Cerved Fined €400K for Failing to Honor GDPR Data Subject Rights
Written by AI from the linked story. Not reviewed by an editor. How this works
Italy's data protection authority fined Cerved Group €400,000 for providing inadequate responses to data subject access requests, effectively blocking individuals from understanding how their credit scores were calculated. The root issue was the absence of a compliant, structured process for handling GDPR rights requests — particularly the right of access (Article 15) and the right to rectification. This matters because credit scoring directly impacts people's financial lives, and opacity in how that data is processed undermines the fundamental principles of fairness and transparency enshrined in GDPR Article 5(1)(a). Organizations that process sensitive personal data must treat data subject rights as operational obligations, not administrative formalities.
Tactical Insight
Immediate actions
- Conduct an audit of all existing data subject request (DSR) workflows to verify they meet GDPR Articles 12 and 15 requirements for timeliness and completeness.
- Designate a trained Data Protection Officer (DPO) or privacy team member as the accountable owner for all incoming DSR responses.
Process & Policy improvements
- Implement a documented, repeatable procedure for handling rights requests (access, rectification, erasure) with SLA timelines aligned to the 30-day GDPR requirement.
- Ensure that responses to access requests include meaningful, intelligible explanations of automated decisions or scoring logic, not just raw data outputs.
- Establish a rectification procedure as a formal process, including escalation paths and confirmation notifications to data subjects.
Long-term governance
- Integrate DSR compliance into annual privacy impact assessments and internal audit cycles.
- Train customer-facing and data management teams regularly on GDPR data subject rights obligations and escalation procedures.
- Implement a case management system to log, track, and report on all DSRs to demonstrate accountability under GDPR Article 5(2).