TL;DR for the DPO
Decision no. 419/2026: EUR 55,000 fine to AgID for breaching Arts. 5(1)(a)(b) and 5(2), 12, 14 and 25 GDPR, with publication of the order on the DPA's website. In short: lawfulness and purpose limitation, information to people whose data was NOT collected directly (Art. 14), and privacy by design. If it happens to the agency writing the technical rules of digital government, no public body can feel safe.
The three points that matter
- Art. 14 is the great forgotten duty: when data comes from other sources (databases, other bodies, vendors) the notice is due anyway, within precise timeframes. It is the typical breach of projects that 'reuse' available data.
- Privacy by design (Art. 25) enforced against a public body: compliance must be designed before launching platforms and services, not patched afterwards. Twice as true for public digital projects.
- The public sanction weighs more than the EUR 55,000: publishing the order on the DPA's website is an accessory reputational sanction hitting institutional credibility.
What to do now, in practice
If you advise public bodies or their vendors: 1) for every project reusing data from other sources, check the Art. 14 notice exists and was given in time; 2) require the privacy assessment BEFORE launch (documented by design, not declared); 3) use this case in public-sector training: it is the perfect answer to 'we are a public body, it will not happen to us'.
Why it matters for your clients
The value of the case is both symbolic and practical: the authority applies the same rules to everyone, including the body coordinating the State's digital transformation. For a DPO working with the public sector it is leverage to obtain what is often postponed: complete notices on reused databases and design assessments actually done before go-live. The full text of the order on the DPA's website clarifies the specific context of the processing at issue.
Official source:Italian Data Protection Authority - injunction order no. 419 of 28 May 2026 (AgID)Looking for a workspace for your DPO work?
DPO Workspace is built by a certified DPO. 30-day free trial.
Start free
