DPA case 9592011 – Complaint Upheld (Italy, 2021)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
The Italian data protection authority ruled that Associazione Rousseau must return personal data to the Movimento 5 Stelle political group. This decision matters because it reinforces the rights of organizations to control their members' data.
What happened
Movimento 5 Stelle complained that Associazione Rousseau refused to delete their members' data after they stopped using the Rousseau platform.
Who was affected
Members of the Movimento 5 Stelle political group whose data was held by Associazione Rousseau.
What the authority found
The authority found that Associazione Rousseau must comply with the request to return the personal data of M5S members.
Why this matters
This ruling underscores the importance of data control for organizations. It reminds companies that they need to ensure their data processors comply with data protection laws.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Secondary-source text retrieved.
Automated check recorded — 18 October 2026.
No issues were reported by that automated check.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
Movimento 5 Stelle (M5S) is a populist political group. Because it is not recognized as a political party under Italian law, it organized its almost 200,000 certified members on the M5S digital platform. The digital platform, owned by Associazione Rousseau, is designed to enable participatory democracy. M5S members used the site to vote on budgetary and leadership decisions, for example. After a political fallout between the leaders of Movimento 5 Stelle (M5S) and the Associazione Rousseau, M5S decided to stop using the Rousseau platform. Thereafter, two members of M5S asked Associazione Rousseau to delete their data, but Associazione Rousseau refused to do so. M5S objected and submitted a complaint to the Italian DPA. M5S claimed that it is the data controller of the M5S digital platform, and that Associazione Rousseau, as the data processor, must comply with Article 28 GDPR by returning all personal data to the data controller. MS5 requested that Associazione Rousseau comply by making the domains of the 'movimento5stelle.it' and 'tirendiconto.it' websites available to M5S and by refraining from any form of processing that is not necessary for the fulfilment of their legal obligations. M5S further demanded that that Associazione Rousseau return the personal data of all M5S members, explain the methods and security requirements it had for collecting and storing data on M5S members, and explain the precise technical procedures it will use for transferring the data in question. The DPA ascertained, based on the documentation provided by M5S, that the Associazione Rousseau does indeed fulfil the role of data processor - even if in certain situations it is an autonomous data processor - and that M5S is the data controller for all purposes. Pursuant to Article 58(2)(d) of the GDPR, the DPA ordered Associazione Rousseau to comply with the provisions of Article 28(3)(g) of the GDPR by ensuring that all the personal data of the M5S members are given to Movimento 5 St
Outcome
Complaint Upheld
A data subject complaint that was upheld by the DPA.
Related Enforcement Actions (0)
No other enforcement actions found for DPA case 9592011 in IT
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. DPA case 9592011 - Italy (2021). Retrieved from cookiefines.eu
Last updated: