Garante per la protezione dei dati personali (Italy) - 485/2026
Italy's DPA fines Cerved Group €400,000 for inadequate data subject response.
Italy's Garante per la protezione dei dati personali has fined credit rating agency Cerved Group S.p.A. €400,000 for failing to adequately respond to data subjects' requests. The agency prevented individuals from exercising their rights by not providing sufficient information about calculated credit scores used to deny energy supply, leading to upheld complaints.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Cerved Group S.p.A.?
Get an email when a new story names Cerved Group S.p.A., usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonItaly's data protection authority fined Cerved Group €400,000 for systematically failing to honor data subject access rights, specifically by withholding meaningful information about credit scores used to deny individuals energy supply contracts. This violates core GDPR principles of transparency and the right of access (Articles 13, 14, and 15), which require organizations to provide intelligible, complete explanations of automated or semi-automated decision-making. The failure is particularly serious because the credit scoring directly impacted individuals' access to essential services. Organizations processing personal data for profiling or scoring must treat data subject rights requests as a compliance obligation, not an administrative burden. This case underscores that regulators will hold data controllers accountable when individuals cannot meaningfully understand or contest decisions made about them.
What helps against this
How we list vendors- Identity governance and single sign-on
People who leave or change roles lose access everywhere at once, and forgotten accounts stop piling up.
- Compliance automation (GRC)
Evidence for NIS2, DORA and ISO 27001 is collected continuously, not in a rush before the audit.