Cerved Fined €400K for Failing to Honor Data Subject Rights Under GDPR
Written by AI from the linked story. Not reviewed by an editor. How this works
Cerved Group S.p.A. was fined €400,000 by Italy's data protection authority for providing incomplete responses to data subject access requests, specifically failing to disclose credit scores and the logic behind automated decisions. This directly hindered individuals' ability to challenge decisions that led to real-world consequences, such as denial of energy supply. Under GDPR Articles 13–15 and 22, organizations using automated decision-making must provide meaningful, intelligible explanations of the logic involved. This case underscores that data subject rights are not a formality — inadequate or opaque responses to such requests constitute a serious compliance failure with significant regulatory and reputational consequences.
Tactical Insight
Immediate actions
- Audit all existing data subject request (DSR) processes to ensure responses include scores, profiling logic, and the basis for automated decisions.
- Establish a dedicated DSR response team with clear SLAs aligned to GDPR's one-month response deadline.
Long-term improvements
- Implement a formal Automated Decision-Making (ADM) transparency framework that documents and communicates the logic, significance, and consequences of profiling to data subjects.
- Conduct regular GDPR Article 22 compliance reviews for any systems involved in credit scoring, risk profiling, or other automated decisions with significant effects on individuals.
- Integrate data subject rights workflows into CRM or case management systems to ensure completeness, traceability, and auditability of all responses.
Detection & monitoring measures
- Establish internal QA checks on DSR response quality, including completeness of information provided regarding automated decision logic.
- Monitor regulatory guidance and DPA decisions across EU member states to proactively identify compliance gaps in data subject rights handling.