Garante per la protezione dei dati personali (Italy) - 10273659
Italian DPA fines Experian Italia €120,000 for inadequate responses and privacy violations.
Italy's Garante per la protezione dei dati personali has fined Experian Italia €120,000 for failing to adequately respond to data subject requests and for violating privacy by design and default principles. The agency's inadequate data protection measures prevented data subjects from exercising their rights, particularly concerning credit information used to deny energy supply.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Experian?
Get an email when a new story names Experian, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonExperian Italia failed to establish adequate mechanisms for responding to data subject requests, leaving individuals unable to exercise their GDPR-guaranteed rights over credit data that directly impacted their access to essential services like energy. This case illustrates that privacy by design and default are not optional architectural features but legal obligations requiring active implementation from the ground up. The use of personal data in high-stakes decisions — such as denying utility supply — makes robust data governance especially critical. Regulatory fines like this signal that supervisory authorities are scrutinizing not just breaches, but systemic failures in data subject rights management.
What helps against this
How we list vendors- Identity governance and single sign-on
People who leave or change roles lose access everywhere at once, and forgotten accounts stop piling up.
- Data loss prevention (DLP)
Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.
- Compliance automation (GRC)
Evidence for NIS2, DORA and ISO 27001 is collected continuously, not in a rush before the audit.