What happened
A Poste Italiane employee, after her own loan application was rejected, found information about her financial situation — net income and existing commitments — on a platform accessible to some company operators. Her complaint triggered the investigation. With decisions no. 746 and 747 of 7 October 2026, announced in the 23 October newsletter, the Italian Garante fined Poste Italiane €48,000 and Deutsche Bank €33,000.
The core issue is not the platform but the relationship between the two companies. Poste collected applications and acted as intermediary, identifying the most suitable product; Deutsche Bank independently assessed creditworthiness and decided whether to grant the loan. Each therefore determined purposes and means for itself: for the Garante they acted as independent controllers, contrary to what their agreements formally provided.
The two infringements
- Poste Italiane had not properly informed loan applicants about processing during promotion and placement, in particular about data recipients and information flows to the bank.
- Deutsche Bank had not correctly stated in its notice the role of Poste Italiane as recipient and independent controller; it must update its notice within six months.
- During the investigation both deleted the complainant's data; Poste updated its notice and the bank instructed staff to limit personal and credit data in loan communications.
The Garante recalled that privacy notices must state clearly, completely and understandably who processes the data, for what purposes and to whom it is disclosed: brevity cannot extend to omitting essential elements.
The check for clients who distribute or sell others' products
Agencies, intermediaries, sales networks, comparison sites, pick-up points: put the partner agreement next to what actually happens. Who chooses the product? Who decides the outcome? Who may use the data for itself? If each decides for itself, there are two controllers and an Art. 28 processor appointment does not hold. Then open the privacy notice: it must say that data goes to the partner, in what role and for what.
Roles are not chosen by writing them into the contract: they follow from who determines purposes and means (Art. 4(7) GDPR). A contract describing a relationship different from the real one protects neither party; it leads to wrong privacy notices, which is exactly what was fined here.
In the client file, record for each business partner the real role (independent controller, joint controller, processor), the document governing it and the passage of the privacy notice that declares it. In DPO Workspace the relationship map and the record of processing keep the three together.
Official source:Garante per la protezione dei dati personali — Newsletter n. 554 del 23 ottobre 2026Official source:Garante per la protezione dei dati personali — provvedimento n. 746 del 7 ottobre 2026 [doc. web 10310707]Official source:Garante per la protezione dei dati personali — provvedimento n. 747 del 7 ottobre 2026 [doc. web 10310391]Looking for a workspace for your DPO work?
DPO Workspace is built by a certified DPO. 30-day free trial.
Start free
