Severity: Info Other, enforcement EU
Italian DPA fines Poste Italiane and Deutsche Bank EUR 81,000 for lack of transparency in personal data processing
Original title: Italian DPA fines Poste Italiane and Deutsche Bank a combined EUR 81 000 for lack of transparency in personal data processing
- Published
- Source: edpb.europa.eu
- Effective
- Not stated
- Deadline
- Not stated
- Framework: GDPR
- Regulation (EU) 2016/679 (as corrected 2018) source
- in 13 days
- Indicative European Parliament plenary date (first reading) for the small mid-caps omnibus, COM(2025) 501, which would raise the Article 30 records exemption to organisations under 750 employees - a forecast, not a fixed date source
Why it matters
The Italian Data Protection Authority fined Poste Italiane and Deutsche Bank for breaching transparency requirements under GDPR Articles 5(1)(a) and 13 when processing personal data for loan applications. Both companies acted as independent data controllers but failed to clearly disclose their respective roles, the personal data exchanged between them, and data recipients in their privacy notices. The companies must update their privacy notices to reflect accurate information about data processing activities and provide clear, complete details to enable individuals to understand how their data are used.
What changed
- Poste Italiane fined EUR 48,000 for failing to provide sufficiently clear information on loan promotion and distribution processing, including recipients of personal data and information flows involving Deutsche Bank
- Deutsche Bank fined EUR 33,000 for failing to correctly identify Poste Italiane as a recipient of personal data acting as an independent data controller
- Deutsche Bank ordered to amend its privacy notice within six months to accurately reflect Poste Italiane's role as an independent data controller and provide compliance evidence
- Deutsche Bank issued internal instructions to limit inclusion of personal and credit information in loan application communications
- Poste Italiane updated its privacy notice following the investigation and erased the complainant's personal data
Who is affected
Financial services sector, specifically companies providing loan services and intermediaries processing customer financial data in the EU (Italy). Affects organizations acting as data controllers who must ensure privacy notices accurately reflect their roles and data processing activities.
What to do
AI-assisted summary of the official document; the official text prevails. Not legal advice.