Poste Italiane S.p.A.

Summary

The Italian DPA has imposed a fine of EUR 48,000 on Poste Italiane S.p.A. An employee of Poste Italiane applied for a BancoPosta loan, which is granted by Deutsche Bank S.p.A. and distributed by Poste Italiane. Deutsche Bank refused the application and, in the free-text “notes” field of the loan file, recorded the applicant’s existing financial commitments and net income. This information was visible to Poste Italiane staff handling loan files and to anyone using the post office director’s workstation. The applicant asked both companies to erase her data and complained to the Garante because she was not satisfied with the outcome. The Garante found that Poste Italiane and Deutsche Bank act as independent controllers in the BancoPosta loan process. The mutual designation as processors under Art. 28 GDPR had no factual basis, because roles follow the actual allocation of decision-making. Poste Italiane’s privacy notice did not name the recipients of the data and did not properly reflect Poste Italiane’s own role. This breached the principle of transparency. Deutsche Bank was fined EUR 33,000 in the parallel decision (ET ID [●]).