Summary of the Decision Origin of the case The Italian Data Protection Authority (DPA) received a complaint from an employee of Poste Italiane who, following the rejection of a loan application submitted through BancoPosta, discovered that information concerning her financial situation was accessible through a platform used by authorised company staff. The information included her net income and existing financial commitments. The complainant questioned the disclosure of these data and requested their erasure. The DPA launched an investigation into the processing of personal data by Poste

Background information Date of final decision: 14/05/2026 National case Controller: Wind Tre S.p.A. Legal References: Article 5 (Principles relating to processing of personal data), Article 32 (Security of processing) Decision: Administrative fine, Compliance order Key words: Personal data breaches, Basic principles, Cybersecurity Summary of the Decision Origin of the case The Italian Data Protection Authority (DPA) launched an investigation into Wind Tre S.p.A. following two personal data breaches notified by the company in February 2025. The breaches involved unauthorised access to the

Background information Date of final decision: 23/09/2026 National case Controller: Barbuti S.p.A. Legal References: Article 5 (Principles relating to processing of personal data), Article 12 (Transparent information, communication and modalities for the exercise of the rights of the data subject), Article 17 (Right to erasure (‘right to be forgotten’) Decision: Administrative fine, Compliance order Key words: Data subjects rights, Fines, Marketing Summary of the Decision Origin of the case The Italian Data Protection Authority (DPA) received a complaint from an individual who continued to

Brussels, 04 November - European Data Protection Authorities (DPAs) work together to protect personal data, especially for children who are more vulnerable online. Kids may not recognise risks easily, trust strangers, or share personal data carelessly. Many apps collect their data, and without proper safeguards, they could be exposed to harmful content and leave long-lasting digital footprints. This is why the EDPB launches ‘Privacy for Kids’, a new hub for parents, teachers, and educators. It provides engaging and children friendly resources such as games, videos and quizzes, to understand

Background information Date of final decision: 2 October 2026 National case Controller: Xandr Inc. Legal References: Article 6 (Lawfulness of processing), Article 9 (Processing of special categories of personal data) Decision: Administrative fine Key words: Fines, Basic principles, Marketing, Online platforms Summary of the Decision Origin of the case The case started in 2020 when the Norwegian Consumer Council lodged a complaint against the advertising technology company Xandr (at the time AppNexus, now a part of Microsoft) with the Norwegian DPA (Data Protection Authority). The case concerns

Background information Date of final decision: 6 August 2026 National case Controller: La Patria S.p.A. Legal Reference(s): Article 12 (Transparent information, communication and modalities for the exercise of the rights of the data subject), Article 13 (Information to be provided where personal data are collected from the data subject) and Article 15 (Right to access by the data subject) Decision: Administrative fine Key words: Data subjects rights, Fines Summary of the Decision Origin of the case The Italian Data Protection Authority (DPA) initiated an investigation following a complaint

Background information Date of final decision: 23 September 2026 National case Controller: IQVIA Solutions Italy S.r.l Legal Reference(s): Article 5 (Principles relating to processing of personal data), Article 9 (Processing of special categories of personal data), Article 13 (Information to be provided where personal data are collected from the data subject), Article 25 (Data protection by design and by default), Article 28 (Processor) and Article 35 (Data protection impact assessment) Decision: Administrative fine Key words: Data protection impact assessment, Health and research

Background information Date of final decision: 3 July 2026 National case Controller: Banco Bilbao Vizcaya Argentaria, S.A., Italian branch (BBVA) Legal Reference(s): Article 5 (Principles relating to processing of personal data), Article 12 (Transparent information, communication and modalities for the exercise of the rights of the data subject), Article 21 (Right to object), Article 24 (Responsibility of the controller) Decision: Administrative fine, Compliance order Key words: Website topics: Basic principles, Data subjects rights, Marketing Summary of the Decision Origin of the case The