Garante per la protezione dei dati personali (Italy) - 485/2026
Italy's Garante fines Cerved Group €400,000 for inadequate data subject request responses.
Italy's Garante per la protezione dei dati personali has fined Cerved Group S.p.A. €400,000 for failing to adequately respond to data subject requests. The commercial information system processed personal data for creditworthiness assessments, leading to energy supply denials for some individuals. The Garante found that Cerved Group provided incomplete information, including scores and the logic behind them, hindering data subjects' ability to exercise their rights under GDPR.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Cerved Group S.p.A.?
Get an email when a new story names Cerved Group S.p.A., usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonCerved Group S.p.A. violated GDPR by failing to adequately respond to data subject access requests, withholding critical information such as credit scores and the algorithmic logic behind them. This opacity left individuals unable to understand or challenge decisions that materially impacted their lives, including denials of energy supply. Automated decision-making systems that affect individuals must provide meaningful explanations to comply with GDPR Articles 13, 14, and 22. The case highlights that data controllers in the credit and commercial information sector bear heightened obligations when profiling individuals, and inadequate transparency can trigger significant regulatory penalties.
What helps against this
How we list vendors- Identity governance and single sign-on
People who leave or change roles lose access everywhere at once, and forgotten accounts stop piling up.
- Data loss prevention (DLP)
Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.