Barbuti fined EUR 5,000 over unanswered erasure request

According to “Italian DPA fines clothing company for failing to handle erasure request”, published on the European Data Protection Board (EDPB) website on 10 November 2026, Italy’s data protection authority imposed an administrative fine of EUR 5,000 on Barbuti S.p.A. in a decision dated 23 September 2026. The case concerns an individual who continued receiving promotional text messages after requesting erasure of their personal data. The request went to the company’s general email address because the messages did not explain how to exercise data protection rights. The company sent an automatic acknowledgement but subsequently failed to answer the request.

The EDPB account reports that the authority found organisational shortcomings in handling requests and cited the Board’s Guidelines 01/2022. According to this account, requests submitted through a channel provided by the controller should generally be considered valid and handled even when the channel differs from the preferred one identified in the privacy notice. The authority also found that the company had failed to respond to the erasure request, sent further messages without a valid legal basis and omitted suitable contact details for exercising rights. It therefore found infringements of Articles 5(2), 12 and 17 GDPR and Article 130 of Italy’s Data Protection Code.

The EDPB article also reports that the authority ordered the company to adopt measures to bring its promotional communications into compliance with Article 130(5) of the Code and to report to the authority on the measures adopted within 30 days of notification of the decision. The full decision was not consulted: the findings and obligations described have not been independently verified.