The Italian Data Protection Authority published on November 10, 2026 a decision dated September 23, 2026 imposing an administrative fine of EUR 5,000 and a compliance order on Barbuti S.p.A. for failing to handle an erasure request and continuing promotional messages, in breach of Articles 5(2), 12 and 17 GDPR and Article 130 of the Italian Data Protection Code. The decision (docweb 10312650) is reported by the European Data Protection Board.
Italian retail and e-commerce companies running SMS or email promotional marketing, EU consumer brands marketing to Italian consumers via direct messaging, Italian marketing service providers and SMS platforms handling promotional campaigns, and DPOs and privacy compliance leads at Italian consumer-facing companies must immediately audit erasure-request and promotional-marketing workflows so that a request received through any controller-provided channel is treated as valid and actioned, and so that promotional messages carry the contact details that let recipients exercise data protection rights. Otherwise, non-compliance with GDPR data subject rights obligations risks administrative fines under Article 83(4) (up to EUR 10 million or 2% of global annual turnover) and compliance orders requiring remediation within a set period.
- Authority : Italian Data Protection Authority
- Entity : Barbuti S.p.A.
- Measure and amount : administrative fine of EUR 5,000, plus a compliance order
- Legal basis : Articles 5(2), 12 and 17 GDPR, and Article 130 of the Italian Data Protection Code
- Decision date : September 23, 2026 (EDPB publication November 10, 2026)
- Appeal or compliance window : report the measures adopted to the authority within 30 days of notification of the decision
- Official source : Italian DPA decision, docweb 10312650
What happened
An individual complained after promotional text messages from Barbuti S.p.A. continued following an erasure request sent to the general contact email, the only address the messages gave. The company sent an automatic acknowledgement and neither answered nor stopped the messages. The order requires promotional communications to meet Article 130(5) of the Italian Data Protection Code, with a report within 30 days of notification of the September 23, 2026 decision.
The breach
The right to erasure, named the right to be forgotten in Article 17 GDPR, is the data subject's right to obtain erasure of personal data. The authority concluded that Barbuti S.p.A. infringed Article 5(2) GDPR (accountability), Article 12 GDPR and Article 17 GDPR, together with Article 130 of the Italian Data Protection Code.
Under EDPB Guidelines 01/2022, a request on a channel the controller provides is generally valid even if it is not the privacy notice's preferred channel. The messages continued without a valid legal basis and without contact details for exercising rights. The fine is EUR 5,000. See Regulation (EU) 2016/679.
Who else is in the same regime
Anyone sending promotional SMS or email to people in Italy under those provisions is in the same regime, including a brand established outside Italy. Across its registers, Obsidian tracks texts under GDPR in 10 jurisdictions, as of November 2026.
What to check now
- Treat an erasure request on any controller-provided channel, including a general inbox, as valid.
- Search marketing lists, erase or record a grounded refusal, and reply under Article 12 GDPR.
- Stop promotional SMS and email, including lists at an SMS platform, once erasure is requested and no other legal basis remains.
- Add the contact details Article 130(5) of the Italian Data Protection Code requires on each promotional message.
Per-jurisdiction monitoring surfaces a decision of this kind when the authority publishes it.
