Poste Italiane & Deutsche Bank Fined €48,000 for Misaligned Data Roles and Opaque Privacy Notices
Written by AI from the linked story. Not reviewed by an editor. How this works
Deutsche Bank shared a loan applicant's sensitive financial data — including outstanding payments and net income — on a platform accessible to Poste Italiane staff, without clearly defining who was the data controller and who was the data processor. This role ambiguity meant neither party took full accountability for ensuring the data processing was lawful, fair, and transparent. The absence of an adequate privacy notice meant the data subject had no meaningful awareness that their personal financial information was being shared and accessed in this way. This case illustrates that data protection failures are not always the result of cyberattacks — contractual and governance gaps between organizations can be just as damaging and carry significant regulatory consequences.
Tactical Insight
Immediate actions
- Conduct a formal data-sharing mapping exercise to explicitly document and agree upon controller/processor roles before any joint data processing begins.
- Review and update all privacy notices shared with data subjects to ensure they accurately describe who accesses their data, for what purpose, and on what legal basis.
Long-term improvements
- Establish a Data Protection Agreement (DPA) or Joint Controller Agreement for every inter-organizational data sharing arrangement, reviewed at least annually.
- Implement a data minimization policy so that only staff with a documented, role-based need can access sensitive personal financial information on shared platforms.
- Build a recurring privacy impact assessment (DPIA) process for all new data flows involving third-party platforms or partner organizations.
Detection and oversight measures
- Deploy access logging on shared platforms to create an auditable trail of who viewed or processed personal financial data and when.
- Assign a designated Data Protection Officer (DPO) responsibility to review inter-party data flows quarterly and flag any misalignments in role designation or notice adequacy.