The Italian data protection authority Garante Per La Protezione Dei Dati Personali ("Garante") imposed an administrative fine of EUR 460,000 on Piaggio & C. S.p.A. by its decision dated June 18, 2026 and numbered 2026/476. The decision concerns the retention of corporate email accounts allocated to former employees for five years, the retrospective review of such correspondence for use in disciplinary proceedings, and the failure to respond to data subject requests.

The Personal Data Protection Board's ("Board") Principle Decision dated February 10, 2026 and numbered 2026/266 regarding the processing of personal data within the scope of loyalty programs was published in the Official Gazette dated February 28, 2026 and numbered 33182. The six-month compliance period granted to data controllers under the Principle Decision for the purpose of implementing the necessary technical and organizational measures will be expired on February 28, 2026.

However, this period has been extended until February 28, 2027 by the decision of the Board published in the Official Gazette dated August 13, 2026 and numbered 33339.

The Turkish Personal Data Protection Board's Principle Decision No. 2026/1301, dated July 1, 2026, addresses the online publication of personal data by public legal entities acting as data controllers within the framework of the fundamental principles and legal bases for processing set out in the Personal Data Protection Law No. 6698 ("KVKK"). The Decision was published in the Official Gazette No. 33323 dated July 28, 2026.

The Turkish Personal Data Protection Authority (KVKK), in its public announcement published on July 21, 2026, provided important guidance regarding the use of contact information obtained from third parties for advertising and marketing activities.

During its investigations, the Authority found that companies have been contacting prospective customers using telephone numbers, email addresses, and other contact information obtained from existing customers, business partners, referrals, or other third parties. However, it was observed that the obligations set forth under the Turkish Personal Data Protection Law (Law No. 6698) have not always been fulfilled in these processes.