[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fjh1571zodUY8fZd9-bJyMyISeNAA9kTKZOQELiUief0":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"status":22,"created_at":23,"published_at":24,"article":25,"tags":29,"podcasts":42},"ece7c3b7-ca40-4c6c-b198-5782c344c291","experian-italia-fined-120k-for-ignoring-data-subject-rights-and-privacy-by-design-failures","5d5f166d-5975-4053-a683-4a807720a91c","Experian Italia Fined €120K for Ignoring Data Subject Rights and Privacy by Design Failures","Experian Italia failed to establish adequate mechanisms for responding to data subject requests, leaving individuals unable to exercise their GDPR-guaranteed rights over credit data that directly impacted their access to essential services like energy. This case illustrates that privacy by design and default are not optional architectural features but legal obligations requiring active implementation from the ground up. The use of personal data in high-stakes decisions — such as denying utility supply — makes robust data governance especially critical. Regulatory fines like this signal that supervisory authorities are scrutinizing not just breaches, but systemic failures in data subject rights management.","**Immediate actions:**\n- Audit all existing data subject request (DSR) workflows to ensure timely, complete responses are achievable within GDPR-mandated timeframes.\n- Appoint or reassign a dedicated Data Protection Officer (DPO) with authority to enforce DSR compliance across business units.\n\n**Long-term improvements:**\n- Embed privacy by design principles into every new product, system, and process from inception, requiring formal privacy impact assessments (PIAs) before launch.\n- Implement a centralized DSR management platform to track, escalate, and audit all incoming requests with full audit trails.\n- Establish data minimization policies to limit the collection and retention of personal data used in automated or semi-automated decision-making.\n\n**Detection & monitoring measures:**\n- Set up automated alerts for DSR requests approaching their legal response deadline to prevent non-compliance.\n- Conduct quarterly internal audits of credit data processing activities to verify alignment with declared purposes and GDPR obligations.",[12,13,14,15,16,17,18,19,20,21],"GDPR Article 5(1)(f) – Integrity and confidentiality","GDPR Article 12 – Transparent information and communication","GDPR Article 15 – Right of access by the data subject","GDPR Article 17 – Right to erasure","GDPR Article 25 – Data protection by design and by default","GDPR Article 58 – Powers of supervisory authorities","NIST Privacy Framework PR.PO-P1 – Policies and procedures","NIST SP 800-53 IP-1 – Consent","CIS Control 3 – Data Protection","ISO\u002FIEC 27701 – Privacy Information Management","published","2026-09-01T20:20:41.500859+00:00","2026-09-01T20:20:41.354+00:00",{"id":7,"url":26,"slug":27,"title":28},"https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=Garante_per_la_protezione_dei_dati_personali_(Italy)_-_10273659&diff=52869&oldid=52858","garante-per-la-protezione-dei-dati-personali-italy-10273659-eab9f9","Garante per la protezione dei dati personali (Italy) - 10273659",[30,36],{"id":31,"name":32,"slug":33,"description":34,"color":35},"c0dcc566-3654-4d70-8ede-262a198e732f","Regulatory Compliance","regulatory-compliance","GDPR, NIS2, DORA, sector-specific violations","#ec4899",{"id":37,"name":38,"slug":39,"description":40,"color":41},"c8b843a5-d5a7-41d1-8d3b-cabded09d2ef","Data Protection","data-protection","Unencrypted data, missing DLP, poor classification","#3b82f6",[]]