. In this regard, the controller protested that, according to its privacy notice, the user was under an obligation not to post personal data of third parties without their consent. However, the DPA held that this provision could not waive the controller’s obligation under the GDPR. Furthermore, the DPA held that the data subject’s phone number constituted sensitive in the case at hand due to the sexual nature of one of the ads, in which it was publishedWith regards to the sensitive nature of the data, the DPA referenced CJEU, Case C-204/21, European Commission v. Republic of Poland, 5 June 2023 (available [https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex:62021CJ0204 here]).. In this regard, it was not relevant that the data subject did not engage in sex work, as inaccurate data may still be sensitive. So, the DPA concluded that the controller violated Article 9 GDPR as well. Overall, the DPA found violations of Articles 5, 6, 9, 24, 25, and 32. The DPA issued a €5,000 fine and ordered the controller to implement measures in order to prevent users from non-consensually disclosing other people’s contact details, at least with regard to sexual ads.