[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fP-SaC3mzUj1DbpDUYXdyiqRV2ZeZJaIjNG2gMpSKoro":3},{"article":4,"iocs":45,"watch_terms":46,"solutions":47,"lesson":96},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":22,"category":23,"article_tags":27},"40ce74f8-7f02-4c9b-81f6-04e1e73d9412","Garante per la protezione dei dati personali (Italy) - 746\u002F2026","garante-per-la-protezione-dei-dati-personali-italy-746-2026-d8a9bc","← Older revision Revision as of 15:34, 29 October 2026 Line 24: Line 24: |Type=Investigation |Type=Investigation |Outcome=Violation Found |Outcome=Violation Found |Date_Started= |Date_Started=05.01.2024 |Date_Decided=07.10.2026 |Date_Decided=07.10.2026 |Date_Published=23.10.2026 |Date_Published=23.10.2026","The Italian Data Protection Authority (Garante) has fined Deutsche Bank €33,000 for violating GDPR principles. The violations stemmed from an inadequate privacy notice and the incorrect designation of Deutsche Bank as a processor, leading to processing that breached fairness and transparency. The case involved a loan application where sensitive financial data was disclosed inappropriately.","Italian DPA fines Deutsche Bank €33,000 for GDPR violations related to loan application data.","https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=Garante_per_la_protezione_dei_dati_personali_(Italy)_-_746\u002F2026&diff=53555&oldid=53554","https:\u002F\u002Fgdprhub.eu\u002Fimages\u002Fe\u002Fec\u002FLogoIT.png","2026-10-29T15:34:12+00:00","2026-10-29T16:00:13.517225+00:00",7,[17,20],{"name":18,"type":19},"Deutsche Bank","vendor",{"name":21,"type":19},"Poste Italiane S.p.A.","3f0f8451-91df-4b6c-9a73-ef3b2509b7f1",{"id":22,"icon":24,"name":25,"slug":26},null,"GDPR","gdpr",[28,33,35,40],{"category":29},{"id":30,"icon":24,"name":31,"slug":32},"2e06f76c-d5b9-4f54-9eef-4d3447b10730","Breaches","breaches",{"category":34},{"id":22,"icon":24,"name":25,"slug":26},{"category":36},{"id":37,"icon":24,"name":38,"slug":39},"c5c77cdb-f7d7-4990-9436-c81dcbff1163","Policy","policy",{"category":41},{"id":42,"icon":24,"name":43,"slug":44},"d95477d7-eb04-4fad-a2dc-be1428040ce7","Privacy Fines","privacy-fines",[],[18,21],{"controls":48,"vendors":95},[49,78],{"slug":50,"name":51,"problem":52,"products":53},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.",[54,62,70],{"vendor_slug":55,"vendor_name":56,"vendor_logo":57,"product_slug":58,"product_name":59,"url":60,"description":61},"proofpoint","Proofpoint","\u002Fvendor-logos\u002Fproofpoint.png","enterprise-dlp","Proofpoint Enterprise DLP","https:\u002F\u002Fwww.proofpoint.com\u002Fus\u002Fproducts\u002Fdata-loss-prevention","Data loss prevention across email, cloud and endpoints.",{"vendor_slug":63,"vendor_name":64,"vendor_logo":65,"product_slug":66,"product_name":67,"url":68,"description":69},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","purview-dlp","Microsoft Purview Data Loss Prevention","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fdata-security-governance\u002Fmicrosoft-purview-data-security","Data classification and loss prevention across Microsoft 365, endpoints and connected cloud apps.",{"vendor_slug":71,"vendor_name":72,"vendor_logo":73,"product_slug":74,"product_name":75,"url":76,"description":77},"netskope","Netskope","\u002Fvendor-logos\u002Fnetskope.png","netskope-dlp","Netskope DLP","https:\u002F\u002Fwww.netskope.com\u002Fproducts\u002Fdata-loss-prevention","Data loss prevention for web, cloud apps, AI tools and endpoints.",{"slug":79,"name":80,"problem":81,"products":82},"compliance-automation","Compliance automation (GRC)","Evidence for NIS2, DORA and ISO 27001 is collected continuously, not in a rush before the audit.",[83,89],{"vendor_slug":84,"vendor_name":85,"vendor_logo":86,"product_slug":84,"product_name":85,"url":87,"description":88},"vanta","Vanta","\u002Fvendor-logos\u002Fvanta.png","https:\u002F\u002Fwww.vanta.com\u002F","Automated evidence collection and continuous monitoring for ISO 27001, SOC 2, NIS2 and other frameworks.",{"vendor_slug":90,"vendor_name":91,"vendor_logo":92,"product_slug":90,"product_name":91,"url":93,"description":94},"drata","Drata","\u002Fvendor-logos\u002Fdrata.png","https:\u002F\u002Fdrata.com\u002F","Continuous control monitoring and audit readiness across security frameworks.",[],{"slug":97,"title":98,"body":99,"framework_refs":100,"framework_notes":108},"deutsche-bank-fined-33000-for-gdpr-violations-over-opaque-privacy-practices","Deutsche Bank Fined €33,000 for GDPR Violations Over Opaque Privacy Practices","Deutsche Bank violated core GDPR principles of fairness and transparency by providing an inadequate privacy notice and incorrectly designating itself as a data processor rather than a controller during a loan application process. This misclassification meant that affected individuals were not properly informed about who was responsible for their sensitive financial data or how it would be used. The inappropriate disclosure of financial data compounded the harm, exposing customers to risks they had no knowledge of or ability to consent to. This case illustrates that GDPR compliance is not merely a legal formality — inaccurate role designations and vague privacy notices have real consequences for data subjects and carry significant regulatory penalties.",[101,102,103,104,105,106,107],"GDPR Article 32","GDPR Article 13","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","NIST SP 800-53 SI-2: Flaw Remediation","CIS Control 14: Security Awareness and Skills Training","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","ISO\u002FIEC 27001:2022 Clause 7.2: Competence",{"GDPR Article 13":109,"GDPR Article 32":110,"NIST SP 800-53 SI-2: Flaw Remediation":111,"ISO\u002FIEC 27001:2022 Clause 7.2: Competence":112,"CIS Control 14: Security Awareness and Skills Training":113,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":114,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":115},"Article 13 mandates that controllers provide clear, complete privacy information to data subjects at the time of data collection; Deutsche Bank's inadequate privacy notice directly violated this transparency obligation during the loan application process.","Article 32 requires organisations to implement appropriate technical and organisational measures to ensure data processing meets GDPR standards; proper controller\u002Fprocessor designation and transparent notices are foundational organisational measures that were absent here.","Treating compliance gaps — such as incorrect role designations in data processing agreements — as organisational flaws requiring identification, reporting, and timely remediation would have prevented the systemic failure that led to this fine.","Clause 7.2 requires organisations to ensure that personnel responsible for information security and compliance tasks are competent; the misclassification of Deutsche Bank's processing role suggests a gap in staff competence around GDPR obligations.","Staff responsible for drafting privacy notices and classifying data processing roles lacked sufficient understanding of GDPR controller\u002Fprocessor distinctions; targeted training would have caught this error before customer data was mishandled.","While primarily a technical control, the broader 27001 framework requires organisations to maintain accurate records of processing activities and roles, which would have surfaced the incorrect processor designation before it led to a regulatory breach.","Correctly identifying and governing who (or which entity) acts as controller versus processor is an identity and accountability function; failures here mirror access governance gaps where roles and responsibilities are not properly defined or enforced."]