The Italian Supreme Court, with an order dated September 22,
upheld the appeal of the Italian Data Protection Authority, in
which it outlined the necessary criteria of sanctions issued under
the European Data Protection Regulation (GDPR).
The case stems from a sanction issued to the plaintiff in 2021
by the Italian Data Protection Authority (“Guarantor”),
which had sanctioned a violation of the data protection regulations
by issuing a penalty of 2,600,000 euros. The measure was appealed
before the Court of Milan, which annulled the sanction
as disproportionate.
In fact, the court held that the figure, which was based on to
the sanctioned person's turnover, was too high (more than 7
percent), compared to the 4 percent maximum penalty stipulated by
the GDPR. In addition, the court declared itself not competent to
recalculate the sanction, and consequently annulled it. The Milan
judge stated verbatim that “the decision of the
Guarantor, was not [legitimate NDR]
