Italy

Cerved Group S.p.A.

400,000 €

GDPR enforcement action by Italian Data Protection Authority (Garante) on 2026-07-03.

Rank · Sector

#51

of 331 in Finance, Insurance and Consulting

Rank · Italy

#52

of 595

Rank · All fines

#285

of 3,127

Case details

Authority: Italian Data Protection Authority (Garante)
Date: 2026-07-03
Controller / Processor: Cerved Group S.p.A.
Sector: Finance, Insurance and Consulting
Quoted Articles: Art. 5 (1) a) GDPR, Art. 12 GDPR, Art. 15 GDPR
Type of violation: Insufficient fulfilment of data subjects rights

Summary

The Italian DPA has imposed a fine of EUR 400,000 on Cerved Group S.p.A. Cerved Group is a commercial information provider. It supplied one of the credit scores (Score Retail Utilities) combined into the CGS-X score used by two energy retailers, calculating it from personal data including the data subject's age, place of birth and address of residence. The controller did not comply adequately with the requests of data subjects, disclosing only whether a record existed in its database and stating that no negative information concerning them was held, without the Score Retail Utilities, the sub-scores behind it or the logic used to calculate it. During the investigation it was found that the company was in possession of the requested data. Revised response templates introduced in October 2024 and September 2025 remained incomplete. The controller argued the score was only a partial indicator left to the retailers' own decision-making, which the authority rejected, holding that it decisively guided their decisions.

Open original source Links to the regulator's original publication or another source.