[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fj6Rvi6SQnZTj4CXsCgkTzIrnGPP6OMVGD1wziXLXh0c":3},{"article":4,"iocs":41,"watch_terms":42,"solutions":43,"lesson":121},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":20,"category":21,"article_tags":25},"5d5f166d-5975-4053-a683-4a807720a91c","Garante per la protezione dei dati personali (Italy) - 10273659","garante-per-la-protezione-dei-dati-personali-italy-10273659-eab9f9","← Older revision Revision as of 18:50, 1 September 2026 Line 100: Line 100: }} }} The DPA fined an Italian credit information agency €120.000 for providing inadequate responses to data subject requests and violating privacy by design and default which actively prevented data subjects from exercising their rights. The DPA fined an Italian credit information agency €120,000 for providing inadequate responses to data subject requests and violating privacy by design and default which actively prevented data subjects from exercising their rights. == English Summary == == English Summary == Line 123: Line 123: Finally, the DPA found a violation of privacy by design and default in accordance with [[Article 25 GDPR]] as the controller used a file format not designed specifically for the utilities sector, failing to ensure adequate and effective data protection by design and default. Finally, the DPA found a violation of privacy by design and default in accordance with [[Article 25 GDPR]] as the controller used a file format not designed specifically for the utilities sector, failing to ensure adequate and effective data protection by design and default. The DPA imposed a fine of €120.000 pursuant to [[Article 83 GDPR]] taking into account, inter alia, the fact that this affected 561 data subjects. The DPA further ordered the controller revise their internal procedures to include the logic and criteria used, to ensure data subject can fully exercise their rights. The DPA imposed a fine of €120,000 pursuant to [[Article 83 GDPR]] taking into account, inter alia, the fact that this affected 561 data subjects. The DPA further ordered the controller revise their internal procedures to include the logic and criteria used, to ensure data subject can fully exercise their rights. == Comment == == Comment ==","Italy's Garante per la protezione dei dati personali has fined Experian Italia €120,000 for failing to adequately respond to data subject requests and for violating privacy by design and default principles. The agency's inadequate data protection measures prevented data subjects from exercising their rights, particularly concerning credit information used to deny energy supply.","Italian DPA fines Experian Italia €120,000 for inadequate responses and privacy violations.","https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=Garante_per_la_protezione_dei_dati_personali_(Italy)_-_10273659&diff=52869&oldid=52858","https:\u002F\u002Fgdprhub.eu\u002Fimages\u002Fe\u002Fec\u002FLogoIT.png","2026-09-01T18:50:17+00:00","2026-09-01T20:00:18.400003+00:00",7,[17],{"name":18,"type":19},"Experian","vendor","d95477d7-eb04-4fad-a2dc-be1428040ce7",{"id":20,"icon":22,"name":23,"slug":24},null,"Privacy Fines","privacy-fines",[26,31,36],{"category":27},{"id":28,"icon":22,"name":29,"slug":30},"3f0f8451-91df-4b6c-9a73-ef3b2509b7f1","GDPR","gdpr",{"category":32},{"id":33,"icon":22,"name":34,"slug":35},"53f9c4b6-8bc6-4964-9169-d09e5cd41d72","Compliance","compliance",{"category":37},{"id":38,"icon":22,"name":39,"slug":40},"614132b8-5837-4952-b8b5-c6c9a32a1d85","Privacy","privacy",[],[18],{"controls":44,"vendors":120},[45,74,103],{"slug":46,"name":47,"problem":48,"products":49},"identity-governance","Identity governance and single sign-on","People who leave or change roles lose access everywhere at once, and forgotten accounts stop piling up.",[50,58,66],{"vendor_slug":51,"vendor_name":52,"vendor_logo":53,"product_slug":54,"product_name":55,"url":56,"description":57},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","entra-id","Microsoft Entra ID","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fidentity-access\u002Fmicrosoft-entra-id","Cloud identity and access management with single sign-on, conditional access, passkeys and identity governance.",{"vendor_slug":59,"vendor_name":60,"vendor_logo":61,"product_slug":62,"product_name":63,"url":64,"description":65},"sailpoint","SailPoint","\u002Fvendor-logos\u002Fsailpoint.png","human-fabric","SailPoint Human Fabric","https:\u002F\u002Fwww.sailpoint.com\u002Fproducts\u002Fhuman-fabric","Identity governance platform, the successor to Identity Security Cloud: lifecycle management, access requests and continuous access reviews.",{"vendor_slug":67,"vendor_name":68,"vendor_logo":69,"product_slug":70,"product_name":71,"url":72,"description":73},"omada","Omada","\u002Fvendor-logos\u002Fomada.png","omada-identity-cloud","Omada Identity Cloud","https:\u002F\u002Fomadaidentity.com\u002Fproducts\u002Fomada-identity-cloud\u002F","Identity governance and administration delivered as a service.",{"slug":75,"name":76,"problem":77,"products":78},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.",[79,87,95],{"vendor_slug":80,"vendor_name":81,"vendor_logo":82,"product_slug":83,"product_name":84,"url":85,"description":86},"netskope","Netskope","\u002Fvendor-logos\u002Fnetskope.png","netskope-dlp","Netskope DLP","https:\u002F\u002Fwww.netskope.com\u002Fproducts\u002Fdata-loss-prevention","Data loss prevention for web, cloud apps, AI tools and endpoints.",{"vendor_slug":88,"vendor_name":89,"vendor_logo":90,"product_slug":91,"product_name":92,"url":93,"description":94},"proofpoint","Proofpoint","\u002Fvendor-logos\u002Fproofpoint.png","enterprise-dlp","Proofpoint Enterprise DLP","https:\u002F\u002Fwww.proofpoint.com\u002Fus\u002Fproducts\u002Fdata-loss-prevention","Data loss prevention across email, cloud and endpoints.",{"vendor_slug":96,"vendor_name":97,"vendor_logo":98,"product_slug":99,"product_name":100,"url":101,"description":102},"forcepoint","Forcepoint","\u002Fvendor-logos\u002Fforcepoint.png","forcepoint-dlp","Forcepoint DLP","https:\u002F\u002Fwww.forcepoint.com\u002Fproduct\u002Fdlp-data-loss-prevention","Data loss prevention for endpoints, network, email and cloud applications.",{"slug":104,"name":105,"problem":106,"products":107},"compliance-automation","Compliance automation (GRC)","Evidence for NIS2, DORA and ISO 27001 is collected continuously, not in a rush before the audit.",[108,114],{"vendor_slug":109,"vendor_name":110,"vendor_logo":111,"product_slug":109,"product_name":110,"url":112,"description":113},"drata","Drata","\u002Fvendor-logos\u002Fdrata.png","https:\u002F\u002Fdrata.com\u002F","Continuous control monitoring and audit readiness across security frameworks.",{"vendor_slug":115,"vendor_name":116,"vendor_logo":117,"product_slug":115,"product_name":116,"url":118,"description":119},"vanta","Vanta","\u002Fvendor-logos\u002Fvanta.png","https:\u002F\u002Fwww.vanta.com\u002F","Automated evidence collection and continuous monitoring for ISO 27001, SOC 2, NIS2 and other frameworks.",[],{"slug":122,"title":123,"body":124,"framework_refs":125,"framework_notes":136},"experian-italia-fined-120k-for-ignoring-data-subject-rights-and-privacy-by-design-failures","Experian Italia Fined €120K for Ignoring Data Subject Rights and Privacy by Design Failures","Experian Italia failed to establish adequate mechanisms for responding to data subject requests, leaving individuals unable to exercise their GDPR-guaranteed rights over credit data that directly impacted their access to essential services like energy. This case illustrates that privacy by design and default are not optional architectural features but legal obligations requiring active implementation from the ground up. The use of personal data in high-stakes decisions — such as denying utility supply — makes robust data governance especially critical. Regulatory fines like this signal that supervisory authorities are scrutinizing not just breaches, but systemic failures in data subject rights management.",[126,127,128,129,130,131,132,133,134,135],"GDPR Article 5(1)(f) – Integrity and confidentiality","GDPR Article 12 – Transparent information and communication","GDPR Article 15 – Right of access by the data subject","GDPR Article 17 – Right to erasure","GDPR Article 25 – Data protection by design and by default","GDPR Article 58 – Powers of supervisory authorities","NIST Privacy Framework PR.PO-P1 – Policies and procedures","NIST SP 800-53 IP-1 – Consent","CIS Control 3 – Data Protection","ISO\u002FIEC 27701 – Privacy Information Management",{}]