Garante per la protezione dei dati personali (Italy) - 10273659

Experian Italia failed to provide data subjects with meaningful information about how their creditworthiness scores were calculated, violating GDPR's transparency and privacy-by-design principles. This is not merely a procedural failure — concealing automated decision-making logic directly undermines individuals' ability to contest inaccurate assessments and exercise their rights under Articles 13, 14, and 22 of the GDPR. Organizations that process personal data for profiling or scoring purposes are legally required to explain the logic involved, not just acknowledge that a score exists. The €120,000 fine signals that regulators are intensifying scrutiny of algorithmic transparency, particularly in the financial and credit sectors. Companies relying on automated scoring models must treat explainability as a compliance requirement, not a technical afterthought.