Experian Italia Fined €120K for Ignoring Data Subject Rights and Privacy by Design Failures
Experian Italia failed to establish adequate mechanisms for responding to data subject requests, leaving individuals unable to exercise their GDPR-guaranteed rights over credit data that directly impacted their access to essential services like energy. This case illustrates that privacy by design and default are not optional architectural features but legal obligations requiring active implementation from the ground up. The use of personal data in high-stakes decisions — such as denying utility supply — makes robust data governance especially critical. Regulatory fines like this signal that supervisory authorities are scrutinizing not just breaches, but systemic failures in data subject rights management.
Tactical Insight
Immediate actions
- Audit all existing data subject request (DSR) workflows to ensure timely, complete responses are achievable within GDPR-mandated timeframes.
- Appoint or reassign a dedicated Data Protection Officer (DPO) with authority to enforce DSR compliance across business units.
Long-term improvements
- Embed privacy by design principles into every new product, system, and process from inception, requiring formal privacy impact assessments (PIAs) before launch.
- Implement a centralized DSR management platform to track, escalate, and audit all incoming requests with full audit trails.
- Establish data minimization policies to limit the collection and retention of personal data used in automated or semi-automated decision-making.
Detection & monitoring measures
- Set up automated alerts for DSR requests approaching their legal response deadline to prevent non-compliance.
- Conduct quarterly internal audits of credit data processing activities to verify alignment with declared purposes and GDPR obligations.