Deutsche Bank Fined €48K After Misclassifying Data Controller Roles Under GDPR
Written by AI from the linked story. Not reviewed by an editor. How this works
Deutsche Bank and Poste Italiane incorrectly designated each other as data processors when, under GDPR, both were acting as independent data controllers. This misclassification caused a cascade of compliance failures, most notably the omission of accurate data recipient information in privacy notices as required by GDPR Article 13. The error highlights how poorly understood data controller/processor distinctions remain within large financial institutions. Such misclassification is not merely a paperwork issue — it directly strips individuals of their right to know who is responsible for their personal data and how to exercise their rights.
Tactical Insight
Immediate actions
- Conduct a legal review of all existing data sharing agreements to verify whether each counterparty is correctly classified as a controller or processor under GDPR definitions.
- Update privacy notices (Article 13/14 disclosures) to accurately reflect all data recipients and their legal roles.
Governance & process improvements
- Establish a formal Data Sharing Classification Protocol requiring legal and DPO sign-off before any third-party data agreement is executed.
- Maintain a living data map or Record of Processing Activities (RoPA) that explicitly documents controller/processor relationships and is reviewed at least annually.
- Train legal, compliance, and procurement teams on the functional distinction between controllers and processors so misclassification is caught before agreements are signed.
Monitoring & audit measures
- Schedule periodic internal audits of data processing agreements against current GDPR guidance and EDPB opinions on controller/processor determination.
- Implement a compliance checkpoint triggered by any new or renewed data-sharing partnership to reassess classification and notice obligations.