Italy

The Garante fined the bank EUR 33,000 because its privacy notice for BancoPosta loans did not correctly identify Poste Italiane as a recipient and autonomous controller of applicants' data, and ordered it to update the notice within six months. The related Poste Italiane fine is a separate record.

The Garante fined Poste EUR 48,000 because its privacy notice for BancoPosta loans, developed with Deutsche Bank, did not identify the recipients of applicants' data, after a Poste employee complained that her income and financial commitments were visible to Poste staff. It found Poste and the bank were autonomous controllers rather than controller and processor. The related Deutsche Bank fine is a separate record.

The Garante fined the publisher of the weekly Giallo EUR 9,380 for printing images of the victim's body and the family home in the Garlasco case that were not essential to the story and offended her dignity. A YouTube channel was fined EUR 1,000 in a separate decision of the same date. Details come from the press release of 16 October 2026.

ANAC fined the general secretary of a municipality EUR 10,000 for signing two disciplinary sanctions against an employee who had made whistleblowing reports. The courts had annulled both sanctions, and ANAC reopened its suspended proceedings after the judgment became final on 18 August 2026. The mayor had been fined EUR 5,000 under Delibera 426 of 25 September 2024.

ANAC fined each member of the management body EUR 15,000 for questions that risked revealing the identity of an employee who had used the company's internal reporting channel. It archived a separate charge of failing to follow up the report. A court has declared the whistleblower's later dismissal retaliatory and void, though that ruling is not final.

Fined EUR 18,000 for failing to notify Consob that his indirect holding in EEMS Italia S.p.A. (now OPS Italia S.p.A.) crossed above 5% (6.18%) on 9 June 2025 and fell below it the next day. The breach was found negligent and he submitted no defence.

The Garante fined the company EUR 8,000 for video surveillance covering the changing-room lockers of a swimming pool without an adequate legal basis, deficient notices to users and workers, and keeping images for 72 hours without a documented need.

The Garante fined the health authority in Udine EUR 24,000 because its electronic health record had no access limits or alerts, so staff not treating a patient viewed her health data. The amount comes from the Garante newsletter of 11 September 2026; the amount is redacted in the decision text (doc-web 10293994) and an opposition is pending.

The Garante fined the Italian branch of BBVA EUR 5,508,000 for continuing to send in-app promotional notifications to a customer for months after he objected, for not handling his objection and rights request properly, and for giving him inaccurate information about whether notifications could be switched off. The fine was increased partly because of an earlier decision against the same bank, and the bank was ordered to improve how it handles data subject rights.

Consob found that the four traded Falck Renewables shares between July and August 2021 while holding inside information on the sale of Falck's stake. Fines were EUR 500,000 (Daniela Gnutti), EUR 500,000 (Silvana Gnutti), EUR 50,000 (Marco Landi) and EUR 100,000 (Andrea Ruggeri Gnutti), with interdictions of 24, 24, 5 and 10 months and confiscation of profits for three of them. All four filed oppositions with the Brescia Court of Appeal on 5 October 2026.

As former chief executive, fined EUR 850,000 and barred for 36 months under art. 144-ter(3) TUB for deficiencies in risk governance and management affecting the bank's capital position, in the Banca d'Italia order of 28 July 2026.

Following inspections from 31 October 2024 to 4 April 2025, the Banca d'Italia fined 17 named former board members, statutory auditors and heads of risk, compliance and internal audit for risk governance, capital and control failures. Fines range from EUR 70,000 to EUR 850,000 per person, totalling EUR 3,140,000; the 36-month interdiction applied to the former chief executive only, who is entered separately. Ten of those fined have filed oppositions with the Rome Court of Appeal.

The Garante fined the regional employment agency EUR 30,000 for publishing online the names of about 700 people in a ranking used for a hiring call-up, which it found had no legal basis.

The Garante fined an individual EUR 4,950 for publishing an audio file and chat content from a private conversation of a public figure beyond what was essential; the fine was reduced because no declared taxable income was found for the reference year.

Two same-day fines on the company: EUR 75,000 (measure 201) for organisation and control shortcomings on transparency, specifically the application of undue charges, and EUR 48,000 (measure 200) for deficiencies in risk governance, management and control, both found in an inspection from 21 October 2024 to 31 January 2025. No individuals were sanctioned and the company has opposed both before the Rome Court of Appeal. The second measure is at https://www.bancaditalia.it/compiti/vigilanza/provvedimenti-sanzionatori/documenti/2026/Sigla_Srl_provv_200_del_01_07_2026.pdf. Amount shown is the sum of the two fines.

Fined EUR 65,000 for organisational and control deficiencies in banking transparency, relating to the application of charges not due to customers. Inspections ran from 4 November 2024 to 14 February 2025. No individuals were sanctioned.

Fined EUR 40,000 after inspections from 10 February to 30 April 2025 found AML shortcomings in customer due diligence, active cooperation (suspicious-activity reporting) and controls. The irregularities were found to have persisted over time.

The Banca d'Italia fined the crowdfunding platform operator EUR 26,000 for deficiencies in risk governance, management and control found in an inspection from 24 February to 13 May 2025. No individuals were sanctioned.

The Banca d'Italia fined the intermediary EUR 40,000 for deficiencies in risk governance, management and control with effects on its supervisory reporting, found in an inspection from 21 October 2024 to 31 January 2025. The company submitted no observations on the proposal and no individuals were sanctioned.

Fined EUR 30,000 for deficiencies in governance, management and risk control with serious effects on its financial position and the regularity of its money remittance activity, following inspections from 25 February to 9 May 2025. The company filed no counterarguments.

The Garante fined the telecom operator EUR 1,715,600 after two unauthorised access incidents, in which attackers posing as technical support persuaded staff at two retail stores to give them system access, exposed data of over 365,000 customers (payment details for 41,359); it cited weak credential and certificate management and security checks that missed vulnerabilities. Details come from the Garante newsletter of 16 July 2026; the decision text was not opened.

The Banca d'Italia fined the servicer EUR 30,000 for breaching rules on organisation and internal controls. No individuals were sanctioned and the company opposed the measure before the Rome Court of Appeal in June 2026.

The Banca d'Italia fined the company EUR 30,000 under art. 190 TUF for erroneous prudential reports sent to the supervisor, found in an inspection from 30 September 2024 to 28 February 2025. No individuals were sanctioned.

Two same-day fines of EUR 100,000 each on the bank: measure 112 for AML shortcomings in customer profiling, due diligence and active cooperation (the supervisory service had proposed EUR 130,000), and measure 111 for deficiencies in governance and risk controls, both found in inspections from 1 October 2024 to 24 January 2025. No individuals were sanctioned. The second measure is at https://www.bancaditalia.it/compiti/vigilanza/provvedimenti-sanzionatori/documenti/2026/Cherry_Bank_Spa_provv_111_del_21_04_2026.pdf. Amount shown is the sum of the two fines.

The Italian competition and consumer authority fined the Revolut entities EUR 5 million for misleading advertising of investment services, EUR 5 million for aggressive and misleading handling of account suspension, restriction and blocking, and EUR 1.5 million for unclear information on getting an Italian IBAN. The decision number and date were not on the press release, so action_date is the press release date of 2 April 2026. Amount shown is the sum of the three fines.

Two same-day fines of EUR 30,000 each on the bank: measure 89 for AML organisation and control shortcomings (profiling, due diligence, active cooperation) and omitted suspicious transaction reports, and measure 88 for deficiencies in risk governance, management and control affecting its capital position. The bank filed no counter-arguments. The second measure is at https://www.bancaditalia.it/compiti/vigilanza/provvedimenti-sanzionatori/documenti/2026/Banca_Progetto_Spa_in_a.s._provv_88_del_30_03_2026.pdf. Amount shown is the sum of the two fines; this is separate from the 28 July 2026 measure already on file.

The Garante fined the energy group EUR 96,000 for publishing on its website a full court summons that exposed the names, birth details, tax codes and addresses of twelve citizens who had joined environmental groups in a climate lawsuit, without a valid legal basis.

The Banca d'Italia fined the bank EUR 50,000 for shortcomings in managing credit lines connected to the Pharmex Group, found in inspections from 4 November 2024 to 24 January 2025. No individuals were sanctioned.

The Garante fined the portal EUR 5,000 for publishing a woman's phone number and workplace in ads without her knowledge and for not checking that those posting contact details were entitled to, and ordered it to introduce checks. Details come from the Garante newsletter; the decision text was not opened.

The Garante fined the energy supplier EUR 563,052 for telemarketing without a valid legal basis, including offers made to customers during service calls and to customers who had refused marketing, and for inadequate control of its partners, and ordered it to bring its data processing into line with the GDPR. The decision lets the company close the matter by complying and paying half the fine within 30 days (art. 166(8) Codice privacy); this option follows the order and is not a settlement.

The Banca d'Italia fined the payment institution EUR 45,000 for deficiencies in internal organisation and controls found in an inspection from 21 October 2024 to 31 January 2025, noting its corrective action. No individuals were sanctioned.

The Banca d'Italia fined five people connected to Banca Profilo for AML failings found in an inspection from 16 September to 20 December 2024: former CEO Fabio Candeli EUR 180,000, former AML head Luca Gandolfi EUR 48,000, board of statutory auditors chair Nicola Stabile EUR 35,000, and auditors Gloria Francesca Marino and Maria Sardelli EUR 28,000 each. They have opposed the measure before the Rome Court of Appeal. Amount shown is the total of the five fines; the bank's own fine is a separate record.

The Garante fined the energy supplier EUR 2 million over serious violations affecting more than 1,200 customers: contracts concluded from inaccurate data without customers' request, inadequate oversight of door-to-door agents (some used forged signatures), a weak recall system and late or missing replies to rights requests. Details come from the press release of 10 March 2026; the decision text was not opened.

The Banca d'Italia fined the company EUR 30,000 for deficiencies in enhanced customer due diligence found in inspections from 14 October to 20 December 2024. No individuals were sanctioned.

Two same-day fines on the bank: EUR 130,000 (measure 28) for AML organisation and control shortcomings in profiling, due diligence and suspicious-activity reporting, found in inspections from 2 September to 13 December 2024, and EUR 100,000 (measure 27) for organisation and control deficiencies especially on credit risk. No individuals were sanctioned. The second measure is at https://www.bancaditalia.it/compiti/vigilanza/provvedimenti-sanzionatori/documenti/2026/Banca_Popolare_Pugliese_Scpa_provv_27_del_03_02_2026.pdf. Amount shown is the sum of the two fines.

The Banca d'Italia fined the bank EUR 190,000 for shortcomings in AML organisation, procedures and controls covering customer profiling, due diligence and suspicious-activity reporting, found in inspections from 16 September to 20 December 2024. The fines on individuals connected to the bank are a separate record.

Two same-day fines of EUR 330,000 each on the bank: measure 398 for shortcomings in transparency organisation and controls, and measure 397 for organisation and internal control deficiencies, particularly in the lending process. Inspections ran from 27 May to 18 October 2024 and no individuals were sanctioned. The second measure is at https://www.bancaditalia.it/compiti/vigilanza/provvedimenti-sanzionatori/documenti/2026/Cassa_di_Risparmio_di_Asti_Spa_provv_397_del_10_12_2025.pdf. Amount shown is the sum of the two fines.

The Banca d'Italia fined the bank EUR 160,000 for breaching transparency and fair-dealing rules, including applying charges to customers that Title VI TUB does not permit, found in checks from 26 November 2023 to 23 February 2024. No individuals were sanctioned.

The Garante fined the utility EUR 300,000 for a customer area that let anyone register in a customer's name with a tax code and any email, marketing without a valid legal basis (pre-ticked consent boxes) and breach of storage limitation. Details come from the Garante newsletter of 17 December 2025; the decision text was not opened.

The Garante fined the company EUR 400,000 for sending promotional SMS after objection, handling opposition requests late, treating a quote request as marketing consent and keeping prospect data for 12 months, and ordered deletion of unlawfully collected data. Details come from the Garante newsletter of 17 December 2025; the decision text was not opened.

In place of a fine, and after the cooperative told the Banca d'Italia it intended to accept the supervisory service's proposal, the Banca d'Italia ordered it to eliminate AML infringements in organisation and controls, customer due diligence, record keeping and active cooperation, and not to repeat them. If it does not comply by the deadline set (redacted in the published text), the pecuniary sanction under art. 62(1) becomes applicable. No amount is entered because none was imposed.

The Banca d'Italia fined the firm EUR 40,000 for breaches of governance, internal control, conflict of interest and related-party rules found in a Consob inspection from 20 June 2023 to 21 June 2024. The separate fines on two officers are a separate record.

The Banca d'Italia fined two officers of Directa SIM for breaching rules on conflicts of interest with related parties, which exposed the firm to significant legal and reputational risk (Consob inspection 20 June 2023 to 21 June 2024): former co-CEO Giancarlo Marino EUR 85,000 and chairman Massimo Segre EUR 44,000. Amount shown is the total of the two fines.

The Banca d'Italia fined the bank EUR 310,000 for organisation and control deficiencies, particularly on credit risk, found in an inspection from 9 July to 11 October 2024. No individuals were sanctioned.