[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$ffcJr8ttKEhbiCRNj9GBEAjPCTY6Yt1HR5JUoNbvT7lI":3},{"article":4,"iocs":45,"watch_terms":46,"solutions":47,"lesson":96},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":22,"category":23,"article_tags":27},"7086409e-2617-4689-9a85-8e31bc27d34d","Garante per la protezione dei dati personali (Italy) - 747\u002F2026","garante-per-la-protezione-dei-dati-personali-italy-747-2026-b3d3be","← Older revision Revision as of 15:54, 2 November 2026 (One intermediate revision by the same user not shown) Line 24: Line 24: |Type=Investigation |Type=Investigation |Outcome=Violation Found |Outcome=Violation Found |Date_Started= |Date_Started=05.01.2026 |Date_Decided= |Date_Decided=07.10.2026 |Date_Published= |Date_Published=23.10.2026 |Year= |Year= |Fine=48000.0 |Fine=48.000 |Currency=EUR |Currency=EUR Line 120: Line 120: === Holding === === Holding === The DPA found that Deutsche Bank on the one hand independently determines the processing purposes and essential means related to the data subject’s creditworthiness analysis and has the sole authority to grant or deny the loan. Whereas on the other hand, Poste Italiane S.p.A. operates on a separate contractual relationship with the data subject and processes personal data for its own purposes. Ultimately, it was made evident to the DPA that the processing activities including the disclosure by Deutsche Bank and Poste Italiane S.p.A. fell within the scope of what is necessary for the performance of their respective contractual obligations or precontractual measures requested by the data subject ([[Article 6 GDPR|Article 6(1)(b) GDPR]]). The DPA found that Deutsche Bank on the one hand independently determines the processing purposes and essential means related to the data subject’s creditworthiness analysis and has the sole authority to grant or deny the loan. Whereas on the other hand, Poste Italiane S.p.A. operates on a separate contractual relationship with the data subject and processes personal data for its own purposes. Ultimately, it was made evident to the DPA that the processing activities including the disclosure by Deutsche Bank and Poste Italiane S.p.A. fell within the scope of what is necessary for the performance of their respective contractual obligations or precontractual measures requested by the data subject ([[Article 6 GDPR|Article 6(1)(b) GDPR]]). Therefore, the DPA held that the decision to designate each other (Deutsche Bank and Poste Italiane S.p.A.) as processors under [[Article 28 GDPR|Article 28 GDPR]] was contrary to the [[Article 4 GDPR|Article 4(8) GDPR]], which defines a processor as the entity processing on behalf and under the instructions of a controller. Namely because the DPA held that the factual assessment of the relationship demonstrates that the disclosure of information between them is carried out by each of them for their own purposes. Ultimately, according to the DPA this makes them independent controllers. The DPA found that this wrong designation as processors had direct implications on the compliance with [[Article 13 GDPR|Article 13 GDPR]] particularly in regards to the privacy notice. Furthermore, The DPA found that Poste Italiane S.p.A.’s privacy notice had not been properly worded. Specifically, it held that regarding the processing of data subject’s personal data for the promotion and placement of the loan, Deutsche Bank should have specified the recipients or categories of recipients of the personal data in accordance to [[Article 13 GDPR|Article 13(1)(a) GDPR]]. Moreover, the privacy notice lacked the additional information necessary to guarantee fair and transparent processing operations pursuant to [[Article 5 GDPR|Article 5(1)(a) GDPR]]. Therefore, the DPA held that the decision to designate each other (Deutsche Bank and Poste Italiane S.p.A.) as processors under [[Article 28 GDPR]] was contrary to the [[Article 4 GDPR|Article 4(8) GDPR]], which defines a processor as the entity processing on behalf and under the instructions of a controller. Namely because the DPA held that the factual assessment of the relationship demonstrates that the disclosure of information between them is carried out by each of them for their own purposes. Ultimately, according to the DPA this makes them independent controllers. As a result of the aforementioned, the DPA found Poste Italiane S.p.A. in violation of the principles of fairness and transparency under [[Article 5 GDPR|Article 5(1)(a) GDPR]], lacked the necessary information in its privacy notice in accordance with [[Article 13 GDPR|Article 13(1)(a) GDPR]], and wrongly designated each other as processors under [[Article 28 GDPR|Article 28 GDPR]]. Accordingly, the DPA fined Poste Italiane S.p.A. €48,000. The DPA found that this wrong designation as processors had direct implications on the compliance with [[Article 13 GDPR]] particularly in regards to the privacy notice. Furthermore, The DPA found that Poste Italiane S.p.A.’s privacy notice had not been properly worded. Specifically, it held that regarding the processing of data subject’s personal data for the promotion and placement of the loan, Deutsche Bank should have specified the recipients or categories of recipients of the personal data in accordance to [[Article 13 GDPR|Article 13(1)(a) GDPR]]. Moreover, the privacy notice lacked the additional information necessary to guarantee fair and transparent processing operations pursuant to [[Article 5 GDPR|Article 5(1)(a) GDPR]]. As a result of the aforementioned, the DPA found Poste Italiane S.p.A. in violation of the principles of fairness and transparency under [[Article 5 GDPR|Article 5(1)(a) GDPR]], lacked the necessary information in its privacy notice in accordance with [[Article 13 GDPR|Article 13(1)(a) GDPR]], and wrongly designated each other as processors under [[Article 28 GDPR]]. Accordingly, the DPA fined Poste Italiane S.p.A. €48,000. == Comment == == Comment ==","The Italian Data Protection Authority (Garante) found that Deutsche Bank and Poste Italiane S.p.A. incorrectly designated each other as processors, when they were in fact independent controllers. This misclassification led to violations of GDPR Article 13 regarding privacy notices, particularly concerning the specification of data recipients and fair processing. Consequently, the Garante imposed a fine of €48,000 on Deutsche Bank.","Italian DPA fines Deutsche Bank and Poste Italiane for GDPR violations related to data processing.","https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=Garante_per_la_protezione_dei_dati_personali_(Italy)_-_747\u002F2026&diff=53579&oldid=53577","https:\u002F\u002Fgdprhub.eu\u002Fimages\u002Fe\u002Fec\u002FLogoIT.png","2026-11-02T15:54:32+00:00","2026-11-02T16:00:31.999943+00:00",7,[17,20],{"name":18,"type":19},"Deutsche Bank","vendor",{"name":21,"type":19},"Poste Italiane S.p.A.","c5c77cdb-f7d7-4990-9436-c81dcbff1163",{"id":22,"icon":24,"name":25,"slug":26},null,"Policy","policy",[28,33,38,40],{"category":29},{"id":30,"icon":24,"name":31,"slug":32},"3f0f8451-91df-4b6c-9a73-ef3b2509b7f1","GDPR","gdpr",{"category":34},{"id":35,"icon":24,"name":36,"slug":37},"53f9c4b6-8bc6-4964-9169-d09e5cd41d72","Compliance","compliance",{"category":39},{"id":22,"icon":24,"name":25,"slug":26},{"category":41},{"id":42,"icon":24,"name":43,"slug":44},"d95477d7-eb04-4fad-a2dc-be1428040ce7","Privacy Fines","privacy-fines",[],[18,21],{"controls":48,"vendors":95},[49,78],{"slug":50,"name":51,"problem":52,"products":53},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.",[54,62,70],{"vendor_slug":55,"vendor_name":56,"vendor_logo":57,"product_slug":58,"product_name":59,"url":60,"description":61},"netskope","Netskope","\u002Fvendor-logos\u002Fnetskope.png","netskope-dlp","Netskope DLP","https:\u002F\u002Fwww.netskope.com\u002Fproducts\u002Fdata-loss-prevention","Data loss prevention for web, cloud apps, AI tools and endpoints.",{"vendor_slug":63,"vendor_name":64,"vendor_logo":65,"product_slug":66,"product_name":67,"url":68,"description":69},"proofpoint","Proofpoint","\u002Fvendor-logos\u002Fproofpoint.png","enterprise-dlp","Proofpoint Enterprise DLP","https:\u002F\u002Fwww.proofpoint.com\u002Fus\u002Fproducts\u002Fdata-loss-prevention","Data loss prevention across email, cloud and endpoints.",{"vendor_slug":71,"vendor_name":72,"vendor_logo":73,"product_slug":74,"product_name":75,"url":76,"description":77},"forcepoint","Forcepoint","\u002Fvendor-logos\u002Fforcepoint.png","forcepoint-dlp","Forcepoint DLP","https:\u002F\u002Fwww.forcepoint.com\u002Fproduct\u002Fdlp-data-loss-prevention","Data loss prevention for endpoints, network, email and cloud applications.",{"slug":79,"name":80,"problem":81,"products":82},"compliance-automation","Compliance automation (GRC)","Evidence for NIS2, DORA and ISO 27001 is collected continuously, not in a rush before the audit.",[83,89],{"vendor_slug":84,"vendor_name":85,"vendor_logo":86,"product_slug":84,"product_name":85,"url":87,"description":88},"drata","Drata","\u002Fvendor-logos\u002Fdrata.png","https:\u002F\u002Fdrata.com\u002F","Continuous control monitoring and audit readiness across security frameworks.",{"vendor_slug":90,"vendor_name":91,"vendor_logo":92,"product_slug":90,"product_name":91,"url":93,"description":94},"vanta","Vanta","\u002Fvendor-logos\u002Fvanta.png","https:\u002F\u002Fwww.vanta.com\u002F","Automated evidence collection and continuous monitoring for ISO 27001, SOC 2, NIS2 and other frameworks.",[],{"slug":97,"title":98,"body":99,"framework_refs":100,"framework_notes":107},"deutsche-bank-fined-48k-after-misclassifying-data-controller-roles-under-gdpr","Deutsche Bank Fined €48K After Misclassifying Data Controller Roles Under GDPR","Deutsche Bank and Poste Italiane incorrectly designated each other as data processors when, under GDPR, both were acting as independent data controllers. This misclassification caused a cascade of compliance failures, most notably the omission of accurate data recipient information in privacy notices as required by GDPR Article 13. The error highlights how poorly understood data controller\u002Fprocessor distinctions remain within large financial institutions. Such misclassification is not merely a paperwork issue — it directly strips individuals of their right to know who is responsible for their personal data and how to exercise their rights.",[101,102,103,104,105,106],"GDPR Article 32","NIST SP 800-53 SI-2: Flaw Remediation","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","ISO\u002FIEC 27001:2022 Clause 7.2: Competence","CIS Control 14: Security Awareness and Skills Training","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control",{"GDPR Article 32":108,"NIST SP 800-53 SI-2: Flaw Remediation":109,"ISO\u002FIEC 27001:2022 Clause 7.2: Competence":110,"CIS Control 14: Security Awareness and Skills Training":111,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":112,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":113},"While Article 32 addresses security of processing, the broader GDPR accountability principle it embeds requires organisations to demonstrate correct legal classification of processing relationships — a control that failed here when both parties misidentified their controller roles.","Treating role misclassification as an organisational 'flaw' that must be identified, reported, and corrected maps directly to SI-2's requirement to remediate information system flaws — in this case, a governance flaw in how data relationships were defined.","Clause 7.2 requires organisations to ensure personnel have the competence necessary for their roles; inadequate staff knowledge of GDPR controller\u002Fprocessor distinctions directly caused the misclassification that led to this fine.","The misclassification stemmed from a lack of GDPR role-distinction knowledge among the teams drafting data agreements; structured, role-based training as prescribed by CIS Control 14 would have built the competence needed to prevent this error.","Analogously, ISO 27001's requirement to identify and address vulnerabilities extends to legal and contractual vulnerabilities; the misclassification of controller\u002Fprocessor status was an unmitigated compliance vulnerability in the organisations' data governance posture.","PR.AA's principle of clearly identifying and managing the roles of parties handling data directly applies — knowing who controls versus processes data is foundational to assigning correct responsibilities, notices, and legal obligations."]