Garante per la protezione dei dati personali (Italy) - 747/2026
Italian DPA fines Deutsche Bank and Poste Italiane for GDPR violations related to data processing.
The Italian Data Protection Authority (Garante) found that Deutsche Bank and Poste Italiane S.p.A. incorrectly designated each other as processors, when they were in fact independent controllers. This misclassification led to violations of GDPR Article 13 regarding privacy notices, particularly concerning the specification of data recipients and fair processing. Consequently, the Garante imposed a fine of €48,000 on Deutsche Bank.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Deutsche Bank?
Get an email when a new story names Deutsche Bank, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonDeutsche Bank and Poste Italiane incorrectly designated each other as data processors when, under GDPR, both were acting as independent data controllers. This misclassification caused a cascade of compliance failures, most notably the omission of accurate data recipient information in privacy notices as required by GDPR Article 13. The error highlights how poorly understood data controller/processor distinctions remain within large financial institutions. Such misclassification is not merely a paperwork issue — it directly strips individuals of their right to know who is responsible for their personal data and how to exercise their rights.
What helps against this
How we list vendors- Data loss prevention (DLP)
Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.
- Compliance automation (GRC)
Evidence for NIS2, DORA and ISO 27001 is collected continuously, not in a rush before the audit.