DPA case 10021468 – Violation Found (Italy, 2024)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
An Italian authority found that a proposed regulation for cloud services needs to ensure better data protection for public administrations. This is important because it sets standards for how companies should handle personal data in digital services.
What happened
The authority reviewed a draft regulation aimed at improving data protection for public administrations using cloud services.
Who was affected
Public administrations and the companies providing cloud services to them.
What the authority found
The authority highlighted the need for clear responsibilities and security measures for cloud service providers handling personal data.
Why this matters
This finding indicates a push for stronger data protection standards in cloud services, which is crucial for businesses that handle sensitive information.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Secondary-source text retrieved.
Automated check recorded — 18 October 2026.
Processing notes: articles corrected.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
Article 2 of the draft regulation under consideration setted the appropriate objectives and standards to be adopted; specifically: - established the minimum levels of security, processing capacity, energy savings and reliability of digital infrastructure for public administrations and cloud services; - defined the characteristics of quality, security, performance, scalability, interoperability and portability of cloud services for public administrations; - identified the terms and modalities for the migration of data and digital services for public administrations; - defined the modalities for the qualification of cloud services for public administrations. The draft regulation also dealed with identifying ways to adapt PA infrastructure and cloud. The main focus of the opinion is related about Article 22 of the draft regulation. It is elaborated on the regulation of personal data processing, stipulating that: - Administrations are the controllers of personal data processing carried out in the context of digital infrastructure and cloud services. - Operators of digital infrastructures, cloud service providers and additional entities involved in the processing of personal data, as well as entities they use to perform specific processing activities on behalf of administrations, shall act as data controllers within the meaning of Article 28 of Regulation (EU) 2016/679. They shall take appropriate measures to ensure timely and adequate information to the administrations in case of personal data breaches pursuant to Article 33 (2) of the GDPR. - In case of transfer of personal data outside the European Economic Area, data controllers are required to comply with the administrations' instructions issued pursuant to Article 28 (3) (a) of the GDPR and make available to them any information necessary to assess the effectiveness of the measures put in place. - The ACN (National Cybersecurity Agency) shall notify the Guarantor of evidence on possible breaches of personal data.
Outcome
Violation Found
The DPA found a violation but did not impose a fine.
Related Enforcement Actions (0)
No other enforcement actions found for DPA case 10021468 in IT
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. DPA case 10021468 - Italy (2024). Retrieved from cookiefines.eu
Last updated: