Deutsche Bank S.p.A.

Summary

The Italian DPA has imposed a fine of EUR 33,000 on Deutsche Bank S.p.A. An employee of Poste Italiane applied for a BancoPosta loan granted by Deutsche Bank. The bank refused the application and noted her existing financial commitments and net income in a free-text field of the loan file, where it was visible to Poste Italiane staff handling loan files and to anyone using the post office director’s computer. She asked both companies to erase her data and complained to the Italian DPA because she was not satisfied with the outcome. The DPA found that the bank and Poste Italiane act as independent controllers and that their mutual designation as processors had no factual basis. The bank’s privacy notice did not name the recipients of the data or properly reflect Poste Italiane’s role. Poste Italiane was fined EUR 48,000 in a parallel decision (ET ID [●]).