[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f-rHUYPO3A-xCWmDaeSLdBPx5a-dFWfTGvGlVpcMZrU4":3},{"article":4,"iocs":45,"watch_terms":46,"solutions":47,"lesson":96},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":23,"category":24,"article_tags":28},"e11bde4b-0d9a-4e4d-b7c8-df3c951bee27","Garante per la protezione dei dati personali (Italy) - 485\u002F2026","garante-per-la-protezione-dei-dati-personali-italy-485-2026-bb56f9","← Older revision Revision as of 18:49, 1 September 2026 Line 104: Line 104: }} }} The DPA fined an Italian credit rating agency €400.000 for providing inadequate responses to data subject request, effectively preventing them from exercising their rights. The DPA fined an credit rating agency €400,000 for providing inadequate responses to data subjects' request, effectively preventing them from exercising their rights. In particular, the credit information agency did not provide sufficient information on the calculated credit scores. == English Summary == == English Summary == Line 125: Line 125: In connection with sensitive nature of the information processed by the controller (residential address, age and place of birth) which relates to a data subjects creditworthiness with potentially prejudicial consequences, the controller was found in violation of [[Article 5 GDPR|Article 5(1)(a) GDPR]], [[Article 12 GDPR]] and [[Article 15 GDPR]]. In connection with sensitive nature of the information processed by the controller (residential address, age and place of birth) which relates to a data subjects creditworthiness with potentially prejudicial consequences, the controller was found in violation of [[Article 5 GDPR|Article 5(1)(a) GDPR]], [[Article 12 GDPR]] and [[Article 15 GDPR]]. The DPA imposed a €400.000 fine on the controller pursuant to [[Article 83 GDPR]] taking into account, inter alia, the fact that this affected 2.094 data subjects. The DPA further ordered the controller to establish a procedure allowing data subjects to exercise their right to rectification pursuant to [[Article 16 GDPR]]. The DPA imposed a €400,000 fine on the controller pursuant to [[Article 83 GDPR]] taking into account, inter alia, the fact that this affected 2.094 data subjects. The DPA further ordered the controller to establish a procedure allowing data subjects to exercise their right to rectification pursuant to [[Article 16 GDPR]]. == Comment == == Comment ==","Italy's Garante per la protezione dei dati personali (DPA) has fined Cerved Group S.p.A., an Italian credit rating agency, €400,000. The fine was imposed for providing inadequate responses to data subject requests, which prevented individuals from exercising their rights, particularly regarding information on their calculated credit scores. The agency processed sensitive data including residential address, age, and place of birth, and its actions violated Articles 5(1)(a), 12, and 15 of the GDPR. The DPA also ordered the controller to establish a procedure for data subjects to exercise their right to rectification.","Italy's DPA fines credit rating agency €400,000 for inadequate data subject request responses.","https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=Garante_per_la_protezione_dei_dati_personali_(Italy)_-_485\u002F2026&diff=52868&oldid=52867","https:\u002F\u002Fgdprhub.eu\u002Fimages\u002Fe\u002Fec\u002FLogoIT.png","2026-09-01T18:49:29+00:00","2026-09-01T20:00:18.400003+00:00",7,[17,20],{"name":18,"type":19},"Cerved Group S.p.A.","vendor",{"name":21,"type":22},"GDPR","product","c5c77cdb-f7d7-4990-9436-c81dcbff1163",{"id":23,"icon":25,"name":26,"slug":27},null,"Policy","policy",[29,33,38,40],{"category":30},{"id":31,"icon":25,"name":21,"slug":32},"3f0f8451-91df-4b6c-9a73-ef3b2509b7f1","gdpr",{"category":34},{"id":35,"icon":25,"name":36,"slug":37},"53f9c4b6-8bc6-4964-9169-d09e5cd41d72","Compliance","compliance",{"category":39},{"id":23,"icon":25,"name":26,"slug":27},{"category":41},{"id":42,"icon":25,"name":43,"slug":44},"d95477d7-eb04-4fad-a2dc-be1428040ce7","Privacy Fines","privacy-fines",[],[18,21],{"controls":48,"vendors":95},[49,78],{"slug":50,"name":51,"problem":52,"products":53},"identity-governance","Identity governance and single sign-on","People who leave or change roles lose access everywhere at once, and forgotten accounts stop piling up.",[54,62,70],{"vendor_slug":55,"vendor_name":56,"vendor_logo":57,"product_slug":58,"product_name":59,"url":60,"description":61},"omada","Omada","\u002Fvendor-logos\u002Fomada.png","omada-identity-cloud","Omada Identity Cloud","https:\u002F\u002Fomadaidentity.com\u002Fproducts\u002Fomada-identity-cloud\u002F","Identity governance and administration delivered as a service.",{"vendor_slug":63,"vendor_name":64,"vendor_logo":65,"product_slug":66,"product_name":67,"url":68,"description":69},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","workforce-identity","Okta Workforce Identity","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fworkforce-identity\u002F","Single sign-on, adaptive MFA including phishing-resistant methods, and lifecycle management for employees.",{"vendor_slug":71,"vendor_name":72,"vendor_logo":73,"product_slug":74,"product_name":75,"url":76,"description":77},"sailpoint","SailPoint","\u002Fvendor-logos\u002Fsailpoint.png","human-fabric","SailPoint Human Fabric","https:\u002F\u002Fwww.sailpoint.com\u002Fproducts\u002Fhuman-fabric","Identity governance platform, the successor to Identity Security Cloud: lifecycle management, access requests and continuous access reviews.",{"slug":79,"name":80,"problem":81,"products":82},"compliance-automation","Compliance automation (GRC)","Evidence for NIS2, DORA and ISO 27001 is collected continuously, not in a rush before the audit.",[83,89],{"vendor_slug":84,"vendor_name":85,"vendor_logo":86,"product_slug":84,"product_name":85,"url":87,"description":88},"vanta","Vanta","\u002Fvendor-logos\u002Fvanta.png","https:\u002F\u002Fwww.vanta.com\u002F","Automated evidence collection and continuous monitoring for ISO 27001, SOC 2, NIS2 and other frameworks.",{"vendor_slug":90,"vendor_name":91,"vendor_logo":92,"product_slug":90,"product_name":91,"url":93,"description":94},"drata","Drata","\u002Fvendor-logos\u002Fdrata.png","https:\u002F\u002Fdrata.com\u002F","Continuous control monitoring and audit readiness across security frameworks.",[],{"slug":97,"title":98,"body":99,"framework_refs":100,"framework_notes":110},"cerved-fined-400k-for-failing-to-honor-gdpr-data-subject-rights","Cerved Fined €400K for Failing to Honor GDPR Data Subject Rights","Italy's data protection authority fined Cerved Group €400,000 for providing inadequate responses to data subject access requests, effectively blocking individuals from understanding how their credit scores were calculated. The root issue was the absence of a compliant, structured process for handling GDPR rights requests — particularly the right of access (Article 15) and the right to rectification. This matters because credit scoring directly impacts people's financial lives, and opacity in how that data is processed undermines the fundamental principles of fairness and transparency enshrined in GDPR Article 5(1)(a). Organizations that process sensitive personal data must treat data subject rights as operational obligations, not administrative formalities.",[101,102,103,104,105,106,107,108,109],"GDPR Article 5(1)(a) — Lawfulness, fairness, and transparency","GDPR Article 12 — Transparent information and communication to data subjects","GDPR Article 15 — Right of access by the data subject","GDPR Article 16 — Right to rectification","GDPR Article 5(2) — Accountability principle","NIST Privacy Framework PR.PO-P6 — Policies, processes, and procedures for data subject requests","ISO\u002FIEC 27701:2019 — Section 7.3 (Rights of data subjects)","CIS Control 3 — Data Protection (data inventory and governance)","ITIL Service Management — Request Fulfilment Practice",{}]