Garante per la protezione dei dati personali (Italy) - 485/2026
Italian DPA fines Cerved Group €400,000 for inadequate data subject request responses.
Italy's Garante per la protezione dei dati personali (DPA) has fined Cerved Group S.p.A., an Italian credit rating agency, €400,000 for failing to adequately respond to data subject requests. The agency processed personal data for creditworthiness verification, leading to energy supply denials for some individuals. The DPA found that Cerved provided incomplete information, including scores and the logic behind them, hindering data subjects' ability to exercise their rights to access, rectification, and challenge decisions.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Cerved Group S.p.A.?
Get an email when a new story names Cerved Group S.p.A., usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonCerved Group S.p.A. was fined €400,000 by Italy's data protection authority for providing incomplete responses to data subject access requests, specifically failing to disclose credit scores and the logic behind automated decisions. This directly hindered individuals' ability to challenge decisions that led to real-world consequences, such as denial of energy supply. Under GDPR Articles 13–15 and 22, organizations using automated decision-making must provide meaningful, intelligible explanations of the logic involved. This case underscores that data subject rights are not a formality — inadequate or opaque responses to such requests constitute a serious compliance failure with significant regulatory and reputational consequences.
What helps against this
How we list vendors- Identity governance and single sign-on
People who leave or change roles lose access everywhere at once, and forgotten accounts stop piling up.
- Data loss prevention (DLP)
Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.