[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fiqLuiEoZMLQnrUyMjg81MeAefLscPTlDYBfZEJKk49k":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":22,"status":23,"created_at":24,"published_at":25,"article":26,"tags":30,"podcasts":43,"controls":44},"93744aaa-90d8-47fb-ab6d-9371c3b87110","experian-italia-fined-120k-for-opaque-credit-scoring-practices-under-gdpr","9b306578-61a2-49ec-b881-0cd5cd5ad0d9","Experian Italia Fined €120K for Opaque Credit Scoring Practices Under GDPR","Experian Italia failed to provide data subjects with meaningful information about how their creditworthiness scores were calculated, violating GDPR's transparency and privacy-by-design principles. This is not merely a procedural failure — concealing automated decision-making logic directly undermines individuals' ability to contest inaccurate assessments and exercise their rights under Articles 13, 14, and 22 of the GDPR. Organizations that process personal data for profiling or scoring purposes are legally required to explain the logic involved, not just acknowledge that a score exists. The €120,000 fine signals that regulators are intensifying scrutiny of algorithmic transparency, particularly in the financial and credit sectors. Companies relying on automated scoring models must treat explainability as a compliance requirement, not a technical afterthought.","**Immediate actions:**\n- Audit all automated decision-making and profiling processes to ensure data subjects can receive clear, plain-language explanations of scoring logic.\n- Review and update Data Subject Access Request (DSAR) response templates to include disclosure of scoring methodologies, input variables, and their relative weights.\n\n**Data governance improvements:**\n- Embed privacy-by-design reviews into the development lifecycle of any new scoring or profiling model before deployment.\n- Appoint a dedicated DSAR response team with subject-matter expertise in automated processing to ensure technically accurate and legally compliant replies.\n- Document all profiling algorithms in a central model registry, including version history and explainability artifacts, to support rapid regulatory disclosure.\n\n**Long-term compliance measures:**\n- Conduct annual GDPR Article 22 compliance assessments covering all automated decision-making systems that produce legal or similarly significant effects.\n- Engage your Data Protection Officer (DPO) in regular reviews of credit and risk scoring models to validate ongoing compliance with transparency obligations.",[12,13,14,15,16,17,18,19,20,21],"GDPR Article 13 – Information to be provided where personal data are collected from the data subject","GDPR Article 14 – Information to be provided where personal data have not been obtained from the data subject","GDPR Article 15 – Right of access by the data subject","GDPR Article 22 – Automated individual decision-making, including profiling","GDPR Article 25 – Data protection by design and by default","NIST Privacy Framework PR.PO-P4 – Policies, processes, and procedures for privacy by design","NIST SP 800-53 PT-6 – System of Records Notice","CIS Control 3 – Data Protection","ISO\u002FIEC 27701:2019 – Privacy Information Management (PIMS)","ITIL Service Design – Transparency and accountability in service delivery",{},"published","2026-09-01T10:21:31.157053+00:00","2026-09-01T10:21:31.064+00:00",{"id":7,"url":27,"slug":28,"title":29},"https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=Garante_per_la_protezione_dei_dati_personali_(Italy)_-_10273659&diff=52856&oldid=0","garante-per-la-protezione-dei-dati-personali-italy-10273659-dc53b3","Garante per la protezione dei dati personali (Italy) - 10273659",[31,37],{"id":32,"name":33,"slug":34,"description":35,"color":36},"c0dcc566-3654-4d70-8ede-262a198e732f","Regulatory Compliance","regulatory-compliance","GDPR, NIS2, DORA, sector-specific violations","#ec4899",{"id":38,"name":39,"slug":40,"description":41,"color":42},"c8b843a5-d5a7-41d1-8d3b-cabded09d2ef","Data Protection","data-protection","Unencrypted data, missing DLP, poor classification","#3b82f6",[],[45,49],{"slug":46,"name":47,"problem":48},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.",{"slug":50,"name":51,"problem":52},"compliance-automation","Compliance automation (GRC)","Evidence for NIS2, DORA and ISO 27001 is collected continuously, not in a rush before the audit."]