[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f6deuPdzzY4F-3X1jMhW1Ly82gPtpfokGIHR34XDNltw":3},{"article":4,"iocs":45,"watch_terms":46,"solutions":47,"lesson":125},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":22,"category":23,"article_tags":27},"9282270a-083a-4a95-bb10-3d60f321ed1f","Garante per la protezione dei dati personali (Italy) - 747\u002F2026","garante-per-la-protezione-dei-dati-personali-italy-747-2026-a257e4","Created page with \"{{DPAdecisionBOX |Jurisdiction=Italy |DPA-BG-Color= |DPAlogo=LogoIT.png |DPA_Abbrevation=Garante per la protezione dei dati personali |DPA_With_Country=Garante per la protezione dei dati personali (Italy) |Case_Number_Name=747\u002F2026 |ECLI= |Original_Source_Name_1=Garante per la protezione dei dati personali |Original_Source_Link_1=https:\u002F\u002Fwww.garanteprivacy.it\u002Fweb\u002Fguest\u002Fhome\u002Fdocweb\u002F-\u002Fdocweb-display\u002Fdocweb\u002F10310707 |Original_Source_Language_1=Italian |Original_Source_L...\" Show changes","Italy's Garante per la protezione dei dati personali has imposed a €48,000 fine on Poste Italiane S.p.A. and Deutsche Bank. The fine was issued for the incorrect designation of roles as processor and controller, and for an inadequate privacy notice that led to processing data contrary to fairness and transparency principles. This stemmed from Deutsche Bank publishing a loan applicant's outstanding payments and net income on a platform accessible to Poste Italiane staff.","Italy's Garante fines Poste Italiane and Deutsche Bank €48,000 for privacy violations.","https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=Garante_per_la_protezione_dei_dati_personali_(Italy)_-_747\u002F2026&diff=53577&oldid=0","https:\u002F\u002Fgdprhub.eu\u002Fimages\u002Fe\u002Fec\u002FLogoIT.png","2026-11-02T15:52:30+00:00","2026-11-02T16:00:31.999943+00:00",7,[17,20],{"name":18,"type":19},"Deutsche Bank","vendor",{"name":21,"type":19},"Poste Italiane","c5c77cdb-f7d7-4990-9436-c81dcbff1163",{"id":22,"icon":24,"name":25,"slug":26},null,"Policy","policy",[28,33,38,40],{"category":29},{"id":30,"icon":24,"name":31,"slug":32},"2e06f76c-d5b9-4f54-9eef-4d3447b10730","Breaches","breaches",{"category":34},{"id":35,"icon":24,"name":36,"slug":37},"3f0f8451-91df-4b6c-9a73-ef3b2509b7f1","GDPR","gdpr",{"category":39},{"id":22,"icon":24,"name":25,"slug":26},{"category":41},{"id":42,"icon":24,"name":43,"slug":44},"d95477d7-eb04-4fad-a2dc-be1428040ce7","Privacy Fines","privacy-fines",[],[18,21],{"controls":48,"vendors":124},[49,78,107],{"slug":50,"name":51,"problem":52,"products":53},"identity-governance","Identity governance and single sign-on","People who leave or change roles lose access everywhere at once, and forgotten accounts stop piling up.",[54,62,70],{"vendor_slug":55,"vendor_name":56,"vendor_logo":57,"product_slug":58,"product_name":59,"url":60,"description":61},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","workforce-identity","Okta Workforce Identity","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fworkforce-identity\u002F","Single sign-on, adaptive MFA including phishing-resistant methods, and lifecycle management for employees.",{"vendor_slug":63,"vendor_name":64,"vendor_logo":65,"product_slug":66,"product_name":67,"url":68,"description":69},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","entra-id","Microsoft Entra ID","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fidentity-access\u002Fmicrosoft-entra-id","Cloud identity and access management with single sign-on, conditional access, passkeys and identity governance.",{"vendor_slug":71,"vendor_name":72,"vendor_logo":73,"product_slug":74,"product_name":75,"url":76,"description":77},"omada","Omada","\u002Fvendor-logos\u002Fomada.png","omada-identity-cloud","Omada Identity Cloud","https:\u002F\u002Fomadaidentity.com\u002Fproducts\u002Fomada-identity-cloud\u002F","Identity governance and administration delivered as a service.",{"slug":79,"name":80,"problem":81,"products":82},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.",[83,91,99],{"vendor_slug":84,"vendor_name":85,"vendor_logo":86,"product_slug":87,"product_name":88,"url":89,"description":90},"netskope","Netskope","\u002Fvendor-logos\u002Fnetskope.png","netskope-dlp","Netskope DLP","https:\u002F\u002Fwww.netskope.com\u002Fproducts\u002Fdata-loss-prevention","Data loss prevention for web, cloud apps, AI tools and endpoints.",{"vendor_slug":92,"vendor_name":93,"vendor_logo":94,"product_slug":95,"product_name":96,"url":97,"description":98},"proofpoint","Proofpoint","\u002Fvendor-logos\u002Fproofpoint.png","enterprise-dlp","Proofpoint Enterprise DLP","https:\u002F\u002Fwww.proofpoint.com\u002Fus\u002Fproducts\u002Fdata-loss-prevention","Data loss prevention across email, cloud and endpoints.",{"vendor_slug":100,"vendor_name":101,"vendor_logo":102,"product_slug":103,"product_name":104,"url":105,"description":106},"forcepoint","Forcepoint","\u002Fvendor-logos\u002Fforcepoint.png","forcepoint-dlp","Forcepoint DLP","https:\u002F\u002Fwww.forcepoint.com\u002Fproduct\u002Fdlp-data-loss-prevention","Data loss prevention for endpoints, network, email and cloud applications.",{"slug":108,"name":109,"problem":110,"products":111},"compliance-automation","Compliance automation (GRC)","Evidence for NIS2, DORA and ISO 27001 is collected continuously, not in a rush before the audit.",[112,118],{"vendor_slug":113,"vendor_name":114,"vendor_logo":115,"product_slug":113,"product_name":114,"url":116,"description":117},"drata","Drata","\u002Fvendor-logos\u002Fdrata.png","https:\u002F\u002Fdrata.com\u002F","Continuous control monitoring and audit readiness across security frameworks.",{"vendor_slug":119,"vendor_name":120,"vendor_logo":121,"product_slug":119,"product_name":120,"url":122,"description":123},"vanta","Vanta","\u002Fvendor-logos\u002Fvanta.png","https:\u002F\u002Fwww.vanta.com\u002F","Automated evidence collection and continuous monitoring for ISO 27001, SOC 2, NIS2 and other frameworks.",[],{"slug":126,"title":127,"body":128,"framework_refs":129,"framework_notes":136},"poste-italiane-deutsche-bank-fined-48000-for-misaligned-data-roles-and-opaque-privacy-notices","Poste Italiane & Deutsche Bank Fined €48,000 for Misaligned Data Roles and Opaque Privacy Notices","Deutsche Bank shared a loan applicant's sensitive financial data — including outstanding payments and net income — on a platform accessible to Poste Italiane staff, without clearly defining who was the data controller and who was the data processor. This role ambiguity meant neither party took full accountability for ensuring the data processing was lawful, fair, and transparent. The absence of an adequate privacy notice meant the data subject had no meaningful awareness that their personal financial information was being shared and accessed in this way. This case illustrates that data protection failures are not always the result of cyberattacks — contractual and governance gaps between organizations can be just as damaging and carry significant regulatory consequences.",[130,131,132,133,134,135],"GDPR Article 32","NIST SP 800-53 SI-2: Flaw Remediation","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","CIS Control 14: Security Awareness and Skills Training","CIS Control 17: Incident Response Management",{"GDPR Article 32":137,"NIST SP 800-53 SI-2: Flaw Remediation":138,"CIS Control 17: Incident Response Management":139,"CIS Control 14: Security Awareness and Skills Training":140,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":141,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":142},"Article 32 requires controllers and processors to implement appropriate technical and organizational measures to ensure data security; unclear role designation between Deutsche Bank and Poste Italiane meant neither party fully owned this obligation, leaving personal financial data inadequately protected.","While not a software flaw, the governance gap in role designation represents a systemic control deficiency; a structured remediation process for identifying and correcting such organizational weaknesses would have prevented the violation.","Having a structured incident response and governance review process would have allowed either organization to identify and escalate the privacy notice inadequacy and role misclassification before regulators intervened.","Staff at both Poste Italiane and Deutsche Bank involved in configuring the shared platform needed training on data protection roles and privacy-by-design principles; better awareness could have flagged the role ambiguity before data was improperly shared.","More broadly, ISO 27001 Annex A controls around information classification and third-party agreements (A.5.19–A.5.22) would require clear documentation of data handling responsibilities when sharing personal data with partner organizations, directly addressing the role misdesignation found here.","The exposure of a loan applicant's sensitive financial data to Poste Italiane staff highlights a failure to restrict data access based on defined roles and authorizations, which PR.AA directly addresses by requiring that access to data be managed and limited appropriately."]