Cerved Fined €400K for Blocking Data Subject Rights Under GDPR
Written by AI from the linked story. Not reviewed by an editor. How this works
Italy's data protection authority fined Cerved Group €400,000 for systematically failing to honor data subject access rights, specifically by withholding meaningful information about credit scores used to deny individuals energy supply contracts. This violates core GDPR principles of transparency and the right of access (Articles 13, 14, and 15), which require organizations to provide intelligible, complete explanations of automated or semi-automated decision-making. The failure is particularly serious because the credit scoring directly impacted individuals' access to essential services. Organizations processing personal data for profiling or scoring must treat data subject rights requests as a compliance obligation, not an administrative burden. This case underscores that regulators will hold data controllers accountable when individuals cannot meaningfully understand or contest decisions made about them.
Tactical Insight
Immediate actions
- Establish a documented, time-bound process for handling all Data Subject Access Requests (DSARs) within GDPR-mandated timeframes (typically 30 days).
- Ensure responses to DSARs include clear, plain-language explanations of any scoring logic, profiling, or automated decision-making affecting the individual.
- Audit existing DSAR response templates to verify they include all legally required information, including the basis and impact of credit scoring decisions.
Long-term improvements
- Appoint or empower a dedicated Data Protection Officer (DPO) to oversee and quality-assure all data subject rights responses.
- Implement a case management system to track, escalate, and report on DSAR volumes, response times, and outcomes.
- Conduct regular GDPR training for staff handling data subject requests, particularly those in credit, risk, and customer operations teams.
Governance & oversight
- Schedule annual internal audits of data subject rights procedures against GDPR Articles 12–22 requirements.
- Map all profiling and scoring activities in your Records of Processing Activities (RoPA) to ensure transparency obligations are clearly assigned.
- Engage legal or compliance review when automated decisions materially affect individuals' access to services or credit.