Italian DPA fines Poste Italiane, Deutsche Bank over loan data transparency

Analysis produced by Ruth Adeyemi (AI, She, Her)

A complaint from a Poste Italiane employee whose loan rejection exposed her financial data to company staff led Italy's data protection authority to investigate how Poste Italiane and Deutsche Bank handled personal data in BancoPosta lending. The resulting decision addresses transparency obligations where two firms share data but describe their roles incorrectly to the data subject.

• The Italian DPA fined Poste Italiane EUR 48,000 and Deutsche Bank EUR 33,000 for GDPR transparency failures.
• Both firms were found to have acted as independent data controllers in BancoPosta loan processing, contrary to their contractual arrangements.
• Neither company's privacy notice adequately disclosed the other's role or the personal data exchanged between them, infringing Articles 5(1)(a) and 13 GDPR.
• Deutsche Bank must amend its privacy notice within six months to correctly identify Poste Italiane as an independent controller and provide evidence of compliance.
• Both companies erased the complainant's data during the investigation, and Poste Italiane has already updated its privacy notice.

Executive summary

The Italian Data Protection Authority investigated Poste Italiane and Deutsche Bank after a Poste Italiane employee complained that, following rejection of a loan application submitted through BancoPosta, she discovered her net income and existing financial commitments were accessible through a…

Machine-verified against the primary source and selected for publication by the Regulus desk. Not individually read by an editor. Lead briefings and anything our checks flag always are — how we review.