Italian DPA fines Poste Italiane and Deutsche Bank a combined EUR 81 000 for lack of transparency in personal data processing
Summary of the Decision
Origin of the case
The Italian Data Protection Authority (DPA) received a complaint from an employee of Poste Italiane who, following the rejection of a loan application submitted through BancoPosta, discovered that information concerning her financial situation was accessible through a platform used by authorised company staff.
The information included her net income and existing financial commitments. The complainant questioned the disclosure of these data and requested their erasure.
The DPA launched an investigation into the processing of personal data by Poste Italiane and Deutsche Bank in connection with the promotion and provision of BancoPosta loans.
Key Findings
The investigation established that, contrary to their contractual arrangements, Poste Italiane and Deutsche Bank acted as independent data controllers.
Poste Italiane collected loan applications and carried out intermediary activities, including identifying financial products suited to applicants' needs, while Deutsche Bank independently assessed creditworthiness and decided whether to grant the loans.
The DPA found that the privacy notices provided by both companies did not adequately reflect their respective roles and the personal data exchanged between them.
In particular, Poste Italiane had failed to provide sufficiently clear information on the processing carried out during the promotion and distribution of loans, including the recipients of personal data and information flows involving the bank.
Deutsche Bank had also failed to correctly identify Poste Italiane as a recipient of personal data acting as an independent controller.
The DPA stressed that privacy notices must provide clear, complete and understandable information about the processing of personal data. The need for concise information cannot justify omitting essential details that enable individuals to understand how their data are used.
Both companies were found to have infringed Articles 5(1)(a) and 13 GDPR.
Decision
The Italian DPA imposed an administrative fine of EUR 48 000 on Poste Italiane and EUR 33 000 on Deutsche Bank.
During the investigation, both companies erased the complainant's personal data. Poste Italiane also updated its privacy notice, while Deutsche Bank issued internal instructions to limit the inclusion of personal and credit information in communications concerning loan applications.
The DPA also ordered Deutsche Bank to amend its privacy notice within six months to accurately reflect the role of Poste Italiane as an independent data controller and to provide evidence of compliance.
For further information: