Altroconsumo Edizioni S.r.l. – €280,000 Fine (Italy, 2026)

The controller is a publishing company that sells subscriptions to consumer information services through its website. Users can sign up by filling in a registration form on the site, ticking a box acknowledging the privacy policy and accepting the General Terms. The controller then sends an email asking the user to click a link to confirm their account and complete the registration. The data subject started receiving promotional emails from the controller, and was also called by the controller's processor, who offered them a subscription. The data subject denied ever having visited the controller's website or having filled in the registration form. The controller, on the other hand, stated that its logs recorded three visits attributable to the data subject: two on 11 August 2025 and one on 5 September 2025, during which the form was completed. In the file submitted as evidence, the data subject's surname was misspelt on all three occasions and the three connections came from Canadian IP addresses. The controller sent three unanswered confirmation emails and then began sending promotional emails anyway, as if the registration had been completed. On 17 September 2025, the data subject sent the processor a form exercising their right of access and their right to object to processing for direct marketing purposes. The processor forwarded it to the controller the same day. As the promotional emails continued, the data subject sent the same form directly to the controller on 11 October 2025. The last promotional email was sent on 3 November 2025. On 4 November 2025, the data subject lodged a complaint with the DPA. On 9 February 2026, the DPA asked the controller for information under Article 157 of the Italian Data Protection Code, which went unanswered. On 31 March 2026, the DPA opened proceedings. In its defence of 5 May 2026, the controller argued that it had failed to reply because of a handover between its former internal DPO and a new external one as of 1 January