Sagitter S.p.a. – Complaint Upheld (Italy, 2026)

Due to a mistaken identity, a collection agency (the controller) attempted to collect a debt from the wrong person (the data subject). In order to do so, the controller intended to foreclose on an undivided real estate owned by the data subject and his relatives. So, the controller contacted the data subject’s relatives and informed them about the unpaid debt and about its intention to foreclose on the estate. The data subject later filed a complaint, protesting that the controller processed his data unlawfully. During the procedure, the controller pointed out that Italian lawArt. 599 of the Italian Code of civil procedure. requires creditors to notify all co-owners when foreclosing on an undivided estate. On these grounds, the controller claimed that it lawfully processed personal data based on its legitimate interest. The DPA, however, observed that the notifications took place even though the foreclosure procedure had not started. In other words, the foreclosure procedure was merely hypothetical at the time. Therefore, the controller’s legitimate interest was not real and present at the time of the notification. On these grounds, the DPA concluded that the controller unlawfully disclosed personal data, in violation of Articles 5(1)(a) and 6 GDPR. The DPA ordered the controller to bring its activities into compliance by only notifying actual foreclosure proceedings.