[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fqJawYa8e6uIAbN0o0x9XLVnLbrfQLOIH79sXXNA_hsM":3},{"article":4,"iocs":46,"watch_terms":47,"solutions":48,"lesson":97},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":23,"category":24,"article_tags":28},"9b306578-61a2-49ec-b881-0cd5cd5ad0d9","Garante per la protezione dei dati personali (Italy) - 10273659","garante-per-la-protezione-dei-dati-personali-italy-10273659-dc53b3","Created page with \"{{DPAdecisionBOX |Jurisdiction=Italy |DPA-BG-Color= |DPAlogo=LogoIT.png |DPA_Abbrevation=Garante per la protezione dei dati personali |DPA_With_Country=Garante per la protezione dei dati personali (Italy) |Case_Number_Name=10273659 |ECLI= |Original_Source_Name_1=Garante per la protezione dei dati personali |Original_Source_Link_1=https:\u002F\u002Fwww.garanteprivacy.it\u002Fweb\u002Fguest\u002Fhome\u002Fdocweb\u002F-\u002Fdocweb-display\u002Fdocweb\u002F10273659 |Original_Source_Language_1=Italian |Original_Source_L...\" Show changes","Italy's Garante per la protezione dei dati personali has fined Experian Italia S.p.A. €120,000 for violating GDPR. The credit information agency provided inadequate responses to data subject requests regarding creditworthiness assessments, failing to disclose information about generated scores and the methods used to derive them. The DPA found this practice violated privacy by design and default principles, hindering individuals' ability to exercise their rights.","Italy's DPA fines Experian Italia €120,000 for inadequate data subject responses.","https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=Garante_per_la_protezione_dei_dati_personali_(Italy)_-_10273659&diff=52856&oldid=0","https:\u002F\u002Fgdprhub.eu\u002Fimages\u002Fe\u002Fec\u002FLogoIT.png","2026-09-01T08:50:23+00:00","2026-09-01T10:00:17.937531+00:00",7,[17,20],{"name":18,"type":19},"Experian Italia S.p.A","vendor",{"name":21,"type":22},"credit information system","product","c5c77cdb-f7d7-4990-9436-c81dcbff1163",{"id":23,"icon":25,"name":26,"slug":27},null,"Policy","policy",[29,34,39,41],{"category":30},{"id":31,"icon":25,"name":32,"slug":33},"3f0f8451-91df-4b6c-9a73-ef3b2509b7f1","GDPR","gdpr",{"category":35},{"id":36,"icon":25,"name":37,"slug":38},"53f9c4b6-8bc6-4964-9169-d09e5cd41d72","Compliance","compliance",{"category":40},{"id":23,"icon":25,"name":26,"slug":27},{"category":42},{"id":43,"icon":25,"name":44,"slug":45},"d95477d7-eb04-4fad-a2dc-be1428040ce7","Privacy Fines","privacy-fines",[],[18,21],{"controls":49,"vendors":96},[50,79],{"slug":51,"name":52,"problem":53,"products":54},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.",[55,63,71],{"vendor_slug":56,"vendor_name":57,"vendor_logo":58,"product_slug":59,"product_name":60,"url":61,"description":62},"forcepoint","Forcepoint","\u002Fvendor-logos\u002Fforcepoint.png","forcepoint-dlp","Forcepoint DLP","https:\u002F\u002Fwww.forcepoint.com\u002Fproduct\u002Fdlp-data-loss-prevention","Data loss prevention for endpoints, network, email and cloud applications.",{"vendor_slug":64,"vendor_name":65,"vendor_logo":66,"product_slug":67,"product_name":68,"url":69,"description":70},"netskope","Netskope","\u002Fvendor-logos\u002Fnetskope.png","netskope-dlp","Netskope DLP","https:\u002F\u002Fwww.netskope.com\u002Fproducts\u002Fdata-loss-prevention","Data loss prevention for web, cloud apps, AI tools and endpoints.",{"vendor_slug":72,"vendor_name":73,"vendor_logo":74,"product_slug":75,"product_name":76,"url":77,"description":78},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","purview-dlp","Microsoft Purview Data Loss Prevention","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fdata-security-governance\u002Fmicrosoft-purview-data-security","Data classification and loss prevention across Microsoft 365, endpoints and connected cloud apps.",{"slug":80,"name":81,"problem":82,"products":83},"compliance-automation","Compliance automation (GRC)","Evidence for NIS2, DORA and ISO 27001 is collected continuously, not in a rush before the audit.",[84,90],{"vendor_slug":85,"vendor_name":86,"vendor_logo":87,"product_slug":85,"product_name":86,"url":88,"description":89},"drata","Drata","\u002Fvendor-logos\u002Fdrata.png","https:\u002F\u002Fdrata.com\u002F","Continuous control monitoring and audit readiness across security frameworks.",{"vendor_slug":91,"vendor_name":92,"vendor_logo":93,"product_slug":91,"product_name":92,"url":94,"description":95},"vanta","Vanta","\u002Fvendor-logos\u002Fvanta.png","https:\u002F\u002Fwww.vanta.com\u002F","Automated evidence collection and continuous monitoring for ISO 27001, SOC 2, NIS2 and other frameworks.",[],{"slug":98,"title":99,"body":100,"framework_refs":101,"framework_notes":112},"experian-italia-fined-120k-for-opaque-credit-scoring-practices-under-gdpr","Experian Italia Fined €120K for Opaque Credit Scoring Practices Under GDPR","Experian Italia failed to provide data subjects with meaningful information about how their creditworthiness scores were calculated, violating GDPR's transparency and privacy-by-design principles. This is not merely a procedural failure — concealing automated decision-making logic directly undermines individuals' ability to contest inaccurate assessments and exercise their rights under Articles 13, 14, and 22 of the GDPR. Organizations that process personal data for profiling or scoring purposes are legally required to explain the logic involved, not just acknowledge that a score exists. The €120,000 fine signals that regulators are intensifying scrutiny of algorithmic transparency, particularly in the financial and credit sectors. Companies relying on automated scoring models must treat explainability as a compliance requirement, not a technical afterthought.",[102,103,104,105,106,107,108,109,110,111],"GDPR Article 13 – Information to be provided where personal data are collected from the data subject","GDPR Article 14 – Information to be provided where personal data have not been obtained from the data subject","GDPR Article 15 – Right of access by the data subject","GDPR Article 22 – Automated individual decision-making, including profiling","GDPR Article 25 – Data protection by design and by default","NIST Privacy Framework PR.PO-P4 – Policies, processes, and procedures for privacy by design","NIST SP 800-53 PT-6 – System of Records Notice","CIS Control 3 – Data Protection","ISO\u002FIEC 27701:2019 – Privacy Information Management (PIMS)","ITIL Service Design – Transparency and accountability in service delivery",{}]