Italian Data Regulator Fines US Data Broker Lusha €2 Million

Italy’s data protection authority (Garante) imposed a €2 million fine on US‑based data broker Lusha Systems Inc. and ordered the company to cease processing and delete the personal data of individuals located in Italy. The decision, adopted on 14 July and announced on 27 July, found breaches of several GDPR provisions, including unlawful processing, lack of a valid legal basis, and failures in transparency and data‑minimisation.

Lusha, incorporated in Boston and without an establishment in the EU, operates a subscription platform that sells enriched contact records compiled from social‑media scraping, purchases from other brokers, and user contributions. The platform contained details of senior institutional figures, public‑administration staff, law‑enforcement officers and members of the judiciary. The Garante concluded that legitimate interest was not an adequate basis for the processing and that the privacy notice was unclear. The fine represents 10 % of the applicable ceiling, and Lusha must prove deletion of Italian‑territory data within 60 days, with the option to halve the fine during the appeal window.