Italy's data protection authority, the Garante per la protezione dei dati personali, has fined Barbuti S.p.A. €5,000 after a customer's request to have their data deleted landed in a company mailbox meant for e-commerce queries, was never acted on, and was followed by more promotional text messages. The injunction order, no. 644 in the authority's register, was adopted on September 23, 2026. The Garante's page for the decision (doc. web 10312650) links it to the authority's newsletter of October 29, 2026.

The sum is small. The reasoning is not. The Garante held that a clear deletion request sent through a channel the company itself published counts, even when the company's privacy notice points to a different address. It also found that Barbuti's marketing texts identified the sender and nothing else, with no link, no dedicated email address and no "STOP" option through which a recipient could exercise their rights. Barbuti, registered at Piazza della Seta in Caserta, is a fashion retailer whose shops appear in the store directories of outlet centres such as McArthurGlen's La Reggia Designer Outlet near Caserta and Valmontone Outlet near Rome. The decision itself does not describe the company's business beyond references to e-commerce and a loyalty programme. Quotations from the decision below are PPC Land's translations from the Italian.

In Short

An Italian clothing retailer kept sending promotional text messages to a customer who had emailed to ask for their data to be deleted, because the email went to an inbox nobody checked for privacy requests. Italy's privacy regulator fined the company €5,000 and said a clear request sent to any address the company publishes should be handled or forwarded, not ignored. The decision also says every marketing text must include a way to exercise data rights, such as a link, a dedicated email address or a "STOP" reply option, and Barbuti has 30 days from notification to report what it has changed.

A request sent to the shop inbox

The case began with one person. According to the decision, the complainant had received promotional text messages from Barbuti on their mobile phone "without any possibility of deletion through that communication channel." On June 7, 2024, they emailed a specific request to have their data deleted to site@barbuti.it, the company's ordinary email address. That request, according to the decision, "remained without a reply."

The texts did not stop. The complainant reported further promotional communications on December 7, 2024, November 21, 2025 and January 10, 2026. A complaint followed on January 23, 2026. The Garante logged it on January 27 and the complainant regularised it with a note dated February 27, 2026. By the time the authority wrote its first letter to the company, almost 22 months had passed since the deletion email.

The Garante's office sent a request for information under Article 157 of the Italian Privacy Code on April 3, 2026. Barbuti replied that, because of an "internal mix-up," the complainant's request had not been correctly recorded in its management systems, and that it had removed the person's number from its sending lists. The authority was not satisfied with that answer and, on April 27, 2026, asked what kind of mix-up it had been, offering technical, organisational or human error as examples.

What Barbuti told the Garante

The company's second reply described an organisational failure. The complainant, according to Barbuti, had used a mailbox "originally intended for the management of activities connected with e-commerce and, more generally, requests of an informational nature." The company pointed out that the "Contact us" form also carries a link to its privacy policy, where the email addresses of the data controller and of its data protection officer are listed. No person had been "specifically designated" to monitor the "contact us" mailbox for data protection requests. Together, those circumstances produced what the company called the "failure to register the objection in the company's systems."

Barbuti listed the corrective steps it had taken. It had identified, instructed and trained staff to monitor company mailboxes for requests from people exercising their data protection rights. It had introduced internal procedures for the classification, traceability and prompt assignment of communications received through digital channels. It also said it intended to carry out a systematic review of its databases to delete "contacts that can no longer lawfully be processed for marketing purposes, because they have expired or do not comply with current regulatory requirements." The decision does not say how many contacts that review covers or whether it has been completed.

The complainant did not respond to the company's statements.

On June 3, 2026, the Garante opened formal proceedings under Article 166(5) of the Privacy Code. It alleged three sets of violations: a breach of the accountability principle in Article 5(2) of the GDPR, for lacking the measures needed to handle rights requests properly; breaches of Articles 12 and 17, for failing to answer the deletion request; and a breach of Article 130 of the Privacy Code, the Italian provision that transposes the ePrivacy Directive rules on unsolicited communications, for sending promotional messages without consent.

Barbuti's written defence, dated June 25, 2026, added one new claim. The company stated that the complainant's mobile number had been collected when they signed up to its "fidelity" loyalty programme, which they joined voluntarily, giving consent to receive dedicated offers for marketing and for profiling purposes. Joining the programme, according to the defence, required reading the privacy notice published at barbuti.it, and the company said that the complainant had thereby "declared that they had read the communication channels indicated in the notice on page 7," namely the controller's address, info@barbuti.it, and the data protection officer's. The Garante recorded that this claim about the original consent was made "albeit not documented."

The inbox question

The central legal issue was whether a deletion request sent to the wrong address is still a request. The Garante checked Barbuti's website itself and confirmed what the company had said: the site does distinguish between the channel for exercising data protection rights, set out in the privacy notice, and the channel for general information requests.

That did not settle the matter in Barbuti's favour. The authority turned to the European Data Protection Board's Guidelines 01/2022 on data subject rights, which it quoted at length. According to the passage cited in the decision, the EDPB "encourages controllers to provide the simplest and most appropriate communication channels" so that a person can submit a valid request. "If, however, a data subject submits a request using a communication channel provided by the controller, different from the one indicated as preferable, that request is, in general, considered valid and the controller should handle it accordingly," the guidelines state, adding that controllers "should make every reasonable effort to facilitate the exercise of the data subject's rights." That effort, according to the same paragraphs, includes "mechanisms to improve internal communication between employees about requests received by people who may not be competent to deal with them."

The guidelines also contain a limit, and the Garante quoted it too. A controller "is not required to act on a request sent to a random or incorrect email (or postal) address not directly provided by the controller, or to a communication channel clearly not designated to receive requests concerning the data subject's rights, if the controller has provided an appropriate communication channel that the data subject can use."

Barbuti's position sat close to that second passage: the e-commerce inbox was, on the company's account, not designated for privacy requests, and an appropriate channel existed. The Garante did not accept that reading. It found that the complainant, "while using a channel other than the one indicated as preferable, made a clear and precise request that, with reasonable effort and appropriate measures in place, the controller could easily have redirected to the competent office, or answered by asking the data subject to take that step." The decision describes site@barbuti.it as the company's own ordinary email address, which Barbuti said served e-commerce and information requests. It does not explain in any more detail why the "clearly not designated" exception in the guidelines did not apply.

The authority went further. It found that Barbuti lacked measures to redirect rights requests sent to the wrong channel, "whereas the implementation of the most basic technical and/or organisational measures, including adequate staff training (as the Company in fact subsequently did), would certainly have favoured the correct handling of the request." The company's own remedial steps, in other words, were read as evidence of what had been missing.

There was a detail in the handling that made matters worse. According to the decision, the complainant first received an automated reply confirming that the request had been taken in charge, "thereby creating a reasonable expectation that some response would follow," and then received no specific or formal answer at all. Article 12 of the GDPR requires a controller to tell a person what it has done about a request under Articles 15 to 22, which run from the right of access to the rules on automated decision-making, without undue delay and within one month at the latest. Article 17 requires deletion without undue delay where consent is withdrawn or the person objects. The Garante found both provisions breached.

Texts that named the sender and nothing else

The second strand of the decision concerns the messages themselves. The Garante observed that the complaint arose from promotional SMS messages that carried no indication of a channel through which a recipient could easily and quickly object, withdraw consent or ask for deletion. It cited Articles 7(3), 17 and 21(3) of the GDPR, noting that the relevant right depends on whether the marketing rested on consent or on another legal basis.

Under the accountability principle, according to the decision, a controller "taking into account the state of the art" must put in place specific measures to make it easier to exercise data rights, including for commercial communications sent by SMS. The Garante listed what those measures could look like, "purely by way of example and not exhaustively": "a hyperlink to the controller's website, a specific dedicated email address, or an indication in the SMS itself of a 'STOP' option for simple deletion." It cross-referenced Article 130(5) of the Privacy Code.

Article 130 frames the rest of the analysis. Promotional SMS messages fall under the regime that originates in Directive 2002/58/EC and is transposed in Title X of the Italian Privacy Code. Article 130(2) allows such messages only with the consent of the subscriber or user. Article 130(5) adds a second condition: every commercial communication must indicate a suitable contact point where the recipient can exercise the rights in Articles 15 to 22 of the GDPR. Barbuti's texts, according to the decision, "merely indicated the identity of the sender without, however, providing a suitable contact point at which it was possible for the data subject to exercise their rights."

The messages sent on November 21, 2025 and January 10, 2026 arrived after the complainant had expressed "a wish diametrically opposed" to receiving them. The Garante concluded that they were sent without a valid legal basis, in breach of Article 130, citing its own earlier decision of October 17, 2024 (doc. web 10108041). On the Garante's reading, whatever consent the loyalty programme sign-up may have produced no longer covered messages sent after the request.

Why the fine was €5,000

Because all the violations stemmed from a single course of conduct, the Garante applied Article 83(3) of the GDPR, which caps the total at the amount for the most serious violation. The relevant ceiling, under Article 83(5), was €20 million. The fine imposed is 0.025 per cent of that ceiling, by PPC Land's calculation.

The authority rated the seriousness of the violation as low, citing point 60 of the EDPB's Guidelines 04/2022 on the calculation of administrative fines, in the version of May 24, 2023. Its reasons were narrow: although the case stemmed from a lack of accountability in the procedures for handling rights requests, it concerned "common data relating to a single data subject, and the unwanted commercial communications established were only three over more than a year." The conduct was attributed to negligence, not intent.

The Garante said it had also considered the company's turnover, which the decision does not disclose, and listed five further circumstances:

  • Barbuti promptly deleted the complainant's data and took steps to prevent a repeat.
  • The conduct was negligent.
  • There were no relevant previous violations by the company.
  • The company showed a "high degree of cooperation" during the investigation.
  • The design of Barbuti's website, according to the decision, was "clear about the channels to use to exercise data protection rights."

That last point is notable. The same website structure that separated the privacy channel from the e-commerce inbox, and so helped produce the missed request, was counted as a mitigating factor under Article 83(2)(k).

The Garante also imposed the ancillary sanction of publishing the injunction on its website, a measure it justified "by reason of the particular wrongfulness of the violations found." The decision does not reconcile that wording with its earlier finding that the seriousness of the violation was low. It also ordered that the violations and measures be entered in the authority's internal register under Article 57(1)(u) of the GDPR, which means they will be on record if Barbuti appears before the authority again.

What Barbuti must do now

The operative part of the decision contains four instructions. First, it declares the processing unlawful for breach of Articles 5(2), 12 and 17 of the GDPR and Article 130 of the Privacy Code. Second, under Article 58(2)(d) of the GDPR, it orders Barbuti to adopt measures ensuring that its promotional activities fully comply with Article 130(5), the contact-point requirement. Third, it requires the company to tell the Garante, within 30 days of notification, what it has done to implement that order. Fourth, it orders payment of €5,000 within 30 days of notification.

Italian law offers a discount. Under Article 166(8) of the Privacy Code, Barbuti can close the matter by paying half the fine, €2,500, within the deadline for an appeal. It can also challenge the decision before the ordinary courts within 30 days of notification. No corrective measure was imposed concerning the complainant's own data, because the company had already deleted it.

The decision is signed by Garante president Pasquale Stanzione, by vice-president Ginevra Cerrina Feroni, who acted as rapporteur, and by secretary general Luigi Montuori.

Gaps and inconsistencies in the decision text

The published text contains several errors and loose ends that affect how precisely the facts can be stated.

  • Email or SMS. The account of the complaint refers to "the promotional email of December 7, 2024." The notice opening proceedings then charges Barbuti with sending "promotional emails" without consent, "with reference to those text messages" sent despite the request, and lists December 7, 2024, November 21, 2025 and January 10, 2026 as at least three of them. The final reasoning calls the November and January messages SMS. The decision never settles whether the December 2024 message was an email or a text.
  • A year out of place. Barbuti's second reply is dated May 12, 2025 and logged on May 13, 2025, although it answers a request the Garante sent on April 27, 2026. The year is almost certainly 2026.
  • "Of the Regulation." The corrective order refers to compliance with "Article 130, paragraph 5 of the Regulation." The GDPR has 99 articles; Article 130 belongs to the Italian Privacy Code, which the rest of the decision correctly cites.
  • No reply, or an automated one. The opening section says the deletion request "remained without a reply," while the reasoning says the complainant received an automated acknowledgement and no substantive answer. The two statements are compatible only if "reply" means a substantive one.
  • The loyalty consent. Barbuti's claim that the number was collected with marketing and profiling consent at loyalty sign-up is recorded as undocumented. The Garante did not make a finding on whether that original consent was valid.

Why it matters for marketers

For anyone running SMS or email marketing in Italy, the decision turns two routine operational questions into compliance points. Which mailboxes receive deletion and objection requests is not only a privacy team matter: any address a company publishes can receive a valid request, and the Garante expects a working route from that inbox to whoever handles rights requests. And the content of a marketing text is regulated down to its footer, with the authority naming a "STOP" reply option as one acceptable way to meet the Article 130(5) requirement.

The loyalty programme angle is familiar. In June 2026, Norway's Datatilsynet fined Elkjop NOK 20 million over a club consent that bundled newsletters, SMS, profiling and analytics into a single all-or-nothing choice, a case that also involved overdue data subject requests. Barbuti's defence relied on exactly that kind of sign-up consent, covering offers, marketing and profiling, and the Garante treated the later deletion request as decisive regardless.

Erasure handling has also drawn larger fines elsewhere. France's CNIL fined EXTIA €300,000 for breaches of the same two articles, 12 and 17, in a deliberation dated July 21, 2026, holding that deleting data on a 60-day timer did not discharge the one-month duty to tell the person what had been done. In Belgium, a telecom company was fined €100,000 in 2024 for a 14-month delay in answering an access request. Barbuti's case, with a request that went unanswered for nearly two years before the regulator intervened, drew a much smaller sum because only one person and three messages were involved.

The Garante's own recent enforcement record runs at a very different scale. On the same day as the Barbuti decision, September 23, 2026, the authority adopted the decision that fined IQVIA €7 million over data on about one million patients that the company had called anonymous. In July 2026 it fined Lusha €2 million and ordered the erasure of Italian contact data, a decision whose full text gave the contact data company 60 days to report compliance. Earlier in 2026 it fined Intesa Sanpaolo €17.6 million for profiling 2.4 million bank customers and, separately, €31.8 million over one employee's access to 3,573 customers' accounts. Piaggio was fined €460,000 in June over archived staff email, a case that also involved unanswered requests to deactivate accounts.

Small fines of this kind tend to attract less attention, but they show how the authority applies its rules to ordinary marketing operations. A comparable case in Germany saw the Hesse authority fine an IT company €10,000 for a single unconsented email campaign to more than 2,700 recipients. France's ad industry body Alliance Digitale published a guide in April 2026 on commercial prospecting rules, setting out roles and legal bases channel by channel.

The decision can still be appealed. Garante fines do not always survive the courts: a Rome tribunal annulled the authority's €15 million OpenAI fine on jurisdictional grounds in March 2026, and an Alliance Risk analysis published in May 2026 found that nearly 40 per cent of the €7.1 billion in GDPR fines announced since 2018 had been annulled or was under challenge. At €5,000, with a 50 per cent discount for settling within the appeal period, the economics of an appeal in Barbuti's case look very different. Would a company contest a ruling that its inbox should have forwarded one email?

Timeline

Summary

Who: Italy's data protection authority, the Garante per la protezione dei dati personali, and Barbuti S.p.A., a fashion retailer registered in Caserta. The case was brought by one unnamed customer. The decision was signed by president Pasquale Stanzione, rapporteur Ginevra Cerrina Feroni and secretary general Luigi Montuori.

What: The Garante fined Barbuti €5,000 for breaching the GDPR's accountability principle (Article 5(2)), its rules on answering rights requests and on erasure (Articles 12 and 17), and Article 130 of the Italian Privacy Code. A deletion request emailed to the company's e-commerce inbox was never handled, promotional messages kept arriving, and the texts carried no contact point for exercising data rights. The Garante held that a clear request sent through a channel the company publishes should be handled or forwarded, and ordered Barbuti to bring its promotional messages into line with Article 130(5).

When: The deletion request was sent on June 7, 2024, the complaint was filed on January 23, 2026 and the decision was adopted on September 23, 2026. The Garante's page for the decision links it to its newsletter of October 29, 2026. Barbuti has 30 days from notification to pay, or to pay €2,500 within the appeal period, and 30 days to report the measures it has taken.

Where: Italy. The company is based in Caserta, and the decision was issued in Rome.

Why: The case shows how the Garante treats routine marketing operations: an unmonitored inbox and a text message footer that only names the sender were enough to establish violations, even though the authority rated the seriousness as low and the fine sits at 0.025 per cent of the €20 million ceiling. For companies sending SMS marketing in Italy, the decision names a link, a dedicated email address or a "STOP" option as ways to meet the legal requirement for a contact point in every promotional message.