Italy Garante Fines Corona EUR 4,950 for Publishing Chat Audio

Italy's Garante Fines Fabrizio Corona EUR 4,950 for Publishing Private Chat Audio

Italy's data protection authority published an injunction order on 3 September 2026 fining Fabrizio Corona EUR 4,950 for disseminating an audio file and chat extracts involving the actor Raoul Bova, holding that a person's fame does not license publishing private material that carries no genuine public interest (Garante, provvedimento n. 492 of 3 July 2026, doc. web n. 10287188).

Information last verified on September 5, 2026.

Status: Administrative injunction order (ordinanza ingiunzione), not a criminal conviction. The Garante adopted the measure as provvedimento n. 492 on 3 July 2026 and published it, together with a press release, on 3 September 2026; publication on the authority's website was itself imposed as an accessory sanction under Art. 166, comma 7 of the Codice privacy. The published text records no appeal as of 5 September 2026. Opposition lies to the ordinary courts under Art. 152 of the Codice privacy and Art. 10 of d.lgs. 1 settembre 2011, n. 150, within 30 days of communication of the measure.

Jurisdiction scope: This covers Italy. It applies the EU General Data Protection Regulation as implemented by Italy's Codice in materia di protezione dei dati personali (d.lgs. 30 giugno 2003, n. 196) and the Regole deontologiche annexed to that code. It does not state United States law. It resolves an administrative data protection proceeding only, and decides no criminal, defamation or civil damages question.

What Happened

On 3 September 2026 the Garante per la protezione dei dati personali issued a press release announcing that it had declared unlawful the unauthorised dissemination of an audio file and of content extracted from a private chat conversation between Raoul Bova and another person, published by Fabrizio Corona on social networks and digital platforms.

The decision behind that announcement is older than the announcement. The Garante adopted it as provvedimento n. 492 on 3 July 2026, at a session attended by president Pasquale Stanzione, vice-president Ginevra Cerrina Feroni, member Agostino Ghiglia as rapporteur, and secretary general Luigi Montuori. Two months separate the adoption date from the publication date, and both appear on the authority's own website.

The proceeding began with a complaint (reclamo) under Art. 77 GDPR, regularised on 7 and 8 August 2025, filed by Bova through counsel. The complaint concerned an audio file taken from a private chat exchange between him and a third party, published without his consent on a YouTube channel attributable to Corona and then circulating widely. On the evidence gathered in the investigation, the Garante established that the controller had disseminated the audio file and extracts of the private conversation both in that programme and through further social profiles attributable to him.

The Garante had already intervened twice before the sanction. On 4 August 2025, by provvedimento n. 467, it issued a general warning under Art. 58(2)(a) GDPR and Art. 154, comma 1, lett. f) of the Codice privacy, directed at the indeterminate set of potential users of the material, stating that further dissemination of the audio or of content extracted from the private conversation would likely breach the Regulation and the Codice. On 20 August 2025, by provvedimento n. 479, it went further and imposed on Corona an urgent provisional limitation of processing under Art. 58(2)(f) GDPR, requiring removal of the audio and prohibiting reproduction and dissemination of it in any form.

Formal proceedings against Corona opened on 12 September 2025 under Art. 166, comma 5 of the Codice privacy. The alleged breaches were identified at that stage as Art. 5(1)(a) and (c) GDPR, Artt. 2-quater, comma 4 and 137 of the Codice privacy, and Art. 6 of the Regole deontologiche.

The press release states the operative principle in a single sentence:

«la notorietà di una persona non legittima la divulgazione di dati personali e informazioni attinenti alla sua sfera privata quando tali contenuti non rivestono un effettivo interesse pubblico.»

In English: a person's fame does not legitimise the disclosure of personal data and information relating to their private sphere where such content carries no actual public interest.

Garante per la protezione dei dati personali, press release of 3 September 2026, doc. web n. 10287714

And on the essentiality standard, quoted through to its second limb:

«La diffusione di stralci di conversazioni intime e affettive eccede infatti il principio di essenzialità dell'informazione e contrasta con i principi di liceità, correttezza e minimizzazione del trattamento dei dati personali stabiliti dalla normativa privacy.»

In English: the dissemination of extracts of intimate and affective conversations in fact exceeds the principle of essentiality of information and conflicts with the principles of lawfulness, fairness and minimisation of the processing of personal data established by privacy legislation.

Garante, press release of 3 September 2026, doc. web n. 10287714

The Garante also recorded that the conduct was carried out «con finalità di spettacolarizzazione e alimentazione del gossip», that is, for purposes of spectacle and of feeding gossip, causing significant harm to the actor's reputation, including his professional reputation, and to his privacy, and that distribution through digital platforms aggravated the breach by amplifying its reach and effects.

Two parts of the outcome are easy to miss. First, the Garante took formal note that the material complained of was no longer available online and concluded that no further corrective measures were needed on that point. Second, it declared the complaint unfounded in one respect: as to a later subscriber-only episode in which Corona commented on statements Bova had himself made during a television appearance. That, the Garante reasoned, fell within free expression, because it concerned opinions and assessments of declarations the person had made in a public broadcast context accessible to a general audience, with a consequent attenuation of legitimate expectations of privacy.

How the EUR 4,950 figure was reached

The order applies the sanction under the combined operation of Artt. 2-quater and 166, comma 2 of the Codice privacy and Art. 83(5) GDPR, adopted as an ordinanza ingiunzione under Art. 166, comma 7 of the Codice privacy and Art. 18 of legge n. 689/1981. The order expressly records that the ceiling for breaches of that kind is up to EUR 20 million, or for undertakings up to 4 percent of total worldwide annual turnover for the preceding financial year, whichever is higher.

Against that ceiling, the Garante found aggravating circumstances under Art. 83(2) GDPR: the gravity of the breach given dissemination in a digital environment that widens reach to an indeterminate audience (lett. a); the nature of the data, which the authority found related exclusively to the data subject's intimate and affective sphere and unconnected to any public role (lett. g); the duration, because processing continued after the 4 August 2025 warning and ceased only after notification of the opening of proceedings; an intentional character, the authority describing a deliberate intent to feed gossip through spectacle rather than an isolated episode (lett. b); and financial benefits obtained, given plausible monetisation through views, paid subscriber content and advertising (lett. k).

As mitigating factors, the order counts the eventual removal of the episode complained of, albeit only after proceedings had opened (lett. c), and purposes referable to freedom of information under Art. 85 GDPR and Artt. 136 and following of the Codice privacy. It then records the decisive financial finding: checks carried out with the support of the Guardia di Finanza's Nucleo Speciale Privacy found no income tax declarations attributable to the controller or to companies linked to him, and for tax year 2025 only limited amounts consisting of a share of end-of-service pay and some social security contributions.

The press release makes the same point in its own words, noting that the sanction was set at EUR 4,950 «non risultando redditi fiscalmente dichiarati nell'anno di riferimento», that is, because no declared taxable income appeared for the reference year, and that this was so despite the gravity of the breach and the particularly delicate nature of the data disseminated. The order also applied an accessory sanction: publication of the injunction on the Garante's website, justified by the controller's field of activity, the reach of the platform used and the intimate nature of the data.

The order additionally notes that under Art. 166, comma 8 of the Codice privacy the person sanctioned may settle the matter by paying half the sanction imposed within the time limit for filing an appeal.

What the Law Actually Says

The Italian framework here has three layers, and the Garante used all three.

Layer one is the GDPR. Art. 5(1)(a) requires that personal data be «trattati in modo lecito, corretto e trasparente nei confronti dell'interessato», processed lawfully, fairly and transparently in relation to the data subject. Art. 5(1)(c) requires data to be «adeguati, pertinenti e limitati a quanto necessario rispetto alle finalità per le quali sono trattati», adequate, relevant and limited to what is necessary for the purposes of processing. Art. 85 GDPR is the provision that requires member states to reconcile data protection with freedom of expression and information, including processing for journalistic purposes.

Layer two is the Codice privacy. Art. 136 sets the scope of the journalism title, and its comma 1, lett. c) is what made this proceeding possible at all: the title applies to processing «finalizzato esclusivamente alla pubblicazione o diffusione anche occasionale di articoli, saggi e altre manifestazioni del pensiero anche nell'espressione accademica, artistica e letteraria», directed exclusively at the publication or dissemination, even occasional, of articles, essays and other expressions of thought, including in academic, artistic and literary expression. That wording does not turn on a press card.

Art. 137, comma 3 then supplies the limit:

«In caso di diffusione o di comunicazione dei dati per le finalità di cui all'articolo 136 restano fermi i limiti del diritto di cronaca a tutela dei diritti di cui all'articolo 1, paragrafo 2, del Regolamento e all'articolo 1 del presente codice e, in particolare, quello dell'essenzialità dell'informazione riguardo a fatti di interesse pubblico. Possono essere trattati i dati personali relativi a circostanze o fatti resi noti direttamente dagli interessati o attraverso loro comportamenti in pubblico.»

In English: where data are disseminated or communicated for the purposes set out in Art. 136, the limits of the right of reporting remain in place to protect the rights referred to in Art. 1(2) of the Regulation and Art. 1 of this code, and in particular the limit of the essentiality of the information as to facts of public interest. Personal data relating to circumstances or facts made known directly by the data subjects or through their conduct in public may be processed.

Codice in materia di protezione dei dati personali, d.lgs. 30 giugno 2003, n. 196, Art. 137, comma 3

That single comma carries both halves of this decision. Its first sentence is the limit the Garante applied, and its second is a permission that tracks, in the code's own terms, the part of the complaint that failed, although the order reached that result through free expression rather than by citing this sentence.

Art. 2-quater, comma 4 closes the loop by providing that compliance with the deontological rules «costituisce condizione essenziale per la liceità e la correttezza del trattamento dei dati personali», an essential condition for the lawfulness and fairness of processing. That is the hinge that converts a breach of a professional code into a breach of data protection law carrying a monetary sanction.

Layer three is the Regole deontologiche relative al trattamento dei dati personali nell'esercizio dell'attività giornalistica, Annex A.1 to the Codice, published in the Gazzetta Ufficiale of 4 January 2019. Art. 6 is headed «Essenzialità dell'informazione». Its comma 2 is the sentence the Garante applied:

«La sfera privata delle persone note o che esercitano funzioni pubbliche deve essere rispettata se le notizie o i dati non hanno alcun rilievo sul loro ruolo o sulla loro vita pubblica.»

In English: the private sphere of well-known persons or of those exercising public functions must be respected where the news or the data have no bearing on their role or on their public life.

Regole deontologiche, Art. 6, comma 2

Comma 1 of the same article supplies the other half: disclosing news of significant public or social interest does not conflict with respect for the private sphere where the information, even in detail, is indispensable given the originality of the fact or the description of the particular manner in which it occurred, as well as the standing of those involved. Read together, the structure of the test becomes clear. Public interest is not a status a person carries. It is a property a particular item of information either has or lacks.

Art. 13, comma 1 of the same rules states their reach directly: they apply to professional journalists, to publicists and trainees, and to «chiunque altro, anche occasionalmente, eserciti attività pubblicistica», anyone else who engages, even occasionally, in publishing activity.

The Garante drew the operational consequence in the order itself: respect for the essentiality principle is required not only of those who practise journalism professionally, but of anyone who proceeds to publish or disseminate, even occasionally, articles, essays and other expressions of thought, including through the use of social platforms.

Recording a Conversation and Publishing It Are Two Different Questions

This is the part that matters most for readers who arrive here from a search about recording.

The Garante decided a publication question. It did not decide whether the underlying audio was lawfully made, and nothing in the order turns on that. The order addresses the diffusione, the dissemination, of an audio file and chat extracts, and it measures that dissemination against the essentiality standard. Whether a person may lawfully record a conversation they are taking part in is a separate question under separate rules, and our guide to recording conversations under Italian law works through it; the broader Italian recording law hub sets out how the pieces fit together.

Italian law keeps that division visible in its criminal code as well, and it is worth stating carefully because it is a different track from the one the Garante used. Art. 617-septies of the codice penale, inserted by Art. 1 of d.lgs. 29 dicembre 2017, n. 216, is headed «Diffusione di riprese e registrazioni fraudolente», dissemination of fraudulent recordings and footage. Its first paragraph reads:

«Chiunque, al fine di recare danno all'altrui reputazione o immagine, diffonde con qualsiasi mezzo riprese audio o video, compiute fraudolentemente, di incontri privati o registrazioni, pur esse fraudolente, di conversazioni, anche telefoniche o telematiche, svolte in sua presenza o con la sua partecipazione, è punito con la reclusione fino a quattro anni.»

In English: whoever, in order to harm another's reputation or image, disseminates by any means audio or video recordings, made fraudulently, of private meetings, or recordings, likewise fraudulent, of conversations, including telephone or electronic conversations, held in their presence or with their participation, is punished by imprisonment of up to four years.

Gazzetta Ufficiale, Serie Generale n. 8 of 11 January 2018, d.lgs. 29 dicembre 2017, n. 216, Art. 1

Two limiting clauses in the same article have to travel with that sentence. The second paragraph excludes punishability where dissemination derives directly and immediately from the use of the recordings in an administrative or judicial proceeding, or for the exercise of the right of defence or the right of reporting. The third paragraph makes the offence prosecutable only on a complaint (querela) by the injured person.

Note what that provision targets. The prohibited act is the dissemination, and the article expressly contemplates recordings of conversations held with the participation of the person who then spreads them. The legislature located the criminal wrong at the moment of publication, with an intent element and a set of exemptions attached.

None of that was applied here. The Garante's proceeding was administrative, its findings concerned the data protection rules, and the order contains no criminal finding against anyone. The elements of Art. 617-septies, in particular the fraudulent making of the recording and the intent to harm reputation or image, are not what the Garante examined. It is set out above to mark the boundary, not to suggest it applies to these facts.

Analysis: Why This Matters

The following is analysis from the Recording Law Editorial Team.

The reporting hook is the name and the number. The durable point is the test.

Italian law does not ask whether the subject is famous. It asks whether the specific information disclosed bears on the person's public role. Art. 6, comma 2 of the Regole deontologiche is phrased as a protection that survives fame rather than an exception that fame defeats, and Art. 137, comma 3 of the Codice privacy makes essentiality a limit on the right of reporting rather than a factor to be weighed against it. On the Garante's own account of the facts, the material concerned the data subject's intimate and affective sphere and was unconnected to his professional activity, which is why the balance came out where it did.

The second point is about who the rules bind. Art. 136, comma 1, lett. c) of the Codice privacy and Art. 13, comma 1 of the Regole deontologiche both reach occasional publishers, and this order applies them to a social platform publication. A reader who assumes that a code written for journalists cannot reach an ordinary account holder is reading the wrong sentence. The consequence runs both ways, though, and this is often missed: the same framework also supplied the mitigating factor of purposes referable to freedom of information under Art. 85 GDPR, and it is what allowed part of the complaint to fail.

That partial rejection deserves more attention than it will get. The Garante distinguished between disseminating a private exchange and commenting on statements a person chose to make in a broadcast accessible to the general public. The first was found unlawful; the second was not, because publicly made statements attenuate the expectation of privacy that attaches to them. The line is not between flattering and unflattering commentary. It is between material the person kept private and material the person put into public circulation themselves.

On the amount, some care is warranted. EUR 4,950 against a ceiling of EUR 20 million is not a measure of how seriously the authority treated the conduct. The order's own reasoning inventories aggravating factors, including an intentional character and financial benefit, and the press release says in terms that the figure was set as it was despite the gravity of the breach. Under Art. 83(1) GDPR sanctions must be effective, proportionate and dissuasive, and proportionality is assessed against the actual position of the person sanctioned, which here included no declared taxable income for the reference year. Whether a monetary sanction calibrated that way is dissuasive against a publisher whose revenue is difficult to trace is a real question, and the accessory publication sanction under Art. 166, comma 7 of the Codice privacy reads as the Garante's answer to part of it.

Finally, the enforcement sequence is instructive on its own. A general warning in August 2025, an urgent limitation of processing weeks later, formal proceedings in September 2025, and a monetary sanction in July 2026 published in September 2026. The Garante's fast tools were the corrective ones under Art. 58(2) GDPR. The money arrived nearly a year afterwards, by which time the material had already come down. For anyone whose private communications are circulating, the practical lesson in that timeline is that the urgent-measure track and the sanction track do different jobs at different speeds.

How This Affects You

These are general observations about Italian law, not advice about any particular situation.

If you publish in Italy, whether professionally or occasionally, the journalism title of the Codice privacy can apply to what you post. Art. 136, comma 1, lett. c) does not condition that on employment or registration, and Art. 2-quater, comma 4 makes compliance with the deontological rules a condition of lawful processing. The practical filter before publishing material about an identifiable person is not whether the person is well known, but whether this particular content bears on their public role.

If you are the subject of a publication in Italy, the GDPR complaint route under Art. 77 is what opened this file, and the authority's urgent powers under Art. 58(2) GDPR are what produced the fastest concrete result in it. A data protection complaint and a defamation claim are different actions addressing different wrongs: one concerns whether personal information should have been disclosed at all, the other concerns whether a statement was false and damaging to reputation, and material can be entirely true and still be unlawfully published. Our page on defamation over social media in Italy covers that second track, our overview of how Italy applies the GDPR through its Codice privacy covers the first, and our profile of Italy's data protection authority sets out the complaint-handling powers and corrective tools the body that issued this order can deploy.

What Happens Next

The order is an ordinanza ingiunzione. Under Art. 152 of the Codice privacy, disputes concerning the application of data protection legislation are assigned to the ordinary judicial authority, and comma 1-bis routes them through Art. 10 of d.lgs. 1 settembre 2011, n. 150. That article makes the competent forum, in the alternative, the tribunal of the place where the controller resides or has its seat or the tribunal of the data subject's place of residence, and requires any challenge to a Garante measure to be filed, on pain of inadmissibility, within 30 days of communication of the measure, or 60 days where the applicant resides abroad. The order carries that notice on its face, along with the reference to Art. 78 GDPR.

Separately, Art. 166, comma 8 of the Codice privacy allows the person sanctioned to settle within the same period by complying with any prescriptions and paying an amount equal to half the sanction imposed.

As of 5 September 2026 the published materials record no appeal and no settlement, and we make no prediction about either. The event that would convert this from an administrative decision into judicial precedent is a challenge filed under Art. 152 and decided by an ordinary court. Until that happens, the order stands as the Garante's own application of the essentiality standard to social media publication, which is authoritative within its administrative sphere but is not a court ruling.

This is general legal information, not legal advice. It describes an administrative decision of Italy's Garante per la protezione dei dati personali and the Italian and EU provisions that decision applies, verified as of September 5, 2026. It does not state the law of the United States or of any other country, and it is not a substitute for advice from a qualified Italian lawyer about a specific situation.

Related articles

• Recording conversations under Italian law, which covers the separate question of when a recording may be made
• Italy's recording law hub, for how consent, workplace and publication rules interact
• Italy's data protection authority, the body that issued this order
• How Italy applies the GDPR through its Codice privacy
• Defamation over social media in Italy, a different wrong from unlawful publication of private data

Last updated: 2026-09-05. Details verified as of 2026-09-05.