The Italian data protection authority (Garante) sanctions an online press publisher for a total lack of transparency and procedure in managing data subject rights, having ignored both the requests of a complainant and those of the authority.

Facts and context

The Italian data protection authority (Garante) issued a sanction decision against the Cultural Association “Quadrante Sud”, publisher of the online newspaper “Il Dispaccio”, including the imposition of a fine of €2,000 for breaches related to the obligation of transparency and respect for data subject rights.

The case originated from a complaint by a person concerning the persistent indexing, on the Google search engine, of a 2023 article linking her to a judicial case for which she has since been fully acquitted, damaging her reputation.

Grounds for the decision

The authority found several violations of the GDPR and national legislation, based on the following reasoning:

• Obligation to facilitate the exercise of rights and respond to requests (Article 12, paragraphs 2 and 3 of the GDPR): The controller provided no response to the de-indexing requests made by the complainant on 4 and 18 September 2025, in violation of the one-month deadline. The authority emphasizes that this omission persisted even after the complaint was filed, and that the subsequent removal of the article does not remedy the initial violation of the obligation to respond to the data subject.
• Obligation of transparency and information (Article 5, paragraph 1, point a), Article 12, paragraph 1 and Article 13 of the GDPR): The website contained no privacy policy informing individuals about the processing of their data for journalistic purposes. Furthermore, no dedicated contact point for exercising rights was available, forcing the complainant to find an email address on her own via the publisher's Facebook profile. The authority considered that a simple postal address in the footer is insufficient to facilitate the exercise of rights and recalled, citing the Article 29 Working Party Guidelines on transparency, that information must be centralized and easily accessible.
• Obligation to cooperate with the supervisory authority (Article 157 of the Italian Data Protection Code): The controller did not respond to the information request sent by the authority on 22 January 2026, although it was properly notified, thus failing in its duty to cooperate.

Authority's decision

Consequently, the authority imposed a fine of €2,000 on the Cultural Association “Quadrante Sud”.

Moreover, the authority ordered the association to bring its website into compliance by providing complete information on processing for journalistic purposes and by establishing dedicated and effective contact channels to ensure the exercise of data subject rights.

Lessons learned

This decision reminds that:

• The mere mention of a postal address on a website is not sufficient to fulfill the obligation to facilitate the exercise of rights; direct and easily accessible contact channels, such as a dedicated email address, must be provided.
• The information owed to data subjects must be centralized and easily accessible, in accordance with the guidelines of the European Data Protection Board; a mechanism that forces the user to complex searches or redirects them to irrelevant pages is contrary to the principle of transparency.
• The subsequent removal of disputed content does not exempt a controller from responsibility for failing to respond to a data subject's requests to exercise rights within the deadlines provided by the GDPR.