Garante per la protezione dei dati personali (Italy) - 747/2026

Deutsche Bank shared a loan applicant's sensitive financial data — including outstanding payments and net income — on a platform accessible to Poste Italiane staff, without clearly defining who was the data controller and who was the data processor. This role ambiguity meant neither party took full accountability for ensuring the data processing was lawful, fair, and transparent. The absence of an adequate privacy notice meant the data subject had no meaningful awareness that their personal financial information was being shared and accessed in this way. This case illustrates that data protection failures are not always the result of cyberattacks — contractual and governance gaps between organizations can be just as damaging and carry significant regulatory consequences.