[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fA21r7T4HFuxI5gwhX6iAwgpP8903joHMBGUdwF3vRUU":3},{"article":4,"iocs":45,"watch_terms":46,"solutions":47,"lesson":122},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":22,"category":23,"article_tags":27},"ecd928b6-72e9-4006-b6dd-8a55e8c25505","Garante per la protezione dei dati personali (Italy) - 746\u002F2026","garante-per-la-protezione-dei-dati-personali-italy-746-2026-db542c","Created page with \"{{DPAdecisionBOX |Jurisdiction=Italy |DPA-BG-Color= |DPAlogo=LogoIT.png |DPA_Abbrevation=Garante per la protezione dei dati personali |DPA_With_Country=Garante per la protezione dei dati personali (Italy) |Case_Number_Name=746\u002F2026 |ECLI= |Original_Source_Name_1=Garante per la protezione dei dati personali |Original_Source_Link_1=https:\u002F\u002Fwww.garanteprivacy.it\u002Fweb\u002Fguest\u002Fhome\u002Fdocweb\u002F-\u002Fdocweb-display\u002Fdocweb\u002F10310391 |Original_Source_Language_1=Italian |Original_Source_L...\" Show changes","The Italian DPA has fined Deutsche Bank €33,000 for designating it incorrectly as a processor and for providing an inadequate privacy notice. This led to data processing that violated fairness and transparency principles. The case involved a loan application where Deutsche Bank disclosed outstanding payments and net income on a platform accessible to Poste Italiane staff, despite the data subject's objections.","Italian DPA fines Deutsche Bank €33,000 for inadequate privacy notice and processor designation.","https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=Garante_per_la_protezione_dei_dati_personali_(Italy)_-_746\u002F2026&diff=53554&oldid=0","https:\u002F\u002Fgdprhub.eu\u002Fimages\u002Fe\u002Fec\u002FLogoIT.png","2026-10-29T15:26:58+00:00","2026-10-29T16:00:13.517225+00:00",7,[17,20],{"name":18,"type":19},"Deutsche Bank","vendor",{"name":21,"type":19},"Poste Italiane S.p.A.","c5c77cdb-f7d7-4990-9436-c81dcbff1163",{"id":22,"icon":24,"name":25,"slug":26},null,"Policy","policy",[28,33,38,40],{"category":29},{"id":30,"icon":24,"name":31,"slug":32},"2e06f76c-d5b9-4f54-9eef-4d3447b10730","Breaches","breaches",{"category":34},{"id":35,"icon":24,"name":36,"slug":37},"3f0f8451-91df-4b6c-9a73-ef3b2509b7f1","GDPR","gdpr",{"category":39},{"id":22,"icon":24,"name":25,"slug":26},{"category":41},{"id":42,"icon":24,"name":43,"slug":44},"d95477d7-eb04-4fad-a2dc-be1428040ce7","Privacy Fines","privacy-fines",[],[18,21],{"controls":48,"vendors":121},[49,78,104],{"slug":50,"name":51,"problem":52,"products":53},"identity-governance","Identity governance and single sign-on","People who leave or change roles lose access everywhere at once, and forgotten accounts stop piling up.",[54,62,70],{"vendor_slug":55,"vendor_name":56,"vendor_logo":57,"product_slug":58,"product_name":59,"url":60,"description":61},"sailpoint","SailPoint","\u002Fvendor-logos\u002Fsailpoint.png","human-fabric","SailPoint Human Fabric","https:\u002F\u002Fwww.sailpoint.com\u002Fproducts\u002Fhuman-fabric","Identity governance platform, the successor to Identity Security Cloud: lifecycle management, access requests and continuous access reviews.",{"vendor_slug":63,"vendor_name":64,"vendor_logo":65,"product_slug":66,"product_name":67,"url":68,"description":69},"omada","Omada","\u002Fvendor-logos\u002Fomada.png","omada-identity-cloud","Omada Identity Cloud","https:\u002F\u002Fomadaidentity.com\u002Fproducts\u002Fomada-identity-cloud\u002F","Identity governance and administration delivered as a service.",{"vendor_slug":71,"vendor_name":72,"vendor_logo":73,"product_slug":74,"product_name":75,"url":76,"description":77},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","entra-id","Microsoft Entra ID","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fidentity-access\u002Fmicrosoft-entra-id","Cloud identity and access management with single sign-on, conditional access, passkeys and identity governance.",{"slug":79,"name":80,"problem":81,"products":82},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.",[83,88,96],{"vendor_slug":71,"vendor_name":72,"vendor_logo":73,"product_slug":84,"product_name":85,"url":86,"description":87},"purview-dlp","Microsoft Purview Data Loss Prevention","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fdata-security-governance\u002Fmicrosoft-purview-data-security","Data classification and loss prevention across Microsoft 365, endpoints and connected cloud apps.",{"vendor_slug":89,"vendor_name":90,"vendor_logo":91,"product_slug":92,"product_name":93,"url":94,"description":95},"forcepoint","Forcepoint","\u002Fvendor-logos\u002Fforcepoint.png","forcepoint-dlp","Forcepoint DLP","https:\u002F\u002Fwww.forcepoint.com\u002Fproduct\u002Fdlp-data-loss-prevention","Data loss prevention for endpoints, network, email and cloud applications.",{"vendor_slug":97,"vendor_name":98,"vendor_logo":99,"product_slug":100,"product_name":101,"url":102,"description":103},"netskope","Netskope","\u002Fvendor-logos\u002Fnetskope.png","netskope-dlp","Netskope DLP","https:\u002F\u002Fwww.netskope.com\u002Fproducts\u002Fdata-loss-prevention","Data loss prevention for web, cloud apps, AI tools and endpoints.",{"slug":105,"name":106,"problem":107,"products":108},"compliance-automation","Compliance automation (GRC)","Evidence for NIS2, DORA and ISO 27001 is collected continuously, not in a rush before the audit.",[109,115],{"vendor_slug":110,"vendor_name":111,"vendor_logo":112,"product_slug":110,"product_name":111,"url":113,"description":114},"drata","Drata","\u002Fvendor-logos\u002Fdrata.png","https:\u002F\u002Fdrata.com\u002F","Continuous control monitoring and audit readiness across security frameworks.",{"vendor_slug":116,"vendor_name":117,"vendor_logo":118,"product_slug":116,"product_name":117,"url":119,"description":120},"vanta","Vanta","\u002Fvendor-logos\u002Fvanta.png","https:\u002F\u002Fwww.vanta.com\u002F","Automated evidence collection and continuous monitoring for ISO 27001, SOC 2, NIS2 and other frameworks.",[],{"slug":123,"title":124,"body":125,"framework_refs":126,"framework_notes":134},"deutsche-bank-fined-33000-for-misclassifying-data-role-and-failing-transparency-obligations","Deutsche Bank Fined €33,000 for Misclassifying Data Role and Failing Transparency Obligations","Deutsche Bank was penalised by Italy's data protection authority for incorrectly designating itself as a data processor rather than a data controller, and for providing an inadequate privacy notice to a loan applicant. This misclassification meant that critical safeguards — including lawful basis determination, transparency requirements, and data subject rights — were not properly applied. Sensitive financial data (outstanding payments and net income) was then disclosed on a platform accessible to Poste Italiane staff without proper justification, even after the data subject objected. The case demonstrates that misunderstanding or misrepresenting roles within a data-sharing arrangement can cause cascading compliance failures. Correct role classification is foundational to GDPR accountability and cannot be treated as a formality.",[127,128,129,130,131,132,133],"GDPR Article 32","GDPR Article 13","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","ISO\u002FIEC 27001:2022 Clause 7.2: Competence","CIS Control 14: Security Awareness and Skills Training","NIST SP 800-53 SI-2: Flaw Remediation","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control",{"GDPR Article 13":135,"GDPR Article 32":136,"NIST SP 800-53 SI-2: Flaw Remediation":137,"ISO\u002FIEC 27001:2022 Clause 7.2: Competence":138,"CIS Control 14: Security Awareness and Skills Training":139,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":140,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":141},"Article 13 mandates that data subjects receive clear, complete privacy information at the point of data collection; the inadequate privacy notice provided by Deutsche Bank directly violated this obligation.","Article 32 requires appropriate technical and organisational measures to ensure data security and confidentiality; correct role classification and restricted platform access are baseline organisational measures that were absent here.","Although SI-2 addresses technical flaws, its principle of identifying and correcting deficiencies in a timely manner applies to procedural and compliance flaws — the misclassified role designation should have been caught and corrected through internal review.","Clause 7.2 requires organisations to ensure personnel have the necessary competence to fulfil information security and compliance responsibilities; staff misclassifying legal roles indicates a training and competence gap.","A structured training programme covering data classification, legal roles under privacy law, and handling of personal data would have reduced the likelihood of staff and legal teams misapplying the controller\u002Fprocessor distinction.","While primarily technical, A.8.8's broader context of managing risks in information handling applies here, as unreviewed data-sharing configurations created exploitable compliance gaps on the shared platform.","PR.AA calls for controlling who can access sensitive data and under what conditions; ensuring Poste Italiane staff had appropriately scoped and justified access to the financial data platform would have limited unnecessary exposure."]