Garante per la protezione dei dati personali (Italy) - 746/2026

Deutsche Bank was penalised by Italy's data protection authority for incorrectly designating itself as a data processor rather than a data controller, and for providing an inadequate privacy notice to a loan applicant. This misclassification meant that critical safeguards — including lawful basis determination, transparency requirements, and data subject rights — were not properly applied. Sensitive financial data (outstanding payments and net income) was then disclosed on a platform accessible to Poste Italiane staff without proper justification, even after the data subject objected. The case demonstrates that misunderstanding or misrepresenting roles within a data-sharing arrangement can cause cascading compliance failures. Correct role classification is foundational to GDPR accountability and cannot be treated as a formality.