Garante per la protezione dei dati personali (Italy) - 485/2026
Italy's DPA fines credit rating agency €400,000 for inadequate data subject request responses.
Italy's Garante per la protezione dei dati personali (DPA) has fined Cerved Group S.p.A., an Italian credit rating agency, €400,000. The fine was imposed for providing inadequate responses to data subject requests, which prevented individuals from exercising their rights, particularly regarding information on their calculated credit scores. The agency processed sensitive data including residential address, age, and place of birth, and its actions violated Articles 5(1)(a), 12, and 15 of the GDPR. The DPA also ordered the controller to establish a procedure for data subjects to exercise their right to rectification.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Cerved Group S.p.A.?
Get an email when a new story names Cerved Group S.p.A., usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonItaly's data protection authority fined Cerved Group €400,000 for providing inadequate responses to data subject access requests, effectively blocking individuals from understanding how their credit scores were calculated. The root issue was the absence of a compliant, structured process for handling GDPR rights requests — particularly the right of access (Article 15) and the right to rectification. This matters because credit scoring directly impacts people's financial lives, and opacity in how that data is processed undermines the fundamental principles of fairness and transparency enshrined in GDPR Article 5(1)(a). Organizations that process sensitive personal data must treat data subject rights as operational obligations, not administrative formalities.
What helps against this
How we list vendors- Identity governance and single sign-on
People who leave or change roles lose access everywhere at once, and forgotten accounts stop piling up.
- Compliance automation (GRC)
Evidence for NIS2, DORA and ISO 27001 is collected continuously, not in a rush before the audit.