On February 6, 2024, the Italian data protection authority (Garante) announced in its newsletter its decision No. 6, as issued on January 11, 2024, in which it imposed a fine of €5,000 on the Municipality of Syracuse, for violations of the General Data Protection Regulation (GDPR) following an investigation. 

Background to the decision 

The Garante noted that as part of an initiative aimed at facilitating the fulfillment of obligations regarding the protection of personal data, the Municipality of Syracuse was notified that the contact details for the designated data protection officer (DPO) were not recorded in its archives as required by the GDPR. After notification by the Garante, additional checks on the Municipality of Syracuse's website revealed the publication of the contact details for the DPO. However, the contact details were not communicated to the Garante properly.  

Findings of the Garante 

At the end of its investigation, the Garante determined that the failure to communicate the DPO contact details by the Municipality of Syracuse constituted a violation of Article 37(7) of the GDPR. 

The Garante noted that the failure to communicate the contact information of the DPO negatively affected the possibility of communication easily and effectively with the Municipality of Syracuse. The violation also concerned the appointment of two DPOs. Further, the Garante highlighted that the Municipality of Syracuse took steps to remedy the violation and mitigate negative effects.  

Outcomes 

In conclusion, the Garante imposed a fine of €5,000 on the Municipality of Syracuse, in addition to publication on the Garante's website, to be paid within 30 days of notification of the provision.  

You can read the newsletter here and the decision here, both only available in Italian.