What Changed
- Italian DPA imposed administrative fines totaling EUR 81,000 on Poste Italiane and Deutsche Bank for breaching GDPR Articles 5(1)(a) and 13.
- Investigation found that both companies acted as independent data controllers without properly reflecting data flows and recipient statuses in privacy notices.
- Deutsche Bank was ordered to amend its privacy notice within six months to accurately identify Poste Italiane as an independent data controller.
Organizations offering co-branded or partnered financial products within the European Union must maintain strict compliance with General Data Protection Regulation (GDPR) transparency obligations, particularly when defining data controller roles. The Italian Data Protection Authority (DPA) imposed administrative fines of EUR 48,000 on Poste Italiane and EUR 33,000 on Deutsche Bank, totaling EUR 81,000, for failing to adequately inform loan applicants about personal data processing.
The regulatory investigation originated from a complaint filed by a Poste Italiane employee. Following the rejection of her loan application submitted through BancoPosta, she discovered that details of her financial situation—including net income and existing commitments—remained accessible on an internal platform used by authorized staff. Investigating the data processing practices of both entities regarding BancoPosta loans, the Italian DPA found that, despite their contractual arrangements, Poste Italiane and Deutsche Bank acted as independent data controllers. Poste Italiane collected applications and carried out intermediary tasks, while Deutsche Bank independently evaluated creditworthiness and made final lending decisions.
The DPA established that the privacy notices of both companies violated Articles 5(1)(a) and 13 of the GDPR. Poste Italiane failed to clearly outline processing activities during loan promotion, data recipients, and information flows to Deutsche Bank. Deutsche Bank failed to identify Poste Italiane as an independent controller recipient. The authority emphasized that while privacy information should be concise, conciseness cannot justify omitting essential details required for individuals to understand data usage.
During the proceedings, both entities erased the complainant's data. Poste Italiane updated its privacy notice, while Deutsche Bank issued internal instructions to restrict credit details in loan communications. The DPA also ordered Deutsche Bank to amend its privacy notice within six months to correctly designate Poste Italiane as an independent data controller and to submit proof of compliance.
Who May Be Affected
Financial institutions, commercial loan intermediaries, and loan applicants in Italy and the European Union.
Cross-Border Context
Applies EU General Data Protection Regulation (GDPR) standards to financial services distribution involving an Italian entity (Poste Italiane) and an international banking group (Deutsche Bank).
What to check next
- Official decision of the Italian DPA concerning Poste Italiane
- Official decision of the Italian DPA concerning Deutsche Bank
This article provides general information and does not constitute legal advice. Consult the official text and obtain advice appropriate to your circumstances where needed.