Italian Data Protection Authority Imposes Fines
The Italian Data Protection Authority has imposed fines totalling EUR 81,000 on Poste Italiane and Deutsche Bank. According to the authority’s findings, the companies failed to provide adequate information about the processing of personal data in connection with the brokering and granting of BancoPosta loans.
The two penalty decisions, bearing register numbers 746 and 747, are dated 7 October 2026. The authority imposed a fine of EUR 48,000 on Poste Italiane and a fine of EUR 33,000 on Deutsche Bank.
Complaint by a Poste Italiane Employee
The proceedings arose from a complaint filed by a Poste Italiane employee. After her loan application submitted through BancoPosta had been rejected, she discovered that information about her financial circumstances could be viewed via a platform accessible to authorised employees of the company.
The data available there included her net income and existing financial commitments. The complainant objected to the disclosure of this information and requested its erasure.
The Italian Data Protection Authority subsequently investigated the processing of personal data by Poste Italiane and Deutsche Bank in connection with the marketing and provision of BancoPosta loans.
Both Companies Acted as Independent Controllers
Actual Responsibilities Determined the Allocation of Roles
The investigation found that, contrary to their contractual arrangements, Poste Italiane and Deutsche Bank each acted as an independent controller. In its assessment, the Data Protection Authority considered the functions actually performed. The concepts of controller and processor must be understood in functional terms and serve to allocate data protection responsibilities in accordance with the roles actually performed.
According to the authority’s findings, the responsibilities were allocated as follows:
- Poste Italiane received the loan applications and acted as an intermediary. This also included identifying financial products that met the applicants’ needs.
- Deutsche Bank independently assessed creditworthiness and decided whether to grant the loan in question.
The companies therefore did not process personal data within a controller-processor relationship. Instead, each company was independently responsible for the processing operations it carried out.
Privacy Notices Did Not Adequately Reflect Data Processing
Inadequate Information Provided by Poste Italiane
In the Data Protection Authority’s view, neither company’s privacy notice adequately reflected their respective roles or the exchange of personal data between them.
In particular, Poste Italiane had failed to provide sufficiently clear information about data processing in connection with the marketing and distribution of the loans. The authority’s objections concerned, among other matters, the information provided about the recipients of personal data and the flows of information involving the bank.
Deutsche Bank Incorrectly Classified Poste Italiane
According to the authority’s findings, Deutsche Bank’s privacy notice also failed to comply with the applicable requirements. It identified Poste Italiane as an external processor among the recipients of data. However, according to the authority’s assessment, Poste Italiane was in fact acting as an independent controller.
Deutsche Bank had therefore failed to classify Poste Italiane correctly as a recipient of personal data that processes such data under its own responsibility for compliance with data protection law.
Transparency Requires Material and Comprehensible Information
The Italian Data Protection Authority emphasised that privacy notices must contain clear, complete and comprehensible information about the processing of personal data. The requirement to provide concise information does not justify omitting material details that data subjects need in order to understand how their data is used.
The authority found that both companies had infringed Article 5(1)(a) and Article 13 GDPR (General Data Protection Regulation). In this case, the transparency obligations covered, in particular, the actual allocation of roles, the recipients of personal data and the relevant data flows between the companies involved.
Orders and Measures in the Proceedings
During the investigation, both companies erased the complainant’s personal data. Poste Italiane also revised its privacy notice.
Deutsche Bank issued internal instructions to limit the inclusion of personal data and loan-related information in communications concerning loan applications. In addition, the Data Protection Authority ordered the bank to amend its privacy notice within six months. The revised notice must accurately describe Poste Italiane’s status as an independent controller. Deutsche Bank must also provide the authority with evidence that it has complied with this order.
Importance of Transparent Roles in Lending Processes
The decisions demonstrate that contractual designations are not, by themselves, decisive for classification under data protection law. What matters are the responsibilities that a company actually assumes in the specific processing operation and the associated decision-making powers.
Companies, investors and private individuals with questions about transparency obligations, responsibilities or the exchange of personal data can contact MTR Legal Rechtsanwälte. Further information is available under Legal Advice on Data Protection Law.
