Innovation Law Insights

Data Protection and Cybersecurity

One complaint, millions in fines: Are GDPR data subject rights becoming a new enforcement risk?

GDPR data subject rights are becoming a significant enforcement risk for companies. Even a single complaint can lead to large fines if it reveals weaknesses in the way personal data is managed across different systems, teams and business processes.

Two recent European decisions illustrate this very well.

The French CNIL has fined EXTIA EUR300,000 for failing to properly handle requests from individuals exercising their GDPR rights. And the Italian Garante has imposed a EUR5.508 million fine on BBVA following a complaint concerning a single individual.

The two cases are different, both in terms of the facts and the GDPR provisions involved, but they raise a common question: How much regulatory exposure can arise from the way a company handles one individual’s GDPR rights?

The EXTIA case shows that the process matters

On July 21, 2026, the French CNIL fined EXTIA EUR300,000 for several failures concerning the exercise of data subject rights, including the right to erasure under Article 17 GDPR. The case followed complaints from former employees and candidates who experienced difficulties when exercising their right to erasure. The case was also considered in the context of the EDPB’s coordinated enforcement action on the implementation of the right to erasure.

EXTIA received 265 erasure requests in 2024, most of which came from candidates and, occasionally, former employees. More than three-quarters of these requests had either not been dealt with or had not been dealt with satisfactorily.

The CNIL found that 12 requests hadn’t been processed at all, while 166 individuals hadn’t been informed of the action taken following their request. A further 27 individuals were informed late, outside the applicable one-month period.

What I find particularly interesting about this decision is that the regulator didn’t simply look at whether personal data had ultimately been deleted. It also focused on how the company managed the exercise of the right, including the way requests were received, processed and communicated to individuals.

This is an important distinction for companies because having a GDPR policy that explains how individuals can exercise their rights is very different from having a process that actually works when someone exercises those rights.

The EDPB’s work confirms that this isn’t an isolated issue. In its 2026 report following the coordinated enforcement action on the right to erasure, the EDPB described the right to erasure as one of the most frequently exercised data subject rights and one that generates a significant number of complaints across Europe.

The BBVA decision takes the issue much further

The Italian Garante’s decision against BBVA is even more striking from an enforcement perspective as it originated from a complaint by a single individual.

The individual had objected to receiving commercial communications through the BBVA app and had also contacted customer service. According to the Garante, the customer’s choice had been recorded in one system but hadn’t been correctly synchronized with the CRM system used for sending commercial communications. The result was that the individual continued to receive commercial communications despite having exercised the relevant right.

The Garante found violations concerning the right to object, the obligation to provide an appropriate response and the technical and organizational measures adopted by BBVA, with the situation continuing for approximately seven months.

The most remarkable point is the amount of the fine: EUR5.508 million for a case concerning one individual.

This doesn’t mean that the number of individuals affected is irrelevant when a GDPR fine is calculated. The GDPR requires supervisory authorities to consider several factors, including the nature, gravity and duration of the infringement, the degree of negligence, previous infringements and the need for the sanction to be effective, proportionate and dissuasive.

However, the BBVA decision shows how the exercise of privacy rights might be a powerful weapon in the hands of individuals.

For large organizations, the size of the undertaking and its turnover can also have a significant impact on the amount of the fine, meaning that what starts as a complaint by one individual can ultimately have a very different financial dimension. This is the first case in which the Garante took the worldwide turnover of the company as a parameter to calculate the GDPR fine.

Why should companies pay attention to GDPR data subject rights?

I think these cases are particularly relevant for industries that process large databases like banks and insurance companies but also retail brands and gaming operators. A customer can interact with a company through its website, mobile application, customer support, CRM platform, payment systems, marketing platforms and several external service providers.

Personal data can move between different systems and teams during a single customer journey, and this creates a significant operational risk when a customer exercises a GDPR right.

For example, a customer might object to direct marketing through an app, while the CRM system continues to send communications because the objection hasn’t been properly propagated across the organization.

A customer might also request access to personal data, ask for their account to be deleted or exercise another data subject right through customer support, without the request being properly escalated to the privacy team.

The legal issue might start as a relatively small operational failure, but the regulator could then examine what that failure says about the company’s overall ability to respect data subject rights.

This is where GDPR data subject rights become an enforcement issue rather than simply a privacy compliance issue.

When a GDPR request becomes part of a dispute

There is another aspect of these cases that deserves attention, particularly for companies dealing with large numbers of customers, employees and former employees. Data subject rights can increasingly become intertwined with employment, commercial and customer disputes.

An individual involved in a dispute with a company can exercise several GDPR rights, submit repeated requests or combine a data subject request with other complaints and legal claims.

This doesn’t mean these requests are abusive, and companies should be very careful before making such an assumption because GDPR rights are fundamental rights that controllers have to respect.

At the same time, Article 12(5) GDPR expressly allows controllers to take action where requests are manifestly unfounded or excessive, while Article 17 contains exceptions that may be particularly relevant where personal data needs to be retained to establish, exercise or defend legal claims.

The challenge for companies is to distinguish between a legitimate exercise of a data subject right and a situation in which the request forms part of a broader dispute, while continuing to respect the individual’s rights throughout the process.

This is also why I think companies should avoid creating procedures that make it unnecessarily difficult for individuals to exercise their rights. The process should be designed to facilitate the exercise of the right, while giving the company sufficient information to identify the request, assess it properly and document the steps taken.

What should companies do?

The practical lesson from EXTIA and BBVA is not to create another GDPR policy that sits in a compliance folder.

Companies should instead have an operational process connecting privacy, customer service, IT, CRM, compliance and legal teams, particularly where the exercise of a data subject right can affect several systems.

That process should establish how a request can be submitted, how it’s identified and recorded, who is responsible for handling it, how it’s escalated, how the relevant systems are updated and how the company can demonstrate what happened if a regulator subsequently asks questions.

And the process should also be tested to make sure that requests are easily identified and handled, easily accessible from customers and there is no inefficiency. 

A company may have a perfectly drafted procedure stating that a customer can object to direct marketing, but if the objection doesn’t actually stop the marketing because the relevant systems aren’t connected, the organization may still face a regulatory investigation.

This is why I believe privacy governance needs to move closer to the way companies approach cybersecurity and operational resilience. The question is not only whether the legal right exists, but whether the organization’s technology and processes can make that right effective in practice.

One complaint can expose a much bigger problem

The EXTIA and BBVA decisions ultimately illustrate two sides of the same problem.

EXTIA shows that failing to establish an effective process for handling data subject rights can lead to enforcement when a significant number of requests aren’t properly managed.

BBVA shows that a much smaller incident can also result in a very significant sanction where the regulator identifies weaknesses in the organization’s compliance and governance, particularly when the infringement continues over time and the company is a very large undertaking.

GDPR data subject rights are fundamental, and companies should make sure that they can be exercised effectively. At the same time, companies need to ensure that their procedures are robust enough to deal with difficult or repeated requests and, where appropriate, to demonstrate why a particular request couldn’t be fulfilled or why certain data could legitimately be retained.

The lesson from EXTIA and BBVA is quite simple: a GDPR complaint can start with one player, but the regulatory consequences can be much bigger.

Author: Giulio Coraggio

Artificial Intelligence

IVASS highlights new expectations on digital operational resilience and AI risk management

Insurance undertakings subject to the communication must submit to IVASS a board-approved assessment report and related remediation plan by 31 December 2026. 

On 17 July 2026, IVASS issued a market communication on digital operational resilience and advanced AI models, addressed to Italian insurance and reinsurance undertakings and to the Italian branches of insurers headquartered outside the EEA. 

IVASS notes that the latest generation of AI models can identify software vulnerabilities and generate exploitation methods within extremely short timeframes, increasing the risk and potential effectiveness of cyberattacks. Against this backdrop, the regulator emphasizes that digital operational resilience is essential not only for regulatory compliance but also for business continuity and the reliable provision of insurance and financial services. 

Key areas of focus

Having regard to the requirements of the Digital Operational Resilience Act (DORA), IVASS expects insurers to strengthen their controls in the following areas: 

• Governance, including the review of the Risk Appetite Framework (RAF) to address risks arising from emerging technologies and AI.
• Cyber hygiene, through defense-in-depth measures, enhanced access controls and network segmentation.
• IT asset and attack-surface management, including accurate inventories and the modernization of legacy systems.
• Vulnerability and patch management, with a focus on the rapid identification and remediation of critical vulnerabilities.
• Monitoring and detection capabilities, including the possible use of AI-based security tools.
• Digital operational resilience testing, with realistic cyber incident and crisis-management scenarios.
• Third-party and ICT supply chain risk management, particularly in relation to concentrated and multi-layered service-provider arrangements.

Governance and reporting expectations

IVASS expects each insurer’s Board of Directors, jointly with the Board of Statutory Auditors, to review the Communication and launch the preparation of a report assessing:

• current cyber and operational resilience risk exposure
• the adequacy of existing controls
• key gaps and remediation priorities
• a detailed action plan, including timelines, investments and board oversight arrangements

Insurers also have to designate and notify IVASS of a specific internal function responsible for these matters, such as the second-line ICT risk control function. 

Practical takeaway

The Communication signals a heightened supervisory focus on the cybersecurity implications of advanced AI technologies and reinforces insurers’ obligations under DORA. Insurers should promptly assess their governance, cyber resilience, testing and third-party risk management frameworks to ensure readiness for the December 31, 2026, reporting deadline.

Authors: Chiara Cimarelli, Ina Doci and Francesca Santovito

Gaming and Gambling

ENISA updates its CRA reporting platform FAQ: What manufacturers and gaming companies need to do from September 11

ENISA’s updated CRA Single Reporting Platform FAQ explain how manufacturers, including gambling operators and suppliers, have to report actively exploited vulnerabilities and severe incidents from 11 September 2026, and what companies, including those operating in the gambling sector, need to put in place now to respond within the first 24 hours.

This is the third article in my analysis of the Cyber Resilience Act.

• In my first article, I looked at the European Commission’s guidance on the scope of the CRA, the products covered and the obligations that will apply.
• In the second, I looked specifically at the implications of the CRA for gambling operators and suppliers, including the difficult questions around mobile applications, remote data processing solutions and third-party platforms.

This article looks at a different part of the CRA: what happens when something actually goes wrong and a company has to report it in the light of the ENUSA’s updated FAQ on the reporting platform.

The timing is important. The CRA reporting obligations apply from September 11, 2026, for both new and old products, while the CRA as a whole will become fully applicable on December 11, 2027. From September 11, there will be situations where a company has only hours to understand what has happened, determine whether the CRA applies and take action. This is where many of our clients are struggling.

What ENISA’s new FAQ clarify

ENISA’s Single Reporting Platform (SRP) is the mechanism through which manufacturers of products with digital elements will report, under the CRA, actively exploited vulnerabilities and severe incidents affecting the security of those products.

The updated FAQ provide practical information on the reporting process, registration, Assigned Representatives, the relevant coordinating CSIRT and the operation of the platform. ENISA has also published a detailed SRP Glossary setting out the information required at the different stages of a notification.

There are two mandatory categories of events:

• Actively exploited vulnerabilities, meaning vulnerabilities for which there is reliable evidence that a malicious actor has exploited them.
• Severe incidents, meaning incidents having a severe impact on the security of a product with digital elements.

The reporting process then develops in stages:

• An early warning has to be filed within 24 hours of becoming aware of the relevant event.
• A more detailed notification follows within 72 hours.

For an actively exploited vulnerability, the final report is due within 14 days after a corrective measure has become available. For a severe incident, the final report is due within one month after the 72-hour notification.

The above doesn’t mean that a company must have completed its investigation within 24 hours. It means that the company needs to be capable of making a legally and technically informed assessment with the information available at that point.

That requires preparation well before an incident occurs.

What kind of products fall within the CRA? The case of the gambling sector

The gambling sector is a good example of why CRA preparation cannot be limited to a general cybersecurity policy. The CRA analysis is product specific:

• A native sportsbook, casino or poker application distributed through an app store can fall within the definition of a product with digital elements.
• A browser-based gambling platform is different since simply accessing a gambling service remotely through a browser does not, by itself, make the service a product with digital elements.

There are, however, components of the browser that might qualify as remote data processing solutions since the absence of that processing would prevent the product with digital elements from performing one of its functions. As such, even if some products are not in scope of the CRA, the regime might indirectly extend to them.

Likewise, when using third-party software, the operator might be requalified as a manufacturer under the CRA, if it markets a product under its own name or trademark or substantially modifies it.

The assessment on the products that are within the CRA scope have to be performed before an incident. Once the 24-hour countdown has started, it’s not the right moment to discover who is legally responsible for the product.

What companies should do before September 11

There are several practical steps that manufacturers and gambling companies should take now.

Identify the products that may trigger CRA reporting

Companies should identify which products with digital elements they manufacture or place on the EU market and determine which components and supporting services need to be considered.

The objective should be to reach a clear answer to four questions:

• What is the product?
• Who is the manufacturer?
• Which versions are currently supported?
• Which third parties are involved?

Without these answers, the reporting process is likely to become much more difficult when an incident occurs.

Identify the responsible entity

A gambling group may have one company operating the business, another company owning the intellectual property, another company developing the application and a technology provider operating the underlying platform. The company should determine which entity has the manufacturer role for each relevant product.

Make sure the right people can actually report

ENISA has provided specific guidance on the Assigned Representatives who will use the SRP. Companies should identify the relevant Primary and Secondary Assigned Representatives and ensure that they have the necessary access arrangements, including EU Login and MFA. They should also determine the relevant coordinating CSIRT.

Build the first 24 hour process

An incident response policy should establish who:

• receives the initial cybersecurity escalation
• determines whether the event may be reportable
• involves legal
• identifies the affected product and version
• collects the technical information
• records when the company became aware
• decides what can be reported within 24 hours
• submits the notification
• coordinates the 72-hour notification
• prepares the final report

The company should also maintain a record of the decisions taken and the information available at each stage to submit it to regulators in case of enquiries. This aspect matters because a regulator might subsequently ask not only what happened, but also what the company knew at the relevant time and why it decided to act in a particular way. Every case has to be accompanied by a report that documents the decision taken by the company. That’s where the defense dimension of CRA compliance becomes important.

The SRP doesn’t replace the internal workflow

The CRA reporting platform is the reporting mechanism, while it doesn’t determine whether the company has a reporting obligation or replace the internal process required to identify, investigate and classify an event. Companies have to organize their own internal workflows and databases, but the notification will be submitted through the platform interface.

This means that companies should consider creating an internal CRA workflow that records, at a minimum:

• when the company became aware of the event
• the affected product and version
• the preliminary classification
• the information available at 24 hours
• information that remains under investigation
• corrective and mitigating measures
• the person responsible for each action
• the 72-hour deadline
• the final reporting deadline

A properly designed workflow can help the company collect the relevant information, identify the deadlines and maintain a consistent record across cybersecurity, legal and business teams.

If you want to know more on the Cyber Resilience Act, you can read these articles “Cyber Resilience Act guidance: which products, which obligations, from when” and “The Cyber Resilience Act for gambling operators and suppliers: what falls in scope and what has to be done.”

Author: Giulio Coraggio

Intellectual Property

Souvenirs and unfair competition: Venice court goes beyond copyright protection

On August 31, the Specialized Business Division of the Court of Venice issued an interesting decision concerning unfair competition, addressing the relationship between copyright protection and the protection afforded to businesses against the slavish imitation of their products.

At the center of the dispute was a line of souvenirs widely available on the market, consisting of small resin magnets depicting the main landmarks of Italian cities, framed by a miniature window featuring opening shutters and a windowsill decorated with flower pots or cats.

The collection, designed by a graphic artist employed by the claimant, was marketed by the claimant itself and had also been reproduced by a wholesaler based in Padua, which was distributing virtually identical copies through a retail outlet in Verona.

Upon becoming aware of the marketing of the competing products, the claimant – a leading company in the production and distribution of souvenir items in Italy and Europe – brought urgent proceedings before the Court of Venice pursuant to Articles 156 et seq. of the Italian Copyright Act and Articles 669-bis et seq. and 700 of the Italian Code of Civil Procedure, seeking an order for the description and seizure of the products, an injunction against their further marketing, and the imposition of a penalty for each violation of the order to be issued.

The court first ruled that the souvenirs could not benefit from the protection afforded under Article 2(4) of the Italian Copyright Act to works of figurative art. According to the Venice Court, these were products intended for mass production and commercialization, manufactured using molds and, as such, could not be regarded as creative works.

The court further held – albeit within the limits of the summary assessment applicable at the interim stage of the proceedings – that the products couldn’t benefit from the protection afforded to industrial design under Article 2(10) of the Italian Copyright Act.

On this basis, the court dismissed the applications for the description and seizure of the products.

The decision is particularly noteworthy for the conclusion it reaches: the absence of the requirements for copyright protection does not, in itself, prevent a product from being protected on the separate ground of unfair competition. It was precisely on this basis that the application was upheld. The court found that a competitive relationship existed between the parties and identified an extremely high degree of similarity between the products at issue.

This latter factor, assessed also in light of the characteristics of the relevant market, was considered capable of creating a concrete likelihood of confusion as to the commercial origin of the products. Particular weight was given to the low price of the souvenirs, a circumstance which tends to reduce the level of attention exercised by consumers at the time of purchase and, consequently, increases the likelihood that they may be misled as to the actual origin of the product.

Having found both fumus boni iuris and periculum in mora, the court granted the application for interim relief on the grounds of unfair competition.

The court accordingly prohibited the defendant from any further production, distribution, marketing, offering for sale or promotion, by any means, of the window-shaped magnets depicting the landmarks of Verona. It also imposed a penalty of EUR10 for each magnet sold in breach of the order.

Technology, Media and Telecommunications

Infratel publishes report on the progress of the National Ultra-Broadband Plan as of July 31, 2026

In a press release dated August 25, 2026, Infratel announced the publication of its report on the progress of the National Ultra-Broadband Plan, updated to July 31, 2026.

The National Strategy for Ultra-Broadband – “Towards the Gigabit Society,” included in the National Recovery and Resilience Plan (Piano Nazionale di Ripresa e Resilienza – PNRR) and approved on May 25, 2021, by the Interministerial Committee for Digital Transition (Comitato interministeriale per la Transizione Digitale – CiTD), aims to bring 1 Gbit/s connectivity across Italy by 2026 and foster the development of fixed and mobile telecommunications infrastructure.

The strategy encompasses several public intervention plans to promote and incentivize the coverage of geographical areas where the provision of infrastructure and ultra-high-speed digital services by the operators is either absent or insufficient.

The operational activities of the National Ultra-Broadband Plan were initiated in 2016 by Infratel Italia S.p.A., an in-house company of the Ministry of Enterprises and Made in Italy.

Infratel’s aim is to intervene in market failure areas by building and integrating broadband and ultra-broadband infrastructure to extend access opportunities to high-speed internet for citizens, businesses, and public administrations. Through Infratel, the Ministry of Enterprises and Made In Italy implements measures defined in the National Ultra-Broadband Strategy to reduce infrastructure and market disparities across Italy, creating favorable conditions for the integrated development of electronic communications infrastructure.

The report describes the plan’s progress, focusing on the five main operational phases: final design (progettazione definitiva), executive design (progettazione esecutiva), works’ execution, testing, and start of service.

During the final design phase, the layouts of the networks to be built are identified, along with the infrastructure to be reused, the authorities responsible for granting authorizations for FTTH (Fiber To The Home) technology deployment, and the necessary sites for FWA (Fixed Wireless Access) technology deployment. After Infratel approves the final designs, the executive design phase begins, aimed at obtaining the necessary authorizations. Subsequently, works can start on the sites. After the work is completed, Infratel conducts final verifications. If verification is successful, Infratel will issue a positive testing certificate (collaudo).

The report indicates that, as of July 31, 2026, the final design for the FTTH network has been approved in 6,062 municipalities, 2 fewer than in May 2026. As highlighted in the report, the number of planned projects may vary over time due to redesigns prompted by various obstacles. Specifically, during the progress of the executive design phase, some municipalities were found to lack any “white” housing units to connect, leading to the issuance of new regional technical plans that incorporated the cancellation of interventions in certain municipalities. As a result, the number of municipalities with approved final designs for the FTTH network is slightly lower than the figure recorded in May 2026.

As for the number of municipalities in which the final design for the FWA network has been approved, there has been an increase of 48 municipalities. As of July 31, 2026, 7,112 municipalities had approved final designs for the FWA network.

As stated in the report, 6,039 municipalities had approved executive design of FTTH (Fiber To The Home) network infrastructure, while a total of 3,226 executive projects have been approved for the implementation of FWA (Fixed Wireless Access) technology networks. This reflects a decrease of two municipalities with approved executive designs for FTTH networks compared to May 2026. This decrease is related to that recorded with respect to the final design of FTTH networks, since the exclusion of certain municipalities from the scope of the FTTH intervention affects both design phases. For FWA technology, the number of approved executive projects is substantially the same. As noted above, the number of projects may vary due to the cancellation of interventions in certain areas.

As of July 31, 2026, infrastructure works have been completed in 10,590 out of the 11,970 total active sites for fiber construction and in 3,152 out of the 3,224 sites for the FWA network construction.

Infrastructure works for FTTH technology were completed with positive testing in 5,487 municipalities, covering a total of 10,336 projects. Compared to May 2026, projects related to the FTTH network have been positively tested in an additional 50 municipalities, while the number of positively tested projects has increased by 187.

Infrastructure works for FWA technology were completed with positive testing in 2,937 sites, an increase of 20 sites compared to May 2026.

Authors: Massimo D’Andrea, Matilde Losa

Innovation Law Insights is compiled by DLA Piper lawyers, coordinated by Edoardo Bardelli, Carolina Battistella, Noemi Canova, Gabriele Cattaneo, Maria Rita Cormaci, Camila Crisci, Cristina Criscuoli, Tamara D’Angeli, Chiara D’Onofrio, Federico Maria Di Vizio, Enila Elezi, Nadia Feola, Laura Gastaldi, Vincenzo Giuffré, Nicola Landolfi, Giacomo Lusardi, Josaphat Manzoni, Valentina Mazza, Lara Mastrangelo, Maria Chiara Meneghetti, Giulio Napolitano, Andrea Pantaleo, Deborah Paracchini, Maria Vittoria Pessina, Marianna Riedo, Rebecca Rossi, Roxana Smeria, Alessia Spada, Massimiliano Tiberio, Federico Toscani, Giulia Zappaterra.

Articles concerning Telecommunications are curated by Massimo D’Andrea, Flaminia Perna, Matilde Losa and Arianna Porretti.