Garante per la protezione dei dati personali (Italy) - 746/2026
Italian DPA fines Deutsche Bank €33,000 for GDPR violations related to loan application data.
The Italian Data Protection Authority (Garante) has fined Deutsche Bank €33,000 for violating GDPR principles. The violations stemmed from an inadequate privacy notice and the incorrect designation of Deutsche Bank as a processor, leading to processing that breached fairness and transparency. The case involved a loan application where sensitive financial data was disclosed inappropriately.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Deutsche Bank?
Get an email when a new story names Deutsche Bank, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonDeutsche Bank violated core GDPR principles of fairness and transparency by providing an inadequate privacy notice and incorrectly designating itself as a data processor rather than a controller during a loan application process. This misclassification meant that affected individuals were not properly informed about who was responsible for their sensitive financial data or how it would be used. The inappropriate disclosure of financial data compounded the harm, exposing customers to risks they had no knowledge of or ability to consent to. This case illustrates that GDPR compliance is not merely a legal formality — inaccurate role designations and vague privacy notices have real consequences for data subjects and carry significant regulatory penalties.
What helps against this
How we list vendors- Data loss prevention (DLP)
Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.
- Compliance automation (GRC)
Evidence for NIS2, DORA and ISO 27001 is collected continuously, not in a rush before the audit.