What happened
A customer received promotional text messages from Barbuti Spa, a menswear company, with no indication of how to stop them. He wrote to the company's email address for public enquiries: an automatic acknowledgement came back, then nothing, and the texts continued. With decision no. 644 of 23 September 2026, announced in the 29 October newsletter, the Italian Garante fined the company €5,000.
During the investigation the company blamed an organisational problem: the mailbox the customer used was not staffed by people handling privacy requests. That is exactly what the Garante rejected: having a dedicated address in the privacy notice does not excuse a company from recognising and handling requests that arrive through other company channels.
The two rules the decision restates
- Every promotional text must give a suitable way to object easily: a link, an email address or the option to reply "stop".
- An erasure or objection request is valid even if it reaches an address other than the one in the privacy notice: whoever receives it must pass it to whoever handles it.
- An auto-reply is not a reply: the one-month deadline (Art. 12(3) GDPR) still runs, and the messages must stop.
In addition to the fine, the Garante ordered the company to bring its promotional messages into line with the Italian Privacy Code and to report on the measures taken within 30 days of notification.
The check to run today on every client sending texts or newsletters
Open the last promotional text sent: is there a simple way to stop the messages? Then list the mailboxes the public can use — info@, contact@, support, social media, website form — and ask who reads them. Each needs a written rule: privacy requests are forwarded to the contact at once, within the day, and logged. The unsubscribe must also reach the platform that sends the texts.
The case confirms that the problem with data subject requests is rarely a wrong answer: more often it is the request no one sees. Companies with many mailboxes and several marketing suppliers are the most exposed, because an unsubscribe recorded in one system does not reach the others.
In DPO Workspace the document generator now has the "Data subject request procedure", with steps, deadlines and the rule on non-dedicated channels, and the "Rights request form"; requests received are logged in the client's "Requests" tab, which calculates the deadline.
Official source:Garante per la protezione dei dati personali — Newsletter n. 555 del 29 ottobre 2026Official source:Garante per la protezione dei dati personali — provvedimento n. 644 del 23 settembre 2026 [doc. web 10312650]Looking for a workspace for your DPO work?
DPO Workspace is built by a certified DPO. 30-day free trial.
Start free
