Italy

Intesa Sanpaolo S.p.A

100,000 €

GDPR enforcement action by Italian Data Protection Authority (Garante) on 2022-05-26.

Rank · Sector

#89

of 322 in Finance, Insurance and Consulting

Rank · Italy

#74

of 543

Rank · All fines

#468

of 3,042

Case details

Authority: Italian Data Protection Authority (Garante)
Date: 2022-05-26
Controller / Processor: Intesa Sanpaolo S.p.A
Sector: Finance, Insurance and Consulting
Quoted Articles: Art. 5 (1) a), f) GDPR, Art. 6 GDPR
Type of violation: Insufficient legal basis for data processing

Summary

The Italian DPA has imposed a fine of EUR 100,000 on Intesa Sanpaolo S.p.A.. The bank had unlawfully disclosed data of the data subject to unauthorized third parties (the father of the data subject ). The data subject's father, a former employee of the bank, had been authorized to access his daughter's bank data until she reached the age of majority. However, the father had demanded access to his daughter's data, who in the meantime had already reached the age of majority. An employee of the bank suspected that the father still had authorization and for this reason passed on the daughter's data.

Open original source Links to the regulator's original publication or another source.