[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fReNIziLbPofgZFdvjPccXFZXYw2_zSxewidCiIDon2Y":3},{"article":4,"iocs":43,"watch_terms":44,"solutions":45,"lesson":103},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":20,"category":21,"article_tags":25},"3f0f6f3f-ec90-418f-a290-962d37e5ce3c","Garante per la protezione dei dati personali (Italy) - 485\u002F2026","garante-per-la-protezione-dei-dati-personali-italy-485-2026-3c41d1","Created page with \"{{DPAdecisionBOX |Jurisdiction=Italy |DPA-BG-Color= |DPAlogo=LogoIT.png |DPA_Abbrevation=Garante per la protezione dei dati personali |DPA_With_Country=Garante per la protezione dei dati personali (Italy) |Case_Number_Name=485\u002F2026 |ECLI= |Original_Source_Name_1=Garante per la protezione dei dati personali |Original_Source_Link_1=https:\u002F\u002Fwww.garanteprivacy.it\u002Fweb\u002Fguest\u002Fhome\u002Fdocweb\u002F-\u002Fdocweb-display\u002Fdocweb\u002F10273976 |Original_Source_Language_1=Italian |Original_Source_L...\" Show changes","Italy's Garante per la protezione dei dati personali has fined Cerved Group S.p.A. €400,000 for failing to adequately respond to data subject requests. The commercial information system processed personal data for creditworthiness assessments, leading to energy supply denials for some individuals. The Garante found that Cerved Group provided incomplete information, including scores and the logic behind them, hindering data subjects' ability to exercise their rights under GDPR.","Italy's Garante fines Cerved Group €400,000 for inadequate data subject request responses.","https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=Garante_per_la_protezione_dei_dati_personali_(Italy)_-_485\u002F2026&diff=52853&oldid=0","https:\u002F\u002Fgdprhub.eu\u002Fimages\u002Fe\u002Fec\u002FLogoIT.png","2026-09-01T08:04:04+00:00","2026-09-01T10:00:17.937531+00:00",7,[17],{"name":18,"type":19},"Cerved Group S.p.A.","vendor","d95477d7-eb04-4fad-a2dc-be1428040ce7",{"id":20,"icon":22,"name":23,"slug":24},null,"Privacy Fines","privacy-fines",[26,31,36,41],{"category":27},{"id":28,"icon":22,"name":29,"slug":30},"3f0f8451-91df-4b6c-9a73-ef3b2509b7f1","GDPR","gdpr",{"category":32},{"id":33,"icon":22,"name":34,"slug":35},"53f9c4b6-8bc6-4964-9169-d09e5cd41d72","Compliance","compliance",{"category":37},{"id":38,"icon":22,"name":39,"slug":40},"c5c77cdb-f7d7-4990-9436-c81dcbff1163","Policy","policy",{"category":42},{"id":20,"icon":22,"name":23,"slug":24},[],[18],{"controls":46,"vendors":102},[47,76],{"slug":48,"name":49,"problem":50,"products":51},"identity-governance","Identity governance and single sign-on","People who leave or change roles lose access everywhere at once, and forgotten accounts stop piling up.",[52,60,68],{"vendor_slug":53,"vendor_name":54,"vendor_logo":55,"product_slug":56,"product_name":57,"url":58,"description":59},"sailpoint","SailPoint","\u002Fvendor-logos\u002Fsailpoint.png","human-fabric","SailPoint Human Fabric","https:\u002F\u002Fwww.sailpoint.com\u002Fproducts\u002Fhuman-fabric","Identity governance platform, the successor to Identity Security Cloud: lifecycle management, access requests and continuous access reviews.",{"vendor_slug":61,"vendor_name":62,"vendor_logo":63,"product_slug":64,"product_name":65,"url":66,"description":67},"omada","Omada","\u002Fvendor-logos\u002Fomada.png","omada-identity-cloud","Omada Identity Cloud","https:\u002F\u002Fomadaidentity.com\u002Fproducts\u002Fomada-identity-cloud\u002F","Identity governance and administration delivered as a service.",{"vendor_slug":69,"vendor_name":70,"vendor_logo":71,"product_slug":72,"product_name":73,"url":74,"description":75},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","entra-id","Microsoft Entra ID","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fidentity-access\u002Fmicrosoft-entra-id","Cloud identity and access management with single sign-on, conditional access, passkeys and identity governance.",{"slug":77,"name":78,"problem":79,"products":80},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.",[81,86,94],{"vendor_slug":69,"vendor_name":70,"vendor_logo":71,"product_slug":82,"product_name":83,"url":84,"description":85},"purview-dlp","Microsoft Purview Data Loss Prevention","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fdata-security-governance\u002Fmicrosoft-purview-data-security","Data classification and loss prevention across Microsoft 365, endpoints and connected cloud apps.",{"vendor_slug":87,"vendor_name":88,"vendor_logo":89,"product_slug":90,"product_name":91,"url":92,"description":93},"forcepoint","Forcepoint","\u002Fvendor-logos\u002Fforcepoint.png","forcepoint-dlp","Forcepoint DLP","https:\u002F\u002Fwww.forcepoint.com\u002Fproduct\u002Fdlp-data-loss-prevention","Data loss prevention for endpoints, network, email and cloud applications.",{"vendor_slug":95,"vendor_name":96,"vendor_logo":97,"product_slug":98,"product_name":99,"url":100,"description":101},"netskope","Netskope","\u002Fvendor-logos\u002Fnetskope.png","netskope-dlp","Netskope DLP","https:\u002F\u002Fwww.netskope.com\u002Fproducts\u002Fdata-loss-prevention","Data loss prevention for web, cloud apps, AI tools and endpoints.",[],{"slug":104,"title":105,"body":106,"framework_refs":107,"framework_notes":118},"cerved-group-fined-400k-for-failing-to-honor-gdpr-data-subject-rights","Cerved Group Fined €400K for Failing to Honor GDPR Data Subject Rights","Cerved Group S.p.A. violated GDPR by failing to adequately respond to data subject access requests, withholding critical information such as credit scores and the algorithmic logic behind them. This opacity left individuals unable to understand or challenge decisions that materially impacted their lives, including denials of energy supply. Automated decision-making systems that affect individuals must provide meaningful explanations to comply with GDPR Articles 13, 14, and 22. The case highlights that data controllers in the credit and commercial information sector bear heightened obligations when profiling individuals, and inadequate transparency can trigger significant regulatory penalties.",[108,109,110,111,112,113,114,115,116,117],"GDPR Article 13 – Information to be provided where personal data are collected","GDPR Article 14 – Information where personal data have not been obtained from the data subject","GDPR Article 15 – Right of access by the data subject","GDPR Article 22 – Automated individual decision-making, including profiling","GDPR Article 83(4) – Administrative fines","NIST Privacy Framework PR.PO-P6 (Policies for data subject rights)","NIST SP 800-53 IP-1 (Consent), IP-2 (Individual Access)","CIS Control 3 – Data Protection","ISO\u002FIEC 27701:2019 – Privacy Information Management (Section 7.3 Data Subject Rights)","ITIL Service Management – Request Fulfilment Process",{}]