Deutsche Bank Fined €33,000 for Misclassifying Data Role and Failing Transparency Obligations
Written by AI from the linked story. Not reviewed by an editor. How this works
Deutsche Bank was penalised by Italy's data protection authority for incorrectly designating itself as a data processor rather than a data controller, and for providing an inadequate privacy notice to a loan applicant. This misclassification meant that critical safeguards — including lawful basis determination, transparency requirements, and data subject rights — were not properly applied. Sensitive financial data (outstanding payments and net income) was then disclosed on a platform accessible to Poste Italiane staff without proper justification, even after the data subject objected. The case demonstrates that misunderstanding or misrepresenting roles within a data-sharing arrangement can cause cascading compliance failures. Correct role classification is foundational to GDPR accountability and cannot be treated as a formality.
Tactical Insight
Immediate actions
- Conduct a formal review of all existing data-sharing agreements to verify that controller and processor roles are correctly and legally assigned.
- Audit current privacy notices for completeness and accuracy, ensuring they clearly describe the purposes, legal bases, and recipients of personal data.
Long-term improvements
- Establish a Data Protection Impact Assessment (DPIA) process for any new data-sharing arrangements involving third-party platforms or partners.
- Implement a data subject rights management workflow so that objections and access requests trigger documented, time-bound reviews before data is shared.
- Train legal, compliance, and product teams on the distinction between data controllers and processors under GDPR to prevent future misclassification.
Detection and governance measures
- Schedule periodic reviews by the Data Protection Officer (DPO) of all third-party platform access permissions to detect unauthorised or excessive data exposure.
- Maintain a central Record of Processing Activities (RoPA) that is reviewed quarterly to catch role assignments and purpose descriptions that have drifted from legal requirements.