[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f9T-rhAuR4doTLTSN8gT6nVEG2ozR6ZlAzTzy_se2ZcY":3},{"article":4,"iocs":43,"watch_terms":44,"solutions":45,"lesson":106},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":20,"category":21,"article_tags":25},"91ca9c11-5cd4-4c85-b37c-77134660724a","Garante per la protezione dei dati personali (Italy) - 485\u002F2026","garante-per-la-protezione-dei-dati-personali-italy-485-2026-4ed6e3","← Older revision Revision as of 08:07, 1 September 2026 (One intermediate revision by the same user not shown) Line 104: Line 104: }} }} The DPA fined an Italian commercial information system €400.000 for providing inadequate responses to data subject request, effectively preventing them from exercising their rights. The DPA fined an Italian credit rating agency €400.000 for providing inadequate responses to data subject request, effectively preventing them from exercising their rights. == English Summary == == English Summary == === Facts === === Facts === The DPA received several complaints from data subjects concerning Cerved Group S.p.A. (the controller) an Italian commercial information system. The controller was processing the personal data of data subjects for the purpose of verifying the creditworthiness of potential customers of two energy suppliers. As a result of the risk profiles attributed to them, data subjects were declined the supply of energy. The DPA received several complaints from data subjects concerning Cerved Group S.p.A. (the controller) an Italian credit rating agency. The controller was processing the personal data of data subjects for the purpose of verifying the creditworthiness of potential customers of two energy suppliers. As a result of the risk profiles attributed to them, data subjects were declined the supply of energy. When data subjects requested access to their data from the controller under [[Article 15 GDPR]], they were informed that their databases did not contain negative information or adverse events justifying the denial of energy supply. When data subjects requested access to their data from the controller under [[Article 15 GDPR|Article 15 GDPR]], they were informed that their databases did not contain negative information or adverse events justifying the denial of energy supply. The DPA conducted an investigation, and found that the controller provided different responses to different data subject’s depending on whether their personal data had been recorded in their system. The DPA conducted an investigation, and found that the controller provided different responses to different data subject’s depending on whether their personal data had been recorded in their system. Line 117: Line 118: For those data subjects where information was present on their databases the controller provided them with the personal data which was present. The DPA further found that the controller did not provide reference to the scores and sub-scores assigned by the controller to the data subjects. For those data subjects where information was present on their databases the controller provided them with the personal data which was present. The DPA further found that the controller did not provide reference to the scores and sub-scores assigned by the controller to the data subjects. === Holding === === Holding === The DPA held that in light of the controller inadequately responding to data subjects requests, which prevented them from accessing all the information processed for the purpose of calculating their risk profile, and to understand how the score was used in the decisions of the energy suppliers, data subjects were effectively prevented from exercising their rights. The DPA held that in light of the controller inadequately responding to data subjects requests, which prevented them from accessing all the information processed for the purpose of calculating their risk profile, and to understand how the score was used in the decisions of the energy suppliers, data subjects were effectively prevented from exercising their rights. Particularly, the DPA held that the controller did not provide data subjects with all the necessary information, such as certain scores, and the logic and criteria used to calculate the scores, which prevented them from determining the lawfulness, fairness and accuracy of the data. This undermined their ability to exercise their right to rectification pursuant to [[Article 16 GDPR|Article 16 GDPR]], and right to obtain human intervention, express their opinion and challenge the decision made, pursuant to Article 22(3). Particularly, the DPA held that the controller did not provide data subjects with all the necessary information, such as certain scores, and the logic and criteria used to calculate the scores, which prevented them from determining the lawfulness, fairness and accuracy of the data. This undermined their ability to exercise their right to rectification pursuant to [[Article 16 GDPR]], and right to obtain human intervention, express their opinion and challenge the decision made, pursuant to [[Article 22 GDPR|Article 22(3) GDPR]]. In connection with sensitive nature of the information processed by the controller (residential address, age and place of birth) which relates to a data subjects creditworthiness with potentially prejudicial consequences, the controller was found in violation of Articles 5(1)(a), 12 and 15 GDPR. In connection with sensitive nature of the information processed by the controller (residential address, age and place of birth) which relates to a data subjects creditworthiness with potentially prejudicial consequences, the controller was found in violation of [[Article 5 GDPR|Article 5(1)(a) GDPR]], [[Article 12 GDPR]] and [[Article 15 GDPR]]. The DPA imposed a €400.000 fine on the controller pursuant to [[Article 83 GDPR|Article 83 GDPR]] taking into account, inter alia, the fact that this affected 2.094 data subjects. The DPA further ordered the controller to establish a procedure allowing data subjects to exercise their right to rectification pursuant to [[Article 16 GDPR|Article 16 GDPR]]. The DPA imposed a €400.000 fine on the controller pursuant to [[Article 83 GDPR]] taking into account, inter alia, the fact that this affected 2.094 data subjects. The DPA further ordered the controller to establish a procedure allowing data subjects to exercise their right to rectification pursuant to [[Article 16 GDPR]]. == Comment == == Comment ==","Italy's Garante per la protezione dei dati personali (DPA) has fined Cerved Group S.p.A., an Italian credit rating agency, €400,000 for failing to adequately respond to data subject requests. The agency processed personal data for creditworthiness verification, leading to energy supply denials for some individuals. The DPA found that Cerved provided incomplete information, including scores and the logic behind them, hindering data subjects' ability to exercise their rights to access, rectification, and challenge decisions.","Italian DPA fines Cerved Group €400,000 for inadequate data subject request responses.","https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=Garante_per_la_protezione_dei_dati_personali_(Italy)_-_485\u002F2026&diff=52855&oldid=52853","https:\u002F\u002Fgdprhub.eu\u002Fimages\u002Fe\u002Fec\u002FLogoIT.png","2026-09-01T08:07:04+00:00","2026-09-01T10:00:17.937531+00:00",7,[17],{"name":18,"type":19},"Cerved Group S.p.A.","vendor","c5c77cdb-f7d7-4990-9436-c81dcbff1163",{"id":20,"icon":22,"name":23,"slug":24},null,"Policy","policy",[26,31,36,38],{"category":27},{"id":28,"icon":22,"name":29,"slug":30},"3f0f8451-91df-4b6c-9a73-ef3b2509b7f1","GDPR","gdpr",{"category":32},{"id":33,"icon":22,"name":34,"slug":35},"53f9c4b6-8bc6-4964-9169-d09e5cd41d72","Compliance","compliance",{"category":37},{"id":20,"icon":22,"name":23,"slug":24},{"category":39},{"id":40,"icon":22,"name":41,"slug":42},"d95477d7-eb04-4fad-a2dc-be1428040ce7","Privacy Fines","privacy-fines",[],[18],{"controls":46,"vendors":105},[47,76],{"slug":48,"name":49,"problem":50,"products":51},"identity-governance","Identity governance and single sign-on","People who leave or change roles lose access everywhere at once, and forgotten accounts stop piling up.",[52,60,68],{"vendor_slug":53,"vendor_name":54,"vendor_logo":55,"product_slug":56,"product_name":57,"url":58,"description":59},"sailpoint","SailPoint","\u002Fvendor-logos\u002Fsailpoint.png","human-fabric","SailPoint Human Fabric","https:\u002F\u002Fwww.sailpoint.com\u002Fproducts\u002Fhuman-fabric","Identity governance platform, the successor to Identity Security Cloud: lifecycle management, access requests and continuous access reviews.",{"vendor_slug":61,"vendor_name":62,"vendor_logo":63,"product_slug":64,"product_name":65,"url":66,"description":67},"omada","Omada","\u002Fvendor-logos\u002Fomada.png","omada-identity-cloud","Omada Identity Cloud","https:\u002F\u002Fomadaidentity.com\u002Fproducts\u002Fomada-identity-cloud\u002F","Identity governance and administration delivered as a service.",{"vendor_slug":69,"vendor_name":70,"vendor_logo":71,"product_slug":72,"product_name":73,"url":74,"description":75},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","workforce-identity","Okta Workforce Identity","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fworkforce-identity\u002F","Single sign-on, adaptive MFA including phishing-resistant methods, and lifecycle management for employees.",{"slug":77,"name":78,"problem":79,"products":80},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.",[81,89,97],{"vendor_slug":82,"vendor_name":83,"vendor_logo":84,"product_slug":85,"product_name":86,"url":87,"description":88},"netskope","Netskope","\u002Fvendor-logos\u002Fnetskope.png","netskope-dlp","Netskope DLP","https:\u002F\u002Fwww.netskope.com\u002Fproducts\u002Fdata-loss-prevention","Data loss prevention for web, cloud apps, AI tools and endpoints.",{"vendor_slug":90,"vendor_name":91,"vendor_logo":92,"product_slug":93,"product_name":94,"url":95,"description":96},"proofpoint","Proofpoint","\u002Fvendor-logos\u002Fproofpoint.png","enterprise-dlp","Proofpoint Enterprise DLP","https:\u002F\u002Fwww.proofpoint.com\u002Fus\u002Fproducts\u002Fdata-loss-prevention","Data loss prevention across email, cloud and endpoints.",{"vendor_slug":98,"vendor_name":99,"vendor_logo":100,"product_slug":101,"product_name":102,"url":103,"description":104},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","purview-dlp","Microsoft Purview Data Loss Prevention","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fdata-security-governance\u002Fmicrosoft-purview-data-security","Data classification and loss prevention across Microsoft 365, endpoints and connected cloud apps.",[],{"slug":107,"title":108,"body":109,"framework_refs":110,"framework_notes":122},"cerved-fined-400k-for-failing-to-honor-data-subject-rights-under-gdpr","Cerved Fined €400K for Failing to Honor Data Subject Rights Under GDPR","Cerved Group S.p.A. was fined €400,000 by Italy's data protection authority for providing incomplete responses to data subject access requests, specifically failing to disclose credit scores and the logic behind automated decisions. This directly hindered individuals' ability to challenge decisions that led to real-world consequences, such as denial of energy supply. Under GDPR Articles 13–15 and 22, organizations using automated decision-making must provide meaningful, intelligible explanations of the logic involved. This case underscores that data subject rights are not a formality — inadequate or opaque responses to such requests constitute a serious compliance failure with significant regulatory and reputational consequences.",[111,112,113,114,115,116,117,118,119,120,121],"GDPR Article 13 – Information to be provided where personal data are collected","GDPR Article 14 – Information where personal data have not been obtained from the data subject","GDPR Article 15 – Right of access by the data subject","GDPR Article 16 – Right to rectification","GDPR Article 22 – Automated individual decision-making, including profiling","GDPR Recital 71 – Profiling and automated decision-making transparency","NIST Privacy Framework PR.PO-P6 – Policies for responding to data subject requests","NIST SP 800-53 PT-6 – System of Records Notice","CIS Control 3 – Data Protection","ISO\u002FIEC 29101 – Privacy Architecture Framework","ITIL Service Operation – Request Fulfilment Process",{}]