Cerved Group Fined €400K for Failing to Honor GDPR Data Subject Rights
Written by AI from the linked story. Not reviewed by an editor. How this works
Cerved Group S.p.A. violated GDPR by failing to adequately respond to data subject access requests, withholding critical information such as credit scores and the algorithmic logic behind them. This opacity left individuals unable to understand or challenge decisions that materially impacted their lives, including denials of energy supply. Automated decision-making systems that affect individuals must provide meaningful explanations to comply with GDPR Articles 13, 14, and 22. The case highlights that data controllers in the credit and commercial information sector bear heightened obligations when profiling individuals, and inadequate transparency can trigger significant regulatory penalties.
Tactical Insight
Immediate actions
- Audit all existing data subject request (DSR) workflows to ensure responses include scores, profiling logic, and the basis for automated decisions.
- Establish a dedicated DSR response team with defined SLAs aligned to GDPR's one-month response requirement.
Long-term improvements
- Implement a formal explainability framework for all automated scoring and profiling models, documenting the logic in plain language accessible to data subjects.
- Conduct annual GDPR compliance reviews specifically targeting Articles 13, 14, 15, and 22 obligations for any automated decision-making processes.
- Embed Data Protection by Design principles into new product development to ensure transparency mechanisms are built in from the start.
Detection & oversight measures
- Deploy a centralized DSR tracking system with automated escalation alerts to prevent missed or incomplete responses.
- Schedule periodic internal audits and DPO-led assessments to identify gaps in data subject rights fulfillment before regulatory review.