Italy’s Garante is one of the most aggressive data regulators in the EU, and its fine list has a very particular shape. Strip out the famous AI cases – the 2023 ChatGPT block and the Garante’s AI fines – and what is left is dominated by two themes most other regulators barely touch: unsolicited telemarketing and management of workers by algorithm.
This is the registry of those GDPR fines: the telecoms and energy giants punished for phone-marketing people who never consented, and the gig-economy platforms fined for letting an algorithm rate, rank and penalise riders. Every figure links to the regulator or the EU mirror of its decision.
Why telemarketing dominates the Italian list
In Italy, unsolicited marketing calls are a genuine social plague, and the Garante has spent years going after it – with dedicated sections of its annual report on illegal telemarketing in the telecoms sector, the energy sector and beyond (Garante, Relazione 2024). The recurring violations are the same across every case:
- calling people who never gave consent, or who were on the public opt-out register (the Registro Pubblico delle Opposizioni);
- buying contact lists from third parties without checking how that consent was obtained;
- failing to control an outsourced sales network that generated calls – sometimes from fake or unregistered phone numbers, sometimes on forged contracts.
The second Italian speciality is newer and more forward-looking: the Garante fined companies early for algorithmic management – using an automated system to score and discipline gig workers without transparency or a right to human review.
Quick guide to the GDPR provisions below:
- Art. 5–6 – the principles and the need for a valid lawful basis (here, almost always consent for marketing).
- Art. 13–14 – telling people clearly how their data is used.
- Art. 22 – the right not to be subject to purely automated decisions with significant effects – the heart of the gig-worker cases.
- Art. 25 – data protection by design and by default.
- Art. 28 – a controller’s duty to control its processors (the outsourced call centres and sales agencies).
The registry – 2026 decisions by amount, then the largest earlier fines
1. Enel Energia – €79,100,000 – 8 February 2024 – Italy’s record GDPR fine
The largest GDPR fine the Garante has ever imposed. Four companies promoted Enel’s electricity and gas contracts without any authorisation from Enel, using forged identification badges and Enel’s own contract forms; Enel then used the personal data tied to at least 9,300 contracts obtained this way. The Garante found Enel had failed to control the agencies operating in its name.
Articles. Articles 5(1)(f) and 32 (security of the “N.Eve” sales platform and its shared log-ins), Articles 5(2), 24(1) and 25 (accountability, privacy by design) and Article 28 (failure to control processors) (Garante – decision).
Status. UPHELD AT FIRST INSTANCE. Enel challenged the decision, and the Rome court rejected the opposition, confirming the Garante’s decision no. 81 of 8 February 2024 in full – judgment no. 12783/2025 (case R.G. 14089/2025), published 18 September 2025. A further appeal against the decision is pending. The exact amount is €79,107,101 (Garante).
Source: DataGuidance – Garante fines Enel Energia €79.10M.
2. Intesa Sanpaolo – €31,800,000 – 26 March 2026 – SUSPENDED BY A COURT
What happened. The Garante found serious shortcomings in how Italy’s largest bank protected personal data, attributing them to technical and organisational measures that were not adequate. Italian trade press reports that a branch employee looked up customers’ banking records thousands of times with no work reason, over more than two years; those details come from the press, not from the decision, because the text is no longer public.
Decision. €31,800,000 – provvedimento no. 208 of 26 March 2026, announced 30 March 2026.
Status. SUSPENDED. The Garante has taken the decision off its website: on 13 July 2026 the Turin court, by interim order, suspended its enforceability while the challenge is heard.
Source: Garante – notice on decision no. 208/2026.
3. Intesa Sanpaolo (Isybank) – €17,628,000 – 12 March 2026 – UNDER CHALLENGE
What happened. The bank profiled customers without a proper legal basis in order to pick which of them to move automatically into Isybank, its wholly owned digital bank: customers aged 65 or younger, regular users of digital channels, without investment products and with small balances. Around 2.4 million people were affected. Moving the accounts changed contract terms unilaterally, and the notices went out badly – mostly over the summer, into the “archive” section of the Intesa Sanpaolo app, without push notifications or SMS.
Decision. €17,628,000 – provvedimento no. 163 of 12 March 2026.
Status. UNDER CHALLENGE. The text has been removed from the Garante’s website and the opposition proceedings are pending.
Source: Garante – notice on decision no. 163/2026.
4. TIM S.p.A. – €9,516,000 – 23 July 2026
What happened. Unlicensed call centres cold-called people in TIM’s name from numbers outside its official sales network, spoofing caller ID, and collected data from people who thought they were speaking to an authorised agent. Around 7,000 complaints came in during 2025, many about calls to numbers on the opt-out register. The Garante also found the company systematically mishandled people’s rights: access, erasure and objection requests went unanswered or late, and unsubscribing was needlessly hard.
Articles. Articles 5, 6, 7, 12, 15–22, 24, 25, 28 and 32 GDPR, plus Article 130 of the Italian Data Protection Code.
Status. In force, with orders to fix the callback process, tighten oversight of partners and rebuild the procedures for handling people’s rights.
Source: Garante – decision no. 556 of 23 July 2026.
5. Poste Italiane (€6,624,000) and Postepay (€5,877,000) – 17 April 2026 – SUSPENDED BY A COURT
What happened. The BancoPosta and Postepay apps required users to grant access to device data “to detect malicious software”, and blocked the app if they refused. That permission exposed which apps were installed and running, how often they were used and which mobile operator served the device; the processing ran through the ThreatMetrix anti-fraud platform, which scores transaction risk in real time. The Garante found the setup more intrusive than the purpose needed. The companies’ argument that European Banking Authority requirements and PSD2 compelled it was rejected.
Decision. €12,501,000 between them – provvedimento no. 237 of 17 April 2026.
Status. SUSPENDED. Removed from the Garante’s site under an interim order of the Rome court of 17 July 2026 suspending enforceability.
Source: Garante – notice on decision no. 237/2026.
6. BBVA (Italian branch) – €5,508,000 – 3 September 2026
What happened. A customer switched off promotional notifications in the bank’s app and then repeated the refusal to customer service – yet kept receiving marketing messages inside the app for seven months, from October 2025 to May 2026. The bank explained that the switch had been recorded by its internal systems but never synchronised with the customer-relationship unit that sends the marketing. Customer service, for its part, told the customer in December 2025 that the pop-ups could not be removed and could simply be ignored – an answer the Garante found contradicted by the bank’s own later fix, which blocked exactly those notifications. The Garante’s point: recording a customer’s “no” is not enough if the organisation cannot make it stick across all its systems.
Articles. Articles 5(1)(a), 12, 21 and 24 GDPR.
Why this amount. The Garante rated the seriousness of the breach as low under the EDPB’s fine-calculation guidelines, but counted two aggravating factors: customer service not trained to handle people’s rights, and an earlier decision against the same bank – no. 413 of 10 July 2025 – for answering an access request late. Fixing the problem during the investigation counted in the bank’s favour.
Status. Besides the fine, the bank was ordered to put measures in place so that people’s rights requests are handled correctly and on time. The decision can be challenged in an ordinary court.
Source: Garante – decision no. 613 of 3 September 2026 · Garante newsletter, 11 September 2026.
7. TIM – €27,802,946 – 15 January 2020
From January 2017 to early 2019 the Garante received hundreds of complaints about TIM’s unsolicited marketing calls – placed without consent, or in spite of the recipients being on the public opt-out register, plus invalid consents and excessive retention.
Articles. Article 5, Article 6/7 (consent) and transparency duties.
Source: Garante – TIM fined €27.8 million.
8. Enel Energia – €26,500,000 – 16 December 2021
A separate, earlier Enel case (do not confuse it with the €79.1M 2024 fine above). After hundreds of complaints about unsolicited calls made on Enel’s behalf – some using pre-recorded messages – the Garante fined Enel for aggressive telemarketing and breach of the accountability principle.
Status. ANNULMENT OVERTURNED – BACK IN COURT. In 2023 the Rome court annulled the Garante’s decision no. 443 in full (judgment no. 2615/2023). The ground was procedural rather than substantive: Enel did not contest the facts, but argued that the Garante had missed the 120-day deadline for notifying the alleged breaches set by its own Regolamento 2/2019, and the court treated that deadline as peremptory (Portolano Cavallo). The Garante appealed: on 8 July 2025 the Court of Cassation (judgment no. 18583/2025) set aside the annulment and sent the case back for a new hearing, which is still pending (Garante). In September 2026 the Garante reported three further Cassation judgments (nos. 22791, 24861 and 24862/2026) holding that the 120 days run from the moment the breach can be considered definitively established, not from the first information received (Garante newsletter, 11 September 2026).
Articles. Article 5 (accountability) and the lawful-basis and consent rules for marketing.
Source: Garante – Enel Energia fined €26.5 million.
9. Clearview AI – €20,000,000 – 2022
For scraping Italians’ facial images without a legal basis. Part of the cross-regulator story told in full in the Clearview AI fines registry.
Articles. Articles 5, 6 and 9 (no legal basis, special-category data) and data-subject rights.
Source: Clearview AI fines registry.
10. Wind Tre – €16,729,600 – 9 July 2020
The telecoms operator was fined for unlawful direct marketing – users received unsolicited texts, emails and automated calls without consent – and the Garante banned further processing of the data acquired without consent. (The same day, the Garante also fined Iliad €0.8 million – for a different failing: how its employees accessed traffic data.)
Articles. Article 5, Article 6/7 (consent) and Articles 13–14 (information).
Source: Garante – Wind fined €17 million and Iliad €0.8 million.
11. Vodafone Italia – €12,250,000 – 12 November 2020
For unlawfully processing the data of millions of users for telemarketing, after hundreds of complaints about unsolicited calls from Vodafone and its sales network. A striking finding: calls were placed from fake phone numbers not registered with the ROC, Italy’s official register of communications operators.
Articles. Articles 5 and 25(1) (no control over the chain collecting the data), Articles 6, 7 and 21 (consent and objection) and Articles 24 and 32 (security).
Source: Garante – Vodafone fined over €12 million.
12. Foodinho (Glovo) – €2,600,000 – 10 June 2021 – the algorithm case
A landmark. The Glovo-owned delivery platform Foodinho was fined for how its algorithm managed riders: it scored and ranked workers without telling them how the system worked, did not guarantee the accuracy of those algorithmic ratings, and provided no way for a rider to obtain human review or contest an automated decision. It was the Garante’s first decision on riders, aimed squarely at management by algorithm.
Articles. Article 5, Article 13 (transparency) and Article 22 (automated decision-making).
Source: Garante – no to algorithms causing discrimination; Glovo-group platform fined €2.6 million.
13. Deliveroo Italy – €2,500,000 – 2021
Issued in the same wave of scrutiny of gig-economy platforms. Deliveroo’s Italian arm was fined €2.5 million over how it handled riders’ data and the algorithm used to manage them – inadequate transparency about the automated systems that governed their work.
Articles. Article 5, Article 13 (transparency) and Article 22 (automated decision-making).
Source: Garante newsletter, 2 August 2021 – Deliveroo Italy fined €2.5 million.
Two patterns, one regulator
The Garante’s list tells you what Italy’s regulator actually cares about:
- Telemarketing is the bulk of the money. Enel (twice, including the €79.1 million record), TIM, Wind Tre, Vodafone – the biggest Italian fines are overwhelmingly about calling people who didn’t consent, and about companies failing to police the outsourced agencies and call centres acting in their name. If you run any kind of outbound marketing into Italy, this is the case law that applies to you.
- Algorithmic management was pioneered here. With the Foodinho and Deliveroo fines in 2021 the Garante said early that an automated system rating and disciplining workers is a GDPR matter – it needs transparency, accuracy, and a human a worker can appeal to. As AI moves into HR and hiring, these cases are the template.
For the Garante’s separate, equally pioneering AI line – the ChatGPT block and the OpenAI and Replika fines – see the dedicated Garante AI fines registry.
What this means if you operate in Italy
- Don’t call or message without provable consent – and check the opt-out register. Every telecom and energy fine above comes down to this. Consent must be specific, documented, and respected against the Registro Pubblico delle Opposizioni.
- You are responsible for your sales network. Enel’s €79.1 million fine was, at its core, for not controlling the agencies generating contracts in its name. “Our partners did it” is the opposite of a defence under Article 28.
- If an algorithm rates, ranks or penalises people, treat it as Article 22. Workers (and customers) have a right to know the logic, to accurate inputs, and to a human who can review the decision. Building an automated scoring system without those is exactly what cost Foodinho and Deliveroo.
The structural fix is unglamorous: clean, documented consent; real oversight of the third parties acting for you; and human review built into any automated decision that affects someone materially.
Sources for independent verification
- Garante – Relazione 2024 (official annual report) – dedicated sections on illegal telemarketing in telecoms, energy and other sectors.
- Garante – newsroom (English) – the regulator’s own decisions and press releases.
- EDPB national news – EU-level summaries of national decisions, including Italian ones.
- enforcementtracker.com – CMS Law’s registry, filterable to Italy.
Short conclusion
Italy’s Garante fines for two things almost no one else makes headlines over: unsolicited marketing calls and management by algorithm. The telemarketing fines – led by the €79.1 million Enel record – punish companies for calling people who never consented and for not controlling the agencies doing it; the Foodinho and Deliveroo cases made worker-rating algorithms a GDPR question before most regulators had noticed. If you market into Italy or automate decisions about people there, this is the list to read before, not after.