The Italian data protection authority (Garante per la protezione dei dati personali - GPDP) today published a sanction decision against the company Action Fit, including the imposition of a fine of €3,930, for breaches related to sending commercial communications without a legal basis and non-compliance with the right to object.

Facts and context

The procedure was initiated following a complaint from a former gym client who continued to receive promotional emails despite repeated unsubscribe requests.

Grounds for the decision

• Lawfulness of processing obligation (Article 6(1)(a) of the GDPR and Article 130 of the Italian Code): The authority found that the company sent at least six promotional emails to the complainant without a valid legal basis. It recalls that, pursuant to Directive 2002/58/EC transposed by the Italian Code, consent is required for such communications. The controller was unable to prove, as required by Article 7 of the GDPR and the European Data Protection Board (EDPB) Guidelines 5/2020, that valid consent had been obtained, the burden of proof lying with them.
• Obligation to respect the right to object (Article 12 and Article 21(2) of the GDPR): The company did not comply with the complainant's objections made via the unsubscribe link and a formal email. By continuing to send commercial communications after these requests and failing to provide a response within one month, the controller violated obligations related to the exercise of data subject rights.
• Obligation to cooperate with the supervisory authority (Article 157 of the Italian Code): The controller did not respond to the formal information request sent by the authority on 28 January 2026, thus failing in their duty to cooperate. The authority considered this failure a separate infringement and calculated a specific sanction for this violation.

Authority's decision

Consequently, the authority imposed a fine of €3,930 on Action Fit.

Furthermore, the authority ordered the company to bring its processing into compliance, to cease all commercial communications to the complainant's email address, and to provide a response confirming the acknowledgment of the objection.

Lessons learned

This decision reminds that:

• The burden of proof for obtaining valid consent for commercial prospecting always lies with the controller.
• Mechanisms to object to commercial prospecting, such as unsubscribe links, must not only be available but also technically and organizationally effective to ensure an effective stop to communications.
• Failure to cooperate with a supervisory authority, including not responding to an information request, constitutes a separate violation that may be subject to a financial penalty in addition to that imposed for substantive breaches.
• Any request to exercise rights, including an objection, must receive a formal response addressed to the data subject within the prescribed time limits, informing them of the measures taken.