[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fPlb4gVAZPPuHULaOufHojIWOEVTqyDsQATqTL6Ih_cY":3},{"article":4,"iocs":40,"watch_terms":41,"solutions":42,"lesson":91},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":23,"category":24,"article_tags":28},"e790f87f-9fd5-47b3-af8e-8ce0e4735a85","Garante per la protezione dei dati personali (Italy) - 485\u002F2026","garante-per-la-protezione-dei-dati-personali-italy-485-2026-e30749","← Older revision Revision as of 12:09, 2 September 2026 Line 104: Line 104: }} }} The DPA fined an credit rating agency €400,000 for providing inadequate responses to data subjects' request, effectively preventing them from exercising their rights. In particular, the credit information agency did not provide sufficient information on the calculated credit scores. The DPA fined a credit rating agency €400,000 for providing inadequate responses to data subjects' request, effectively preventing them from exercising their rights. In particular, the credit information agency did not provide sufficient information on the calculated credit scores. == English Summary == == English Summary ==","Italy's Garante per la protezione dei dati personali has fined credit rating agency Cerved Group S.p.A. €400,000 for failing to adequately respond to data subjects' requests. The agency prevented individuals from exercising their rights by not providing sufficient information about calculated credit scores used to deny energy supply, leading to upheld complaints.","Italy's DPA fines Cerved Group €400,000 for inadequate data subject response.","https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=Garante_per_la_protezione_dei_dati_personali_(Italy)_-_485\u002F2026&diff=52881&oldid=52868","https:\u002F\u002Fgdprhub.eu\u002Fimages\u002Fe\u002Fec\u002FLogoIT.png","2026-09-02T12:09:39+00:00","2026-09-02T14:00:08.600386+00:00",7,[17,20],{"name":18,"type":19},"Cerved Group S.p.A.","vendor",{"name":21,"type":22},"GDPR","product","d95477d7-eb04-4fad-a2dc-be1428040ce7",{"id":23,"icon":25,"name":26,"slug":27},null,"Privacy Fines","privacy-fines",[29,33,38],{"category":30},{"id":31,"icon":25,"name":21,"slug":32},"3f0f8451-91df-4b6c-9a73-ef3b2509b7f1","gdpr",{"category":34},{"id":35,"icon":25,"name":36,"slug":37},"53f9c4b6-8bc6-4964-9169-d09e5cd41d72","Compliance","compliance",{"category":39},{"id":23,"icon":25,"name":26,"slug":27},[],[18,21],{"controls":43,"vendors":90},[44,73],{"slug":45,"name":46,"problem":47,"products":48},"identity-governance","Identity governance and single sign-on","People who leave or change roles lose access everywhere at once, and forgotten accounts stop piling up.",[49,57,65],{"vendor_slug":50,"vendor_name":51,"vendor_logo":52,"product_slug":53,"product_name":54,"url":55,"description":56},"sailpoint","SailPoint","\u002Fvendor-logos\u002Fsailpoint.png","human-fabric","SailPoint Human Fabric","https:\u002F\u002Fwww.sailpoint.com\u002Fproducts\u002Fhuman-fabric","Identity governance platform, the successor to Identity Security Cloud: lifecycle management, access requests and continuous access reviews.",{"vendor_slug":58,"vendor_name":59,"vendor_logo":60,"product_slug":61,"product_name":62,"url":63,"description":64},"omada","Omada","\u002Fvendor-logos\u002Fomada.png","omada-identity-cloud","Omada Identity Cloud","https:\u002F\u002Fomadaidentity.com\u002Fproducts\u002Fomada-identity-cloud\u002F","Identity governance and administration delivered as a service.",{"vendor_slug":66,"vendor_name":67,"vendor_logo":68,"product_slug":69,"product_name":70,"url":71,"description":72},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","workforce-identity","Okta Workforce Identity","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fworkforce-identity\u002F","Single sign-on, adaptive MFA including phishing-resistant methods, and lifecycle management for employees.",{"slug":74,"name":75,"problem":76,"products":77},"compliance-automation","Compliance automation (GRC)","Evidence for NIS2, DORA and ISO 27001 is collected continuously, not in a rush before the audit.",[78,84],{"vendor_slug":79,"vendor_name":80,"vendor_logo":81,"product_slug":79,"product_name":80,"url":82,"description":83},"vanta","Vanta","\u002Fvendor-logos\u002Fvanta.png","https:\u002F\u002Fwww.vanta.com\u002F","Automated evidence collection and continuous monitoring for ISO 27001, SOC 2, NIS2 and other frameworks.",{"vendor_slug":85,"vendor_name":86,"vendor_logo":87,"product_slug":85,"product_name":86,"url":88,"description":89},"drata","Drata","\u002Fvendor-logos\u002Fdrata.png","https:\u002F\u002Fdrata.com\u002F","Continuous control monitoring and audit readiness across security frameworks.",[],{"slug":92,"title":93,"body":94,"framework_refs":95,"framework_notes":106},"cerved-fined-400k-for-blocking-data-subject-rights-under-gdpr","Cerved Fined €400K for Blocking Data Subject Rights Under GDPR","Italy's data protection authority fined Cerved Group €400,000 for systematically failing to honor data subject access rights, specifically by withholding meaningful information about credit scores used to deny individuals energy supply contracts. This violates core GDPR principles of transparency and the right of access (Articles 13, 14, and 15), which require organizations to provide intelligible, complete explanations of automated or semi-automated decision-making. The failure is particularly serious because the credit scoring directly impacted individuals' access to essential services. Organizations processing personal data for profiling or scoring must treat data subject rights requests as a compliance obligation, not an administrative burden. This case underscores that regulators will hold data controllers accountable when individuals cannot meaningfully understand or contest decisions made about them.",[96,97,98,99,100,101,102,103,104,105],"GDPR Article 5(1)(a) – Principle of Transparency","GDPR Article 12 – Transparent Information and Communication","GDPR Article 13 – Information to be Provided at Collection","GDPR Article 14 – Information Where Data Not Obtained Directly","GDPR Article 15 – Right of Access by the Data Subject","GDPR Article 22 – Automated Individual Decision-Making Including Profiling","NIST Privacy Framework PR.PO-P6 – Policies for Data Subject Rights","CIS Control 3 – Data Protection","ISO\u002FIEC 29101 – Privacy Architecture Framework","ITIL Service Management – Request Fulfilment Process",{}]