Italian DPA sanctions Experian Italia for incomplete Art. 15 GDPR access responses on

[Web Doc. No. 10273659] Decision of July 3, 2026 Register of Decisions No. 486 of July 3, 2026 THE DATA PROTECTION AUTHORITY AT today’s meeting, attended by Prof. Pasquale Stanzione, Chair; Prof. Ginevra Cerrina Feroni, Vice Chair; Dr. Agostino Ghiglia, Member; and Dr. Luigi Montuori, Secretary General; HAVING REGARD TO Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016 (hereinafter the “Regulation”); HAVING REGARD TO Legislative Decree No. 196 of June 30, 2003 (Code on Data Protection, hereinafter the “Code”), as amended by Legislative Decree No. 101 of August 10, 2018, containing “Provisions for the alignment of national legislation with the provisions of Regulation (EU) 2016/679”; HAVING EXAMINED the documentation on file; HAVING CONSIDERED the observations made by the Secretary General pursuant to Art. 15 of the Data Protection Authority’s Regulation No. 1/2000; RAPPORTEUR: Dr. Agostino Ghiglia; WHEREAS 1.

Introduction. This Authority has received several requests concerning the processing of personal data carried out by Experian Italia S.p.A. (hereinafter also referred to as the “Company”) for the purpose of verifying the creditworthiness of potential customers of Hera Comm S.p.A. and EstEnergy S.p.A. Specifically, the complainants alleged that Hera Comm S.p.A. and EstEnergy S.p.A. refused to supply energy to them on the basis of a risk profile of the data subjects that allegedly emerged, following checks carried out by the aforementioned Companies, including through consultation of credit information systems (managed by Experian Italia S.p.A.) and the use of commercial information services (managed by Cerved Group S.p.A.). This risk profile is developed within the Hera Group using software provided by Major 1 S.r.l., called “CGS-X.” This software enables the aforementioned energy suppliers to develop a risk profile regarding the creditworthiness of potential customers, based on an integrated indicator called the “Integrated Utilities Score” (hereinafter also referred to as the “CGS-X Score”).

The latter is the result of combining two assessment indicators: one called “ESX Score” (provided by Experian Italia S.p.A.) and the other called “Retail Utilities Score” (provided by Cerved Group S.p.A.). In this regard, the petitioners pointed out that, although the denial of energy supply resulted from their being assigned a composite score indicating low creditworthiness—derived from consultations of the databases managed by Cerved Group S.p.A. and Experian Italia S.p.A.— these companies, when specifically questioned on this point through requests for access pursuant to Art 15 of the Regulation, had stated that there was no negative information and/or adverse events within their systems regarding the aforementioned data subjects that would justify a negative assessment. With regard to the foregoing, it should be noted that the Authority, in light of the numerous requests received, first decided to consolidate the individual proceedings referred to above in order to conduct a comprehensive examination of the underlying issues and subsequently initiated, on its own initiative, pursuant to Article 21 of the Data Protection Authority’s Regulation No. 1/2019, an investigation aimed at assessing, as a whole, the methods and processing purposes of the data processing carried out by Experian Italia S.p.A. in connection with the service provided by Major 1 S.r.l. and known as “CGS-X.”

In this context, several on-site inspections were conducted: at Hera S.p.A. on March 18, 19, and 20, 2024; at Major 1 S.r.l., on April 15 and 16, 2024; at Cerved Group S.p.A. on April 16, 2024; and at Experian Italia S.p.A. on June 13 and 14, 2024. Subsequently, given the particular complexity of the investigation and in order to obtain further information regarding the processing of the aforementioned data, additional on-site inspections were conducted at Major 1 S.r.l., on October 15 and 16, 2024, and at Cerved Group S.p.A. on October 16, 2024. 2. The Preliminary Investigation. The preliminary investigation into Experian Italia S.p.A. took into account not only the findings of the aforementioned inspections but also additional information provided in the supplementary documentation submitted by the company on June 27, 2024, to address the reservations raised during the on-site inspections, as well as Experian Italia S.p.A.’s communication dated February 6, 2025, and the information contained in the note dated April 18, 2025, which was received in response to the Authority’s request for information dated March 19, 2025.

As part of the investigation, with regard to the issues highlighted in the introduction, the following findings emerged. 2.1. The results of the on-site inspections. The “CGS-X” software is distributed “based on a contractual package that requires the customer [i.e., the energy supplier] to sign three separate contractual documents with Cerved Group S.p.A., Experian Italia S.p.A., and Major 1 S.r.l.” (see Major’s minutes of April 15, 2024, p. 3). Once enrolled in the service, the energy provider enters its potential customers’ data into the CGS-X software, acting as an independent controller and, at the same time, designating Major 1 S.r.l. as the processor, pursuant to Art. 28 of the Regulation. The latter acts as a technology outsourcer, providing the license to use the “CGS-X” software and, in this context, in response to a query made by the energy provider, consults the commercial information systems managed by Cerved Group S.p.A., as well as credit information systems managed by Experian Italia S.p.A.

According to the findings of the inspection at Major 1 S.r.l., “access to the information systems of Cerved and Experian is carried out by Major 1 S.r.l., in the name and on behalf of the client [energy supplier] (..) and constitutes a transfer of data between independent controllers (between Experian/Cerved and the client)” (see Major 1 S.r.l. report dated April 15, 2024, p. 3). From an operational standpoint, “the operation of the aforementioned software requires that the client [energy supplier] perform a query (..) with a specific request based on the tax identification number [of the data subject]” (see minutes of Major 1 S.r.l. dated April 15, 2024, p. 2). The system “queries the information systems of Cerved and Experian using the same tax identification numbers,” retrieving the “Retail Utilities Score” from Cerved Group S.p.A. and the “ESX Score” from Experian Italia S.p.A., along with the corresponding sub-scores.

This information “is processed by Major 1’s software in order to obtain (..), in response to the aforementioned queries, (..) an integrated score (the so-called CGS-X Score) relating to the assessment of the data subjects’ ‘reliability’; a score that is the result of combining (..) the scores obtained from the Experian databases (Credit Information System—SIC) and Cerved (commercial information)” (see minutes of Major 1 S.r.l. dated April 15, 2024, pp. 2–3). More specifically, with regard to the processing carried out by Experian Italia S.p.A. for the purpose of calculating the “ESX Score,” it was verified that the latter is calculated based on the following variables: - “Delphi for utilities (D4U)”: statistical model, [OMISSIS]” (see minutes of Experian Italia S.p.A. dated June 13, 2024, pp. 3–4); - “DG3r”: indicator “[OMISSIS]” (see Experian Italia S.p.A. report dated June 13, 2024, p. 3); - “CDI”: indicator “[OMISSIS]” (see the minutes of Experian Italia S.p.A. dated June 13, 2024, p. 3); - “GeoDelphi”: statistical model “[OMISSIS], which takes into account the place of residence listed in the data subject’s personal records [OMISSIS]” (see Experian Italia S.p.A. minutes of June 13, 2024, pp. 3–4).

On this point, a representative stated that, “it is likely that the XML schema was initially designed, in agreement with Cerved, to include the details of the aforementioned variables, and that only subsequently, the companies [Experian Italia S.p.A. and Cerved Group S.p.A.] agreed to limit the information necessary for calculating the CGS-X score (…). However, the XML schema was not modified accordingly and remained as originally planned” (see minutes of Experian Italia S.p.A. dated June 14, 2024, p. 2). 2.2. Requests regarding the exercise of rights submitted to Experian Italia S.p.A. by data subjects. Specifically, with regard to the responses contested by the complainants—provided by the Company pursuant to Articles 12 and 15 of the Regulation—it emerged that Experian Italia S.p.A. limited itself to sending the applicants an information report containing only the personal data present in the SICs.

More specifically, in the communications sent to the data subjects, in some cases, information was provided regarding the existence of a loan application in the approval process (see response of September 30, 2022, sent to Mr. XX; in other cases, reference was made to certain existing credit accounts with payments up to date and to additional credit accounts that had already been duly closed (see response of September 29, 2023, provided to Mr. XX); in still others, it was confirmed that no information regarding the data subject was recorded in the SIC (see response of October 10, 2022, provided to Mr. XX; notification dated April 4, 2024, sent to Mr. XX; response dated May 31, 2024, provided to Mr. XX). It also emerged that, in none of the cases subject to complaint, did the response provided by the Company contain explicit references to the “ESX Score” and the related sub-scores assigned to the data subjects.

All of this, although it was found that Experian Italia S.p.A. provided the aforementioned scores and sub-scores—referring to the latter—in response to inquiries made by Major 1 S.r.l. in connection with the provision of the “GCS-X” software (see, in this regard, the records obtained from Major 1 S.r.l. during the inspection on October 15, 2024; see, in particular, Annex 8 of the Major 1 S.r.l. report dated April 16, 2024; see also Annexes 3, 4, and 5 of the Major 1 S.r.l. report dated October 15, 2024). It was also established that “even when [the data subject in question] was not present in the SIC (..), a score was [nevertheless] assigned [to him].” On this point, it has in fact emerged that the aforementioned score is “generated based on the GeoDelphi indicator,” which is the “result of a statistical model, [OMISSIS], based exclusively on the data subject’s residential address.” For these reasons, even when the data subject is not present in the SIC, an “ESX Score” is nonetheless generated for that individual (see the statement by Experian Italia S.p.A. dated June 14, 2024, p. 3).

With regard to the explanations provided by Experian Italia S.p.A. concerning the content of the responses sent to the data subjects who filed complaints in the case at hand, the company’s representative stated that, “unless the [aforementioned] requests contain an explicit reference to the scores, the company considers [such requests] to have been adequately addressed by providing only the data regarding the data subject’s status in the SIC, taking into account the data subjects’ need to know their credit status. For this reason, in the response provided to the complainants, the company stated only whether or not the individual’s record was present in the SIC and, if present, the data contained therein” (see the minutes of Experian Italia S.p.A., dated June 14, 2024, p. 3). It should also be noted that, following the inspections conducted at the company, and with specific reference to the request submitted by Ms. XX pursuant to Art. 15 of the Regulation (in this case, on September 10, 2024), Experian Italia S.p.A. responded on September 20, 2024, “clarifying the logic behind the score’s operation and communicating the corresponding value calculated following the inquiry by Hera Comm S.p.A.

(…). In that same response, the Company offered to provide, at the data subject’s request, a further level of detail regarding the processed information, in accordance with the fundamental principles of transparency and fairness” (see Experian Italia S.p.A.’s note dated April 18, 2025, pp. 3–4 and Annex 2.). All of this is because “the Company has initiated a structured process to strengthen its internal procedures regarding the management of data subject rights, with the aim of consolidating an increasingly transparent and clear approach, in line with the changing needs of data subjects and with the principles of the Regulation itself. In this context, effective June 27, 2024, (..) it has adopted a new model for responding to requests for access pursuant to Article 15 of the Regulation, aimed at providing data subjects with more detailed and comprehensible information, with particular attention to the variables considered by the model and to the score returned following the query to the relevant entity” (see note from Experian Italia S.p.A. dated April 18, 2025, p. 3).

The aforementioned new approach “has also been incorporated into the internal documentation titled ‘Procedures for Responding to Data Subjects’” —updated in April 2025— “which was the subject, among other things, of a specific training session for Experian’s customer service staff” (see note from Experian Italia S.p.A. dated April 18, 2025, p. 3). With regard to response templates, the Company “beginning in January 2025, has further refined the text used to respond to access requests, with the aim of providing an even clearer, more concise, and more understandable level of detail” (see note from Experian Italia S.p.A. dated April 18, 2025, p. 3). Furthermore, “the response provided to an access request may, at the data subject’s request, be supplemented with more detailed information, in accordance with the provisions of [Section 5.1] of the updated procedure” (see note from Experian Italia S.p.A. dated April 18, 2025, p. 4 and Attachments Nos. 2, 3, 4, and 5).

With regard to the new form, an examination of the documentation on file (see Attachments Nos. 3 and 5 to the note from Experian Italia S.p.A. dated April 18, 2025) revealed that the data controller, in response to the request submitted by Ms. XX, provided, on July 8, 2024, a response that is incomplete, as it lacks the E5-35 sub-score, despite the presence in the SIC of credit information pertaining to the data subject ([OMISSIS]); likewise, the response sent to Mr. XX on January 17, 2025, based on the updated template, does not contain a reference to the “ESX-score” value, reporting only the value corresponding to the “ESX-index.” Finally, it was verified that the Company, during the period from January 2022 to June 2024, received 561 requests to exercise rights, submitted by potential customers of Hera Comm S.p.A. and/or EstEnergy S.p.A. and pertaining to the specific matter under review (see note from Experian Italia S.p.A. dated April 18, 2025, p. 4).

Finally, regarding storage periods, the Company stated that, as of the date of the investigation, it “stored the XML record of the query and the corresponding response on its on-premises systems for 8 months”; this despite the fact that the Data Storage Procedure adopted by Experian Italia S.p.A. was “originally set at 12 months.” In August 2023, [in fact], due to disk space running out on the company’s systems, [it] was decided to reduce this period to 8 months, while also initiating the necessary assessments to identify a timeframe appropriate for this processing activity” (see minutes of Experian Italia S.p.A., dated June 14, 2024, p. 2). Furthermore, it was stated in a note dated April 18, 2025, that the Company has adopted “a specific data retention policy, called the Record Retention Schedule, which governs the storage periods applicable to personal data processed and stored by the Company, with reference to the various types of processing” (see note from Experian Italia S.p.A. dated April 18, 2025, pp. 4–5).

Within this policy, the storage period for “XML logs of conversations with Major1” was once again set at twelve months. The “purpose of this storage is to facilitate the exercise of data subjects’ rights by streamlining the handling of any requests or complaints—even those received at a later date and including those from our client organizations” (see note from Experian Italia S.p.A. dated April 18, 2025, p. 5). 3. The notification pursuant to Article 166, paragraph 5, of the Code. Following the allegation of violations under Articles 5(1)(a), 12, and 15 of the Regulation, sent to Experian Italia S.p.A. via a notice dated July 16, 2025, the Company, by letter dated September 15, 2025, submitted its defense briefs, which were further supplemented during the hearing on May 21, 2026, and by a subsequent communication dated May 29, 2026. In the aforementioned briefs, Experian Italia S.p.A. made the following representations: a) regarding the allegation concerning the inadequacy of the responses provided to data subjects, in that they lacked information regarding the “ESX Score,” the additional sub-scores, and the logic and criteria applied to the calculation system, the responses provided by the data controller followed a “tiered disclosure” approach.

This was “justified [by the receipt of] a large number (...) of requests that require [Experian Italia S.p.A.] to implement and apply a response procedure structured across multiple levels of response and that provides, at least at the first level, the use of standardized response templates.” Based on this approach, the Company, in order to avoid “a technical overload that would have compromised the purpose of transparency pursued by the Regulation,” therefore provided data subjects, as a first step, with “access to the personal data contained in the SIC”. In this way, data subjects were “enabled (..) to request further details if necessary.” As of June 2024, Experian Italia S.p.A. It then introduced an updated version of the feedback form, which was further refined in January 2025; this was done in order to “combine completeness of information with clarity” in the guidance provided therein (see the Company’s note dated September 15, 2025, pp. 4, 9, and 10); b) regarding the application of Article 22 of the Regulation to the case at hand, “the indicators made available by Experian” through the “ESX Score” do not significantly influence the decision regarding the customer’s supply contract, as they are independent “statistical variables intended to be combined with other variables and synthesized into a further index (the CGS-X)”; an index “which, in turn, serves solely to support the analysis and determinations [carried out downstream by the energy supplier], which remain the exclusive accountability” of the latter (see the Company’s note dated September 15, 2025, p. 5: see also the minutes of the hearing of May 21, 2026, p. 2); c) regarding the objection concerning the storage of XML files for a period of eight months, this was determined “by contingent technical requirements and did not compromise the effective exercise of the data subjects’ rights.”

On this point, the Company noted that “virtually all requests by data subjects to exercise their rights are received by Experian within six months of Experian’s communication of the score to the Energy Supplier.” The temporary measure of reducing the storage period to 8 months therefore did not “actually cause any harm to the data subjects.” Furthermore, as of March 31, 2025, the Company has, in any case, “realigned the retention period to twelve months, in line with the Record Retention Schedule” (see the Company’s note dated September 15, 2025, pp. 4 and 16); d) with regard to the alleged violation of Article 25 of the Regulation for having transmitted to Major1 S.r.l., in the XML files, certain sub-scores not necessary for the calculation of the “CGS-X Score” (specifically, the D4U and DG3r indices), the inclusion of these “did not have any adverse effects on the data subjects concerned.”

In any case, the Company, as part of discussions with Cerved Group S.p.A., has initiated a process to “streamline the XML format dedicated to the utilities sector, in order to limit the information content transmitted to Major1 S.r.l., to the variables relevant to the CGS-X for that sector, and to the consequent update of the XML response schemas to modify the aforementioned schema” (see supplementary note of May 29, 2026, p. 2). This was done in order to “overcome the critical issues and strengthen compliance controls in line with the principles of privacy by design and by default” (see the Company’s note of September 15, 2025, pp. 4, 16, 17, and 19); e) with regard to the subjective element of the violation, “in this case, the existence of intent or negligence on the part of Experian should be ruled out.” All of this is recited in light of the fact that, at the time of the events, Experian’s conduct was in accordance with the interpretation of Articles 22 and 15, para 1, subparagraph h), of the Regulation, as derived from the application of the “Code of Conduct for Information Systems Managed by Private Entities Regarding Consumer Credit, Creditworthiness, and Timeliness of Payments.”

The latter “constituted [at that time] the main industry reference available regarding the interpretation and application of the rules established by the Regulation in the specific sector of credit scoring.” In this regard, the Company argued that article 10, paragraph 1, of the aforementioned Code of Conduct imposes “on the participant—and not on the operator—the obligation to provide an explanation of the scoring logic.” The Company also pointed out that the judgement of the Court of Justice of February 27, 2025, C-203/22, “was issued after the period during which Experian allegedly engaged in the conduct at issue” (see minutes of the hearing of May 21, 2026, pp. 2–3); f) regarding the number of customers affected by the violation, this figure does not correspond to the 561 data subjects who submitted requests to Experian between January 2022 and June 2024, as indicated in the notice pursuant to Art. 166, paragraph 5 of the Code, but must be attributed exclusively to the six individuals whose complaints formed the basis of the proceedings (see minutes of the hearing of May 21, 2026, pp. 3 and 4).

The Company also emphasized the significant efforts it has made, following the initiation of the proceedings by the Data Protection Authority, to further bring its activities into compliance with personal data protection regulations. In this regard, in June 2025, Experian Italia S.p.A. “published a Frequently Asked Questions (FAQ) section dedicated to credit scoring,” in which it clarified “the technical aspects of credit scoring in detail, using language that is accessible and understandable even to a non-specialist audience” (see the Company’s statement of September 15, 2025, pp. 7, 19). More generally, the Company reiterated that, following the inspection findings, it had already adopted a series of measures to protect data subjects, such as: “updating the response templates (June 2024 and January 2025), realigning the retention period to twelve months (March 2025), revising the XML schemas, implementing internal quality control procedures, [as well as] measures that further increase transparency toward data subjects (..)

(June 5, 2025)” (see the Company’s note dated September 15, 2025, p. 20). Finally, it stated that it had promoted and adhered to the “Code of Conduct for Information Systems Managed by Private Entities Regarding Consumer Credit, Reliability, and Timeliness of Payments,” approved by resolution of the Data Protection Authority on October 6, 2022, and that it had actively participated, in 2024, “in various initiatives aimed at updating the [aforementioned] Code” (see the Company’s note dated September 15, 2025, p. 21). 4. The Authority’s Assessments. First of all, it is noted that, unless the act constitutes a more serious offense, anyone who, in proceedings before the Data Protection Authority, falsely declares or attests to information or circumstances, or produces false documents or records, is liable pursuant to Art. 168 of the Code, “False Statements to the Data Protection Authority and Interference with the Performance of the Data Protection Authority’s Duties or the Exercise of Its Powers.”

In light of the evidence gathered during the preliminary investigation described above, it has been established that Experian Italia S.p.A. provided inadequate and incomplete responses to requests from data subjects to exercise their rights under Articles 15–22 of the Regulation. This pertains specifically to the processing of personal data carried out by Experian Italia S.p.A. for the purpose of providing the “CGS-X” service. In this context, it also violated Article 5(1)(c) and Article 25 of the Regulation, as explained in greater detail below. Having duly set forth the foregoing, it should be noted at the outset that, for the purposes of addressing the issues at the heart of this decision, it is necessary to take into account the specific context underlying the processing activities carried out in the cases at hand. 4.1. The processing of personal data within the framework of credit information systems and the Court of Justice of the European Union’s judgement C-634/21 of December 7, 2023.

In its judgement of December 7, 2023, in Case No. C-634/21, the Court of Justice of the European Union (hereinafter “the Court”) ruled on the interpretation of Article 22 of the Regulation, with regard to the processing of personal data carried out within the framework of credit information systems. In that ruling, the Court clarified that the applicability of the aforementioned provision is subject to the fulfillment of three cumulative conditions related to the existence of a “decision,” that such a decision is “based solely on automated processing, including profiling,” and that it produces “legal effects [concerning the data subject],” or “significantly affects the data subject in a similar manner” (see para. 43, CJEU Judgement, C-634/21, cited above). The Court noted in particular that the concept of “decision,” within the meaning of Article 22(1) of the Regulation, may include various acts, including those which, although they do not have direct legal effects on the data subject, nonetheless significantly affect the data subject in a similar manner (see, to that effect, also Recital 71 of the Regulation).

That concept, therefore, is “broad enough to encompass the result of calculating a person’s creditworthiness in the form of a probability ratio relating to that person’s ability to meet future payment obligations.” This applies even where the result—as is the case here—is produced by a company that provides third parties with information regarding the creditworthiness of the data subjects (see para. 46, CJEU judgement, C-634/21, cited above). With regard to the additional conditions set forth in Art. 22 of the Regulation, the Court found that they were met in the specific context at hand. The ruling clarified, first of all, that the aforementioned decision is based exclusively on an automated calculation derived from the processing of the data subject’s personal data concerning the data subject’s reliability in terms of timely payments. Second, it held that the result of that calculation, in the form of a probability score, significantly affects the individual by preventing them from accessing the requested service—in this case, the energy supply at issue.

On this point, the Court itself has in fact clarified that, in the aforementioned context, “the action of the third party to whom the probability rate is transmitted is guided ‘decisively’ by that rate” (see para. 48, CJEU judgement, C-634/21, cited above), as has emerged during the present proceedings with respect to the decisions taken by Hera Comm S.p.A. and EstEnergy S.p.A. This interpretation is consistent with the rationale underlying Article 22 of the Regulation, which aims to ensure the protection of individuals’ fundamental rights and freedoms against the specific risks arising from the automated processing of personal data, including profiling (see para. 51, CJEU Judgement, C-634/21, cited above). Moreover, a restrictive interpretation of the aforementioned provision would undermine the safeguards for the protection of individuals provided for by the Regulation, since the individual would be unable to assert, against companies that provide information regarding the creditworthiness of data subjects, their right of access to data concerning them, as established by Art 15(1)(h) of the Regulation (see paragraphs 61–63, CJEU Judgement, C-634/21, cited above).

In conclusion, according to the Court, “Article 22(1) of the Regulation must be interpreted as meaning that the automated calculation, (...) of a probability score based on personal data relating to a person and concerning that person’s ability to meet future payment obligations constitutes an ‘automated individual decision-making process’ within the meaning of that provision, where the conclusion, performance, or termination of a contractual relationship with that person by a third party to whom that probability rate is communicated” (see para. 73, Judgement of the CJEU, C-634/21, cited above). It follows, therefore, that, contrary to the Company’s contention (see supra, para. 3(b) of this decision), the processing operations carried out by Experian Italia S.p.A. in the cases at issue in this decision fall within the scope of the aforementioned judgement and, therefore, Articles 15(1)(h) and 22 of the Regulation apply to them, as explained in greater detail below (see paragraphs 4.2. and 4.3. of this decision).

Finally, it should be noted that the proceedings in question concerned solely the measures adopted by Experian Italia S.p.A. to ensure proper compliance with the obligations set forth in Art. 15 et seq. of the Regulation regarding the exercise of rights; all of this in light of the specific instances of non-compliance that emerged during the preliminary investigation initiated by the Authority following the submission of the requests indicated in the preamble. With regard, however, to the broader issue concerning the conditions for lawfulness, pursuant to Art. 22(2) of the Regulation, of the processing of the data subject’s personal data carried out by credit information system operators, as well as the safeguards that the controller is required to implement, pursuant to Article 22, paragraphs 3 and 4 of the Regulation, the Authority reserves the right to take any appropriate measures necessary to verify the existence of the aforementioned conditions (see, on this subject, also the Authority’s statements on September 11, 2025, during the hearing of the President of the Data Protection Authority regarding “Draft Law AS 1578 on the Annual Market and Competition Law for 2025,” web doc. no. 10166076). 4.2.

Violations concerning the exercise of the right of access under Article 15 of the Regulation. First and foremost, following the preliminary investigation, it became evident that the responses provided by Experian Italia S.p.A. to requests by data subjects to exercise their rights under Articles 15–22 of the Regulation—aimed at obtaining information regarding the “ESX Score”—were inadequate. Based on the evidence gathered during the preliminary investigation as well as subsequent assessments conducted by this Department, it has been established that Experian Italia S.p.A. provided inadequate and incomplete responses to the requests to exercise rights under Articles 15–22 of the Regulation submitted by data subjects, inadequate and incomplete responses. In these responses, the Company limited itself to confirming the presence (or absence) of the data subjects’ records in the SIC and, where present, to communicating the personal data stored therein; without, however, providing any information regarding the score associated with the creditworthiness profile developed by the Company and made available to energy suppliers, nor regarding the criteria on which that profile was based.

Similarly, in these responses, the data subjects were not provided with information regarding the logic used to develop the aforementioned profile. In this regard, the Company represented that it had limited itself to providing the applicants with information concerning their status within the SIC, “since the [relevant] requests [pursuant to Article 15 of the GDPR] did not contain an explicit reference to the scores” (see minutes of Experian Italia S.p.A., dated June 14, 2024, p. 3). However, an examination of the documentation in the case file revealed that several of the requests under review, filed against Experian Italia S.p.A., contained an explicit reference to the fact that the refusal to supply energy by Hera Comm S.p.A. and/or EstEnergy S.p.A., was due to the assignment of a negative credit rating to them (see, in particular, the petitions: from Mr. XX, dated August 3, 2022; from Mr. XX, dated April 2, 2024; and from Mr. XX, dated September 18, 2023).

All of this occurred even though the information in question was, in fact—as ascertained during on-site inspections—still present in the data controller’s systems as of the date of receipt of the aforementioned requests (see supra, para 2.2. of this decision). On this point, it is worth noting that the right of access under Article 15 of the Regulation is primarily conceived as a tool intended, in general terms, the data subject to exercise “control” over the personal data concerning him or her, ensuring that the data subject is fully aware of the information being processed and the actual methods of such processing; in accordance with the general provisions of the principle of lawfulness, fairness, and transparency (Art 5(1)(a) of the Regulation). The purpose of the right of access is therefore primarily to disclose “what” data and “how” it has been processed by the controller in order to provide the data subject with the means to “ascertain and verify the lawfulness and accuracy of the processing” concerning them (see Recital 63 of the Regulation; European Data Protection Board, “Guidelines 1/2022 on the Rights of Data Subjects—Right of Access,” adopted on March 28, 2023, paragraphs 10–13).

Pursuant to Article 15 of the Regulation, therefore, the data controller, when responding to a request for access, may not limit itself to providing “a general description of the data [or] a mere reference to the categories of data processed,” nor may it omit information in its possession that relates to the data subject; on the contrary, the data controller is required to provide access to “all the information referred to in Article 15” pertaining to the data subject and actually subject to processing. Such information “must be complete, accurate, and up-to-date, reflecting as far as possible the state of the data processing at the time the request was received” and must be provided “in a concise, transparent, intelligible, and easily accessible form” to the data subject (see European Data Protection Board, “Guideline 1/2022 on the Rights of Data Subjects—Right of Access,” op. cit., para. 34; Art. 12, para. 1 of the Regulation).

On this point, reference is also made to the provisions of the “Code of Conduct for Information Systems Managed by Private Entities Regarding Consumer Credit, Creditworthiness, and Timely Payments,” approved by resolution of the Data Protection Authority on October 6, 2022, which sets forth specific obligations for the operator of an Information System (SIC) aimed at ensuring a prompt and timely response by the operator to requests to exercise rights submitted by data subjects (see Art. 9). In this regard, the Company’s interpretation of Article 10, paragraph 1, of the Code of Conduct—according to which “the obligation to provide an explanation of the scoring logic” is attributed “to the participant—and not to the operator—the obligation to provide an explanation of the scoring logic” pertaining to the data contained in a SIC, where such data are processed through automated decision-making processes (see para 3(e) of this decision).

On this point, it should be clarified that the aforementioned provision, while recognizing the data subject’s specific right to contact the participant under the terms set forth above (see, in particular, paragraph 1(d) of Article 10 of the Code of Conduct), does not exempt Experian Italia S.p.A. from fulfilling the obligations of the controller regarding the exercise of data subjects’ rights, pursuant to Articles 12 and 15 of the Regulation. Furthermore, the Company’s argument regarding its adoption of a “layered approach” aimed at avoiding an overload of information in the responses provided to requests from data subjects under Art. 15 of the Regulation (see paragraph 3(a) of this decision). This is because “the use [of such an approach] is not considered appropriate (..) in all situations.” Indeed, such an approach may be justified “only if the controller processes a large amount of personal data concerning the data subject making the request, and when the data subject has obvious difficulty grasping or understanding the information if it is provided all at once” (see European Data Protection Board, “Guidelines 1/2022 on the Rights of Data Subjects—Right of Access,” op. cit., para. 147).

Similarly, the layered approach “must be used in such a way as not to restrict the right of access” or “impose an additional burden on the data subject.” It follows that “the controller must be able to demonstrate that the use [of the aforementioned approach] offers added value to the data subject, as it helps the data subject understand the information provided” (see European Data Protection Board, “Guideline 1/2022 on the Rights of Data Subjects—Right of Access,” op. cit., paragraphs 143 and 147). Conversely, in the cases under consideration, the conditions set forth above are not met. This is because, although the data controller has received a substantial number of requests pursuant to Article 15 of the Regulation, for the purposes of applying this approach, what is relevant is rather the “large volume” of personal information processed by the data controller in relation to the individual data subject.

In fact, this circumstance does not apply to the requests made by the applicants, which were specifically aimed at obtaining only the personal information on the basis of which the supply of energy was denied. Furthermore, the response procedures adopted by the data controller in the case at hand effectively limited the right of access exercised by the data subjects, providing no added value to them. All of this is particularly relevant given that the responses provided by Experian Italia S.p.A. did not include information regarding the “ESX Score,” the additional sub-scores, or the logic and criteria applied to the calculation system. It should also be noted that the specific context underlying the requests to exercise the right of access submitted by the data subjects requires particular attention on the part of the controller, including with regard to the obligation to provide “meaningful information on the logic used, as well as [on] the significance and [the] expected consequences of such processing for the data subject” (Art. 15(1)(h) of the Regulation).

With regard to the aforementioned provision, the Court of Justice of the European Union has recently provided useful operational guidance—both substantively, concerning the type of information that the data subject may require from the controller, and formally, regarding the manner in which such information must be provided by the controller (see CJEU judgement of February 27, 2025, C-203/22). In particular, with regard to the phrase “meaningful information on the logic used,” the Court confirmed that this refers to “any relevant information concerning the procedure and principles of the automated processing of personal data for the purpose of achieving a specific result” (see para. 58, CJEU decision No. C-203/22, cited above). It follows, therefore, that the data subjects, in the case at hand, have the right to be fully informed of all the elements comprising the assessment of their creditworthiness, including those taken into account by the data controller for the purpose of assigning the score, as well as the calculation criteria used for that purpose (see, in this regard, Order of the Court of Cassation, Section I, No. 14381, dated May 25, 2021).

With regard to the manner in which the aforementioned information must be provided, the Court of Justice of the European Union has reaffirmed the data controller’s obligation to provide such information “in a concise, transparent, intelligible, and easily accessible form, using clear and plain language”; all in compliance with the principle of transparency set forth in Articles 5(1)(a) and 12(1) of the Regulation. Therefore, “neither the mere communication of a complex mathematical formula, such as an algorithm, nor a detailed description of all the stages of automated decision-making can satisfy these requirements, since neither of these methods would constitute a sufficiently concise and understandable explanation” (paragraphs 58–59, CJEU decision No. C-203/22, cited above). Overall, the requirement to provide “meaningful information on the logic used,” pursuant to Article 15(1)(h) of the Regulation, thus amounts to an obligation on the part of the controller to “describe the procedure and the principles actually applied in such a way that the data subject can understand which of [his or her] personal data have been used and how (…), without the complexity of the operations to be carried out in the context of the automated decision-making process exempting the controller from its duty to explain” (para. 61, CJEU Decision No. C-203/22, cited above).

In light of the foregoing, it follows that Experian Italia S.p.A., in the cases at issue, acted in violation of Articles 5(1)(a), para 1, 12, and 15 of the Regulation, as a result of which Hera Comm S.p.A. and/or EstEnergy S.p.A. subsequently denied the data subjects the activation of the relevant energy supply. Finally, the Company’s arguments regarding the fact that the aforementioned violation cannot be established because it occurred prior to the issuance of the aforementioned Decision No. C-203/22 (see para 3(e) of this decision) cannot be accepted. That decision, in fact, provides interpretive clarifications regarding regulatory obligations (Articles 12 and 15(1)(h) of the Regulation) which were, in any case, fully in force at the time the conduct in question occurred. On this point, it is worth noting, however, that the responses provided by Experian Italia S.p.A. to the data subjects, in the case at hand, contained no reference to the “ESX Score” or to any additional sub-scores.

Furthermore, they contained no reference to the “logic used” underlying the calculation of the credit risk profile. 4.3. The response template pursuant to Art 15 of the Regulation prepared following the Data Protection Authority’s investigation and other aspects of the violation. It is worth noting that the aforementioned violations persist even with regard to the new feedback forms that Experian Italia S.p.A. has prepared, effective June 27, 2024 (see above, para. 2.2), in order to provide data subjects with more information, including regarding “the variables considered by the model and the score” assigned to them (see the Company’s note of April 18, 2025, p. 3). In particular, the investigation revealed that the Company, based on the updated models, provided a response on July 8, 2024, to the request submitted by Ms. XX, a response that is incomplete because it lacks the “E5-35” sub-score, despite the presence in the SIC of credit information pertaining to the data subject ([OMISSIS]); likewise, the response sent to Mr. XX on January 17, 2025, does not contain a reference to the “ESX-score” value, reporting only the value corresponding to the “ESX-index” (see Attachments Nos. 3 and 5 to the letter from Experian Italia S.p.A. dated April 18, 2025).

It follows from this that even the use of the new model, adopted by Experian Italia S.p.A. in June 2024 (and subsequently updated in January 2025), is capable of ensuring that the data subjects effectively exercise their right of access under Articles 12 and 15 of the Regulation with respect to the specific processing operations in question. The inadequacy of the responses provided by the Company as a whole has therefore effectively prevented the aforementioned data subjects from accessing the types of personal data actually used to process the relevant risk profile and from understanding the actual methods by which such information is used. Consequently, this prevented them from verifying the lawfulness and fairness of the processing, as well as the accuracy of the data used in the context at hand, thereby compromising their ability to exercise, where applicable, the right to rectification in the event of inaccurate and/or incomplete data (see Art. 16 of the Regulation), and, at the same time, the right to “obtain human intervention from the controller, [to] express their opinion and contest the decision” taken against them by the controller (see Article 22(3) of the Regulation).

This risk arises, in particular, in cases where, as noted during the preliminary investigation, “even though [the data subject] was not listed in the SIC (..), an ESX Score was [nevertheless] assigned [to him]” associated with a level of unreliability, based exclusively on the data subject’s residential address (see paragraph 2.2 of this decision). All of this—given the particularly sensitive nature of the information processed by Experian Italia S.p.A. in the case at hand, as it pertains to customer creditworthiness—could have detrimental consequences on the fundamental rights and freedoms of the data subjects (such as, for example, as occurred in the cases in question, the refusal to sign an energy supply contract). The aforementioned unlawful conduct—during the period from January 1, 2022, to June 14, 2024—affected approximately 561 data subjects (see Experian Italia S.p.A.’s note dated April 18, 2025, p. 4).

In this regard, in fact, the Company’s argument that the relevant figure in the case at hand is not 561 but rather only the number pertaining to the six individuals whose complaints formed the basis of the proceedings cannot be accepted (see above, para. 3, subparagraph (f) of this decision). On this point, it should be noted that, contrary to the Company’s assertion (see minutes of the hearing of May 21, 2026), the scope of the proceedings in question cannot be limited exclusively to the cases of data subjects who submitted reports and/or complaints to the Authority. This is because the Data Protection Authority, in the exercise of its supervisory duties—and considering also the large number of requests received by the Authority at various times—recognized the need to initiate, pursuant to Art. 21 of the Data Protection Authority’s Regulation No. 1/2019—a broader investigation aimed at evaluating, as a whole, the methods and processing purposes generally carried out by Experian Italia S.p.A. in connection with the service provided by Major 1 S.r.l. and known as “CGS-X.”

It should also be noted that the Company’s assertions on this point have not been substantiated in any way by Experian Italia S.p.A. through the submission of adequate supporting documentation. In order to determine the number of data subjects involved in these proceedings, therefore, only the Company’s express statement in its note dated April 18, 2025, regarding the figure of 561 data subjects is relevant (see p. 4; see also, in this regard, the minutes of the hearing of May 21, 2026, pp. 3 and 4). Finally, with specific regard to the violation of Article 12 of the Regulation concerning eight months of XML log storage, as set forth in the Authority’s notice of July 16, 2025, it is considered that the conditions for adopting measures pursuant to Article 58 of the Regulation are not met. Therefore, limited to this specific aspect, the request made by Experian Italia S.p.A. to dismiss the allegation regarding this specific instance of the violation is granted (see para 3, subparagraph c) of this decision). 4.4.

The violation of the principles of privacy by design and privacy by default. During the proceedings, it emerged that Experian Italia S.p.A., in response to inquiries made by Major 1 S.r.l. through the “CGS-X,” transmits to the latter an XML file containing a variety of information, as described in paragraph 2.1 of this decision. In particular, it was verified that the aforementioned file contains certain sub-scores—specifically, D4U and Dg3r—that are not necessary for calculating the “CGS-X Score.” In this regard, Major 1 S.r.l. has expressly stated that it does not use these sub-scores in the provision of the aforementioned service (see Major 1 S.r.l.’s statement of October 14, 2024, p. 3). More specifically, on this point, it should be noted that Experian Italia S.p.A., for the purpose of transmitting to Major 1 S.r.l. the information necessary to calculate the “CGS-X Score,” did not develop a custom XML schema tailored to the sector at issue in the cases under review, but instead limited itself to using the schema originally designed solely for the banking sector; this schema, as such, contains data (in this instance, the D4U and Dg3r sub-scores) that are not necessary for calculating the “CGS-X Score” pertaining instead to the specific utilities sector (see Major 1 S.r.l.’s minutes of October 14, 2024, p. 3).

Furthermore, although the Company subsequently agreed with Cerved Group S.p.A. “to limit the information necessary for calculating the CGS-X score for utilities” (see Annex 1 to the minutes of Experian Italia S.p.A. dated June 14, 2024), it did not subsequently modify the XML schema “accordingly, and [the latter therefore] remained as initially envisaged” (see the minutes of Experian Italia S.p.A. dated June 14, 2024, p. 2). Experian Italia S.p.A., therefore, on the one hand, in the context of identifying the procedures defining the methods for transmitting the data necessary for processing the “CGS-X Score” for utilities, failed to implement adequate technical and organizational measures to effectively implement the data protection principles set forth in Art. 5 of the Regulation, nor to incorporate into the processing the necessary safeguards to meet the requirements of the Regulation; on the other hand, when designing the system in question, it failed to implement options and default settings to ensure that, by default, only the personal data necessary for the specific purpose of the processing in question was processed in accordance with the principle of data minimization set forth in Art. 5(1)(c) of the Regulation, only the personal data necessary for the specific processing purpose in question.

It should be noted that the controller, pursuant to Article 25 of the Regulation, is obligated—from the planning stage of the processing and continuously throughout the processing—to put in place appropriate measures and necessary safeguards that allow for the effective implementation of the principles of data protection by design and by default, and to regularly verify the effectiveness of the measures and safeguards thus identified. It follows, therefore, that “by default, the data controller must not collect more data than is necessary [and at the same time] must not process the data collected beyond what is necessary for its purpose”; furthermore, “once processing has begun, (..) the controller is required to maintain [privacy by design and by default] on an ongoing basis,” through “periodic assessments and reviews of the effectiveness of the measures and safeguards it has chosen” (see European Data Protection Board, “Guidelines 4/2019 on Article 25: Data protection by design and by default,” adopted on October 20, 2020, paragraphs 37 and 42).

Experian Italia S.p.A., with regard to the processing at issue, therefore used an XML template designed for the provision of a service intended for a sector other than utilities, thereby engaging in conduct contrary to Article 25 of the Regulation. The use of the aforementioned template also effectively resulted, as extensively explained above, in the transmission to Major 1 S.r.l. of information that exceeded what was necessary for the specific purpose pursued; all of which also constitutes a violation of the principle of data minimization set forth in Art. 5(1)(c) of the Regulation. Finally, with regard to the comments submitted by the Company (see para 3(d) of this decision), it should be noted that, for the purposes of assessing the conduct of Experian Italia S.p.A. with respect to the application of Article 25 of the Regulation, contrary to what the latter has argued, the fact that the data subjects in this case may or may not have suffered harm is irrelevant.

Indeed, the core purpose of the aforementioned provision is precisely to ensure adequate and effective data protection by design and by default. This means, therefore, that data controllers must be able to demonstrate that they have adopted, from the outset, appropriate measures and safeguards to ensure compliance with data protection principles and that the effectiveness of such measures is regularly verified; however, these circumstances were not found to exist in the case at hand. 5. Conclusions: Declaration that the processing is unlawful. Corrective measures pursuant to Art. 58(2) of the Regulation. In light of the overall findings, the Authority considers that the statements, documentation, and explanations provided by the controller during the investigation do not sufficiently address the objections notified by the Office in thenotice of initiation of proceedings, and are therefore insufficient to warrant the dismissal of this proceeding, especially since none of the cases provided for in Art. 11 of the Data Protection Authority Regulation No. 1/2019 apply.

The processing of personal data carried out by Experian Italia S.p.A., which is the subject of this decision, was therefore conducted in violation of Articles 5(1)(a) and (c), 12, 15, and 25 of the Regulation. With regard to the exercise of the corrective powers provided for in Art. 58(2) of the Regulation, although it is acknowledged that Experian Italia S.p.A., during the proceedings, voluntarily adopted some initial measures aimed at bringing the processing of customer data into compliance with the Regulation, these measures do not appear adequate for the reasons already explained (see above, paragraphs 2.2 and 3 of this decision). It is therefore deemed necessary, in light of the critical issues identified regarding the controller, to order the controller, pursuant to Article 58(2)(c) and (d) of the Regulation, to implement the following corrective measures: a) updating the template for responding to requests for access, pursuant to Article 15 of the Regulation, prepared by the Company as of January 2025, in order to include therein information regarding the E5-35 sub-score and the “ESX-score,” as well as the logic and criteria applied to the calculation system, and the simultaneous transmission of said form to Messrs.

XX, XX, XX, XX, XX, and XX; b) revision of the policy titled “Procedures for Responding to Data Subjects (Consumer Service),” version 8.0 dated April 15, 2025, with specific reference to paragraphs 4.1 and 5.1 thereof, with a view to ensuring, for the reasons set forth in paragraph 4.2 of this decision, that the data subject is not required to submit multiple access requests to Experian Italia S.p.A. in order to obtain all information pertaining to the “ESX Score” processed in the context at hand. It is therefore necessary that the aforementioned policy provide that—following the submission of a request pursuant to Art. 15 of the Regulation aimed at learning “one’s credit score(s)” – the Company uses, as a first step and in its response pursuant to Art. 12 of the Regulation, the updated model referred to in point (a); c) the adoption of a procedure designed to ensure that the data subject can fully exercise the right to rectification, pursuant to Article 16 of the Regulation, in the event of the processing of inaccurate and/or incomplete data relating to the “ESX Score” assigned to the data subject.

This applies, in particular, when the aforementioned score is primarily based on the level of risk associated with the data subject, in relation to their residential address (the so-called Geodelphi indicator). All of this is to be considered in light of the fact that, even if the data subject is not listed in the SIC, an “ESX Score” is still generated based on the aforementioned indicator; d) the completion of modifications to the XML format to be transmitted to Major1 S.r.l., aimed at eliminating sub-scores not necessary for the calculation of the “CGS-X Score,” specifically, the D4U and DG3r indices (see supra, para 4.4 of this decision). Finally, it should be noted that the violations, as established in accordance with the terms set forth in the reasoning, cannot in any way be considered “minor” within the meaning of Recital 148 of the Regulation; this is in light of the multiple violations alleged and the number of data subjects involved, as well as the additional factors more fully explained in paragraph 6 of this decision. 6.

Injunction Order. The Data Protection Authority, pursuant to Article 58, para 2, subparagraph (i) of the Regulation and Article 166 of the Code, has the power to impose an administrative fine as provided for in Article 83 of the Regulation, by issuing an injunction order (Article 18. Law No. 689 of November 24, 1981), in relation to the processing of personal data carried out by Experian Italia S.p.A., which has been found to be unlawful, under the terms set forth herein. The violation of the provisions referred to above entails the application of the administrative fine provided for in Art. 83, para. 4, subpara. (a), and para. 5, subpara. (a) and (b), of the Regulation. Having determined that Art. 83(3) of the Regulation must be applied, which provides that “if, in relation to the same processing operation or to related processing operations, a controller […] infringes, intentionally or negligently, several provisions of this Regulation, the total amount of the administrative fine shall not exceed the amount specified for the most serious violation,” the total amount of the fine is calculated so as not to exceed the maximum penalty provided for in Art. 83(5) of the Regulation.

With regard to the factors listed in Article 83(2) of the Regulation for the purposes of applying the administrative fine and determining its amount—bearing in mind that the fine must be “effective, proportionate, and dissuasive in each individual case” (Article 83(1) of the Regulation), it is noted that, in the case at hand, the following circumstances were taken into account: - the significant severity of the violation (Article 83(2)(a) of the Regulation), in relation to its nature (concerning non-compliance with the provisions on transparency and data subject rights, as well as the principles of data minimisation, privacy by design, and privacy by default), the manner in which it occurred (the multiple instances of unlawful conduct repeated over time), and its duration (approximately two and a half years). Also considered relevant for this purpose are the characteristics and processing purposes, as well as the high number of data subjects involved and the nature of the harm they suffered.

All of this, given that: the operations in question were carried out to develop a risk profile regarding the data subjects’ reliability in terms of timely payments, an activity that falls within the data controller’s core business; the unlawful conduct affected 561 data subjects; the established violations contributed, in most cases, to the denial of the signing of the energy and/or gas supply contract, to the detriment of the data subjects; - the negligent nature of the conduct and the data controller’s significant instance of accountability regarding the technical and organizational measures implemented (Articles 83(2)(b) and (d) of the Regulation). All of this, with particular regard to the lack and inadequacy—in the specific context at hand—of the measures and processes implemented by the Company concerning compliance with obligations related to the exercise of data subject rights, as well as the principles of privacy by design and privacy by default.

With regard to the subjective element, the following circumstances are taken into account: with respect to the processing activities carried out by Experian Italia S.p.A. for the purpose of calculating the “ESX Score,” the company erroneously considered the provision of Article 22 of the Regulation to be inapplicable; - the fact that there are no previous violations committed by the controller or previous measures referred to in Article 58 of the Regulation concerning the same subject matter (Article 83(2)(e) and (i) of the Regulation). On this point, it should be noted that Decision No. 630 of October 23, 2025 (web doc. No. 10196194), adopted against Experian Italia S.p.A., was not taken into account for this purpose. This is because the preliminary investigation pertaining to this decision was conducted concurrently with the one that led to the adoption of the aforementioned measure; - the adoption by the data controller of measures to mitigate or eliminate the consequences of the violation (Articles 83(2)(c) and 83(para) of the Regulation).

In this regard, it should be viewed favorably that Experian Italia S.p.A., upon becoming aware of the violation, voluntarily adopted certain initial measures to mitigate the effects of the unlawful processing, even though these were only partially effective in reducing the risks; - the fact that the Company actively cooperated with the Authority during the proceedings (Article 83(2)(f) of the Regulation); - the nature of the information involved in the breach (Art. 83(2)(g) of the Regulation), which, although not classified as special categories of data, is nonetheless considered sensitive as it reflects the reliability of customers’ payment timeliness; this also taking into account the potential economic and social consequences that may arise for the data subjects as a result of the unlawful processing of their data; - other mitigating factors (Article 83(2)(k) of the Regulation), such as, first and foremost, the Company’s implementation of initiatives aimed at raising awareness of the right to personal data protection through its official website; with particular reference, given the specific case at hand, to the initiative implemented in June 2025 through the publication of a Frequently Asked Questions (FAQ) section dedicated exclusively to credit scoring (see above, para 3 of this decision).

Consideration was also given to Experian Italia S.p.A.’s adherence to the “Code of Conduct for Information Systems Managed by Private Entities Regarding Consumer Credit, Creditworthiness, and Timely Payments,” approved, pursuant to Art 41 of the Regulation, by a resolution of the Data Protection Authority dated October 6, 2022. It is further considered that, in the present case, the following factors are relevant in light of the aforementioned principles of effectiveness, proportionality, and deterrence to which the Authority must adhere when determining the amount of the penalty (Articles 83, para 1, of the Regulation): the economic circumstances of the offender, determined on the basis of the Company’s turnover as set forth in the financial statements as of March 31, 2025 (the most recent available). In light of the above elements and the assessments made, it is deemed appropriate, in this case, to impose on Experian Italia S.p.A. an administrative penalty consisting of the payment of a sum equal to 120,000.00 euros (one hundred twenty thousand/00).

In this context, it is also considered that, pursuant to Article 166(7) of the Code and Article 16(1) of the Data Protection Authority’s Regulation No. 1/2019, this section containing the injunction order must be published on the Data Protection Authority’s website. This is in light of the specific nature of the data subject to the processing at issue—as it pertains to the data subject’s creditworthiness—as well as the nature of the violations found, which affected the general principles of processing, in particular the principle of transparency and the obligations regarding the exercise of the data subject rights. Finally, it is considered that the conditions set forth in Article 17 of the Data Protection Authority’s Regulation No. 1/2019 are met. IN VIEW OF THE FOREGOING, THE DATA PROTECTION AUTHORITY - declares, pursuant to Article 57(1)(f) of the Regulation, that the processing carried out by Experian Italia S.p.A., with headquarters in Rome, VAT No. 06016221001, as set forth in the grounds of this decision, for violating Article 5(1)(a) and (c) and Articles 12, 15, and 25 of the Regulation; - orders, pursuant to Article 58(2)(c) and (d) of the Regulation, the aforementioned Company to comply, within six months from the date of notification of this decision, the requirements set forth in para 5 of this decision, while also requiring the Company to provide, within the aforementioned deadline, a properly documented response in accordance with Art 157 of the Code; failure to provide such a response may result in the imposition of the administrative fine provided for in Article 83, para 5, subparagraph e) of the Regulation; ORDERS pursuant to Article 58, para 2, subparagraph (i) of the Regulation, Experian Italia S.p.A. is ordered to pay the sum of 120,000.00 euros (one hundred twenty thousand/00) as an administrative fine for the violations indicated in this order; ORDERS pursuant to Article 58, para 2, subparagraph i) of the Regulation, that the same Company pay the aforementioned sum of 120,000.00 euros (one hundred twenty thousand/00), as an administrative fine for the violations set forth in this order, in accordance with the procedures outlined in the attachment, within thirty days of notification of this order, failing which enforcement measures will be taken pursuant to Art. 27 of Law No. 689/1981.

It is noted that, pursuant to Article 166, paragraph 8 of the Code, the offender retains the right to settle the dispute by paying an amount equal to half of the imposed penalty within the time limit set forth in Article 10, paragraph 3, of Legislative Decree No. 150 of September 1, 2011, set for filing the appeal as indicated below; ORDERS - pursuant to Article 166, paragraph 7, of the Code and Article 16, paragraph 1, of the Data Protection Authority’s Regulation No. 1/2019, the publication of the injunction order on the Data Protection Authority’s website; - pursuant to Article 154-bis, paragraph 3, of the Code and Article 37 of the Authority’s Regulation No. 1/2019, the publication of this order on the Authority’s website; - pursuant to Article 17 of the Authority’s Regulation No. 1/2019, the recording of the violations and the measures taken in accordance with Article 58, para 2 of the Regulation, in the Authority’s internal register provided for in Article 57, para 1, letter u) of the Regulation.

Pursuant to Article 78 of Regulation (EU) 2016/679, as well as Article 152 of the Code and Article 10 of Legislative Decree No. 150 of September 1, 2011, an appeal against this decision may be filed with the ordinary courts by submitting a petition to the ordinary court of the jurisdiction specified in the aforementioned Art 10, within thirty days from the date of notification of the decision, or within sixty days if the appellant resides abroad. Rome, July 3, 2026 THE CHAIRMAN Stanzione THE RAPPORTEUR Ghiglia THE SECRETARY GENERAL Montuori [Web Doc. No. 10273659] Decision of July 3, 2026 Register of Decisions No. 486 of July 3, 2026 THE DATA PROTECTION COMMISSIONER AT today’s meeting, attended by Prof. Pasquale Stanzione, Chair; Prof. Ginevra Cerrina Feroni, Vice Chair; Dr. Agostino Ghiglia, Member; and Dr. Luigi Montuori, Secretary General; HAVING REGARD TO Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016 (hereinafter the “Regulation”); HAVING REGARD TO Legislative Decree No. 196 of June 30, 2003 (Code on Data Protection, hereinafter the “Code”), as amended by Legislative Decree No. 101 of August 10, 2018, containing “Provisions for the alignment of national legislation with the provisions of Regulation (EU) 2016/679”; HAVING EXAMINED the documentation on file; HAVING CONSIDERED the observations made by the Secretary General pursuant to Art. 15 of the Data Protection Authority’s Regulation No. 1/2000; RAPPORTEUR: Dr. Agostino Ghiglia; WHEREAS 1.

Introduction. This Authority has received several requests concerning the processing of personal data carried out by Experian Italia S.p.A. (hereinafter also “the Company”) for the purpose of verifying the creditworthiness of potential customers of Hera Comm S.p.A. and EstEnergy S.p.A. Specifically, the complainants alleged that Hera Comm S.p.A. and EstEnergy S.p.A. refused to supply energy to them based on a risk profile of the data subjects that allegedly emerged following checks carried out by the aforementioned Companies, including through consultation of credit information systems (operated by Experian Italia S.p.A.) and the use of commercial information services (operated by Cerved Group S.p.A.). This risk profile is developed within the Hera Group using software provided by Major 1 S.r.l., called “CGS-X.” This software enables the aforementioned energy suppliers to develop a risk profile regarding the creditworthiness of potential customers, based on an integrated indicator called the “Integrated Utilities Score” (hereinafter also referred to as the “CGS-X Score”).

The latter is the result of combining two assessment indicators: one called the “ESX Score” (provided by Experian Italia S.p.A.) and the other called the “Retail Utilities Score” (provided by Cerved Group S.p.A.). In this regard, the petitioners pointed out that, although the denial of energy supply was the result of their being assigned a composite score indicating low creditworthiness—derived from a search of the databases managed by Cerved Group S.p.A. and Experian Italia S.p.A.— these companies, when specifically questioned on this point through requests for access pursuant to Art 15 of the Regulation, had stated that there was no negative information and/or adverse events within their systems concerning the aforementioned data subjects that would justify a negative assessment. With regard to the foregoing, it should be noted that the Authority, in light of the numerous requests received, first decided to consolidate the individual proceedings referred to above in order to conduct a comprehensive review of the underlying issues and subsequently initiated, on its own initiative, pursuant to Article 21 of the Data Protection Authority’s Regulation No. 1/2019, an investigation aimed at assessing, as a whole, the methods and processing purposes of the data processing carried out by Experian Italia S.p.A. in connection with the service provided by Major 1 S.r.l. and known as “CGS-X.”

In this context, several on-site inspections were conducted: at Hera S.p.A. on March 18, 19, and 20, 2024; at Major 1 S.r.l., on April 15 and 16, 2024; at Cerved Group S.p.A. on April 16, 2024; and at Experian Italia S.p.A. on June 13 and 14, 2024. Subsequently, given the particular complexity of the investigation and in order to gather further information regarding the processing of the aforementioned data, additional on-site inspections were conducted at Major 1 S.r.l., on October 15 and 16, 2024, and at Cerved Group S.p.A. on October 16, 2024. 2. The Preliminary Investigation. The preliminary investigation into Experian Italia S.p.A. took into account not only the findings of the aforementioned inspections but also additional information provided in the supplementary documentation submitted by the company on June 27, 2024, to address the reservations raised during the on-site inspections, as well as Experian Italia S.p.A.’s communication dated February 6, 2025, and the information contained in the letter dated April 18, 2025, which was received in response to the Authority’s request for information dated March 19, 2025.

In the course of the investigation, with regard to the issues highlighted in the introduction, the following findings emerged. 2.1. The results of the on-site inspections. The “CGS-X” software is distributed “under a contractual package that requires the customer [i.e., the energy supplier] to sign three separate contractual documents with Cerved Group S.p.A., Experian Italia S.p.A., and Major 1 S.r.l.” (see Major’s minutes of April 15, 2024, p. 3). Once enrolled in the service, the energy supplier enters the data of its potential customers into the CGS-X software, acting as an independent controller and, at the same time, designating Major 1 S.r.l. as the processor, pursuant to Art. 28 of the Regulation. The latter acts as a technology outsourcer, providing the license to use the “CGS-X” software and, in this context, in response to a query made by the energy supplier, consults the commercial information systems managed by Cerved Group S.p.A., as well as credit information systems managed by Experian Italia S.p.A.

According to the findings of the inspection at Major 1 S.r.l., “access to the information systems of Cerved and Experian is carried out by Major 1 S.r.l., in the name and on behalf of the client [energy supplier] (..) and constitutes a transfer of data between independent controllers (between Experian/Cerved and the client)” (see Major 1 S.r.l. report of April 15, 2024, p. 3). From an operational standpoint, “the operation of the aforementioned software requires that the client [energy supplier] perform a query (..) with a specific call based on the tax identification number [of the data subject]” (see minutes of Major 1 S.r.l. dated April 15, 2024, p. 2). The system “queries the information systems of Cerved and Experian for the same tax identification numbers,” retrieving the “Retail Utilities Score” from Cerved Group S.p.A. and the “ESX Score” from Experian Italia S.p.A., along with their respective sub-scores.

This information “is processed by Major 1’s software in order to obtain (..), in response to the aforementioned queries, (..) an integrated score (known as the CGS-X Score) relating to the assessment of the data subjects’ ‘reliability’; a score that is the result of combining (..) the scores obtained from the Experian databases (Credit Information System—SIC) and Cerved (commercial information)” (see Major 1 S.r.l. minutes of April 15, 2024, pp. 2–3). More specifically, with regard to the processing carried out by Experian Italia S.p.A. for the purpose of calculating the “ESX Score,” it was verified that the latter is calculated based on the following variables: - “Delphi for utilities (D4U)”: statistical model, [OMISSIS]” (see minutes of Experian Italia S.p.A. dated June 13, 2024, pp. 3–4); - “DG3r”: indicator “[OMISSIS]” (see Experian Italia S.p.A. report dated June 13, 2024, p. 3); - “CDI”: indicator “[OMISSIS]” (see minutes of Experian Italia S.p.A. dated June 13, 2024, p. 3); - “GeoDelphi”: statistical model “[OMISSIS],” which takes into account the place of residence listed in the data subject’s personal records [OMISSIS]” (see Experian Italia S.p.A. minutes of June 13, 2024, pp. 3–4).

1 S.r.l.] to the client Hera” (see minutes of Major 1 S.r.l., October 14, 2024, p. 3). On this point, a representative stated that, “it is likely that the XML schema was initially designed, in agreement with Cerved, to include the details of the aforementioned variables, and that only subsequently, the companies [Experian Italia S.p.A. and Cerved Group S.p.A.] agreed to limit the information necessary for calculating the CGS-X score (…). However, the XML schema was not modified accordingly and remained as initially planned” (see minutes of Experian Italia S.p.A. dated June 14, 2024, p. 2). 2.2. Requests regarding the exercise of rights submitted by data subjects to Experian Italia S.p.A. With specific regard to the responses contested by the complainants—provided by the Company pursuant to Articles 12 and 15 of the Regulation—it emerged that Experian Italia S.p.A. limited itself to sending the applicants an informational report containing only the personal data present in the SICs.

More specifically, in the communications sent to the data subjects, in some cases, information was provided regarding the existence of a loan application in the approval process (see response of September 30, 2022, sent to Mr. XX; in others, reference was instead made to certain outstanding credit accounts in good standing and to additional credit accounts that had already been duly closed (see response dated September 29, 2023, provided to Mr. XX); in still other cases, it was confirmed that no information regarding the data subject was recorded in the SIC (see response dated October 10, 2022, provided to Mr. XX; notification dated April 4, 2024, sent to Mr. XX; response dated May 31, 2024, provided to Mr. XX). It also emerged that, in none of the cases subject to the complaint, did the response provided by the Company contain explicit references to the “ESX Score” and the related sub-scores assigned to the data subjects.

All of this, although it was found that Experian Italia S.p.A. provided the aforementioned scores and sub-scores—referring to the latter—in response to inquiries made by Major 1 S.r.l. in connection with the provision of the “GCS-X” software (see, in this regard, the records obtained from Major 1 S.r.l. during the inspection on October 15, 2024; see, in particular, Annex 8 of the Major 1 S.r.l. report dated April 16, 2024; see also Annexes 3, 4, and 5 of the Major 1 S.r.l. report dated October 15, 2024). It was also established that “even when [the data subject in question] was not present in the SIC (..), a score was [nevertheless] assigned [to him].” On this point, it has in fact emerged that the aforementioned score is “generated based on the GeoDelphi indicator,” which is the “result of a statistical model, [OMISSIS], based exclusively on the data subject’s residential address.” For these reasons, even when the data subject is not present in the SIC, an “ESX Score” is still generated for that individual (see the statement by Experian Italia S.p.A. dated June 14, 2024, p. 3).

With regard to the explanations provided by Experian Italia S.p.A. concerning the content of the responses given to the data subjects who filed complaints in the case at hand, the company’s representative stated that, “unless the [aforementioned] requests contain an explicit reference to the scores, the company considers [such requests] to have been adequately addressed by providing only the data regarding the data subject’s status in the SIC, taking into account the data subjects’ need to know their credit status. For this reason, in the response provided to the complainants, the company confirmed only whether or not the individual’s records were present in the SIC and, if present, the data contained therein” (see Experian Italia S.p.A.’s report dated June 14, 2024, p. 3). It should also be noted that, following the inspections conducted at the Company, and with specific reference to the request submitted by Ms. XX pursuant to Article 15 of the Regulation (in this case, on September 10, 2024), Experian Italia S.p.A. responded on September 20, 2024, “clarifying the logic behind the score’s operation and communicating the corresponding value calculated following the query by Hera Comm S.p.A.

(..). In that same response, the Company indicated its willingness to provide, upon request by the data subject, a further level of detail regarding the processed information, in accordance with the fundamental principles of transparency and fairness” (see note from Experian Italia S.p.A. dated April 18, 2025, pp. 3–4 and Annex 2.). All of this is because “the Company has initiated a structured process to strengthen its internal procedures regarding the management of data subject rights, with the aim of consolidating an increasingly transparent and clear approach, in line with the changing needs of data subjects and with the principles of the Regulation itself. In this context, effective June 27, 2024, (..) it has adopted a new model for responding to requests for access pursuant to Article 15 of the Regulation, aimed at providing data subjects with more detailed and intelligible information, with particular attention to the variables considered by the model and to the score returned following the query to the relevant entity” (see note from Experian Italia S.p.A. dated April 18, 2025, p. 3).

The aforementioned new approach “has also been incorporated into the internal documentation titled ‘Procedures for Responding to Data Subjects’” —updated in April 2025— “which was the subject, among other things, of a specific training session for Experian’s customer service staff” (see note from Experian Italia S.p.A. dated April 18, 2025, p. 3). With regard to response templates, the Company “beginning in January 2025, further refined the text used to respond to access requests, with the aim of providing an even clearer, more concise, and more understandable level of detail” (see note from Experian Italia S.p.A. dated April 18, 2025, p. 3). Furthermore, “the response provided in reply to an access request may, at the data subject’s request, be further supplemented with more detailed information, in accordance with the provisions of [Section 5.1] in the updated procedure” (see note from Experian Italia S.p.A. dated April 18, 2025, p. 4 and Attachments Nos. 2, 3, 4, and 5).

With regard to the new form, an examination of the documentation on file (see Attachments Nos. 3 and 5 to the notice from Experian Italia S.p.A. dated April 18, 2025) revealed that the data controller, in response to the request submitted by Ms. XX, provided, on July 8, 2024, a response that is incomplete, as it lacks the E5-35 sub-score, despite the presence in the SIC of credit information pertaining to the data subject ([OMISSIS]); likewise, the response sent to Mr. XX on January 17, 2025, based on the updated template, does not contain a reference to the “ESX-score” value, reporting only the value corresponding to the “ESX-index.” Finally, it was verified that the Company, during the period from January 2022 to June 2024, received 561 requests to exercise rights, submitted by potential customers of Hera Comm S.p.A. and/or EstEnergy S.p.A. and pertaining to the specific matter under review (see note from Experian Italia S.p.A. dated April 18, 2025, p. 4).

Finally, regarding storage periods, the Company stated that, as of the date of the investigation, it “stored the XML record of the query and the corresponding response on its on-premises systems for 8 months”; this despite the fact that the Data Storage Policy adopted by Experian Italia S.p.A. was “originally set at 12 months.” In August 2023, [in fact], due to disk space running out on the company’s systems, [it was] decided to reduce this period to 8 months, while also initiating the necessary assessments to identify a timeframe appropriate for this processing activity” (see minutes of Experian Italia S.p.A., dated June 14, 2024, p. 2). Furthermore, it was stated in a note dated April 18, 2025, that the Company has adopted “a specific data retention policy, called the Record Retention Schedule, which governs the storage periods applicable to personal data processed and stored by the Company, with reference to the various types of processing” (see letter from Experian Italia S.p.A. dated April 18, 2025, pp. 4–5).

Within this policy, the storage period for “XML logs of conversations with Major1” was again set at twelve months. The “purpose of this storage is to facilitate the exercise of data subjects’ rights by streamlining the handling of any requests or complaints—including those received at a later date and those originating from our client organizations” (see note from Experian Italia S.p.A. dated April 18, 2025, p. 5). 3. The notification pursuant to Article 166, paragraph 5, of the Code. Following the allegation of violations under Articles 5(1)(a), 12, and 15 of the Regulation, sent to Experian Italia S.p.A. in a communication dated July 16, 2025, the Company, by letter dated September 15, 2025, submitted its defense briefs, which were further supplemented during the hearing on May 21, 2026, and by a subsequent communication dated May 29, 2026. In the context of the aforementioned briefs, Experian Italia S.p.A. made the following representations: a) regarding the allegation concerning the inadequacy of the information provided to data subjects, in that it lacked details regarding the “ESX Score,” the additional sub-scores, as well as the logic and criteria applied to the calculation system, the responses provided by the data controller followed a “layered disclosure” approach.

This approach was “justified [by the receipt of] a large number (..) of requests that require [Experian Italia S.p.A.] to implement and apply a response procedure structured across multiple levels of response and that provides, at least at the first level, the use of standardized response templates.” Based on this approach, the Company, in order to avoid “a technical overload that would have compromised the purpose of transparency pursued by the Regulation,” therefore provided data subjects, as a first step, with “access to the personal data contained in the SIC”. In this way, they were “enabled (..) to request any further details.” As of June 2024, Experian Italia S.p.A. It then introduced an updated version of the feedback form, which was further refined in January 2025; this was done in order to “combine informational completeness and clarity” in the information provided therein (see the Company’s note dated September 15, 2025, pp. 4, 9, and 10); b) regarding the application of Article 22 of the Regulation to the case at hand, “the indicators made available by Experian” through the “ESX Score” do not significantly influence the decision regarding the customer’s supply contract, as they are independent “statistical variables intended to be combined with other variables and synthesized into a further index (the CGS-X)”; an index “which, in turn, serves solely to support the analysis and determinations [carried out downstream by the energy supplier], which remain the exclusive accountability” of the latter (see the Company’s note of September 15, 2025, p. 5: see also the minutes of the hearing of May 21, 2026, p. 2); c) regarding the objection concerning the storage of XML files for a period of eight months, this was determined “by contingent technical requirements and did not compromise the effective exercise of the data subjects’ rights.”

On this point, the Company noted that “virtually all requests by data subjects to exercise their data subject rights are received by Experian within six months of Experian’s communication of the score to the Energy Supplier.” The temporary measure of reducing the storage period to 8 months therefore did not “in fact cause any harm to the data subjects.” Furthermore, as of March 31, 2025, the Company has, in any case, “realigned the retention period to twelve months, in line with the Record Retention Schedule” (see the Company’s note dated September 15, 2025, pp. 4 and 16); d) with regard to the alleged violation of Art. 25 of the Regulation for having transmitted to Major1 S.r.l., in the XML files, certain sub-scores not necessary for the calculation of the “CGS-X Score” (in this case, the D4U and DG3r indices), the inclusion of these “did not have any adverse effects on the data subjects concerned.”

In any case, the Company, as part of discussions with Cerved Group S.p.A., has initiated a process to “streamline the XML schema dedicated to the utilities sector, in order to limit the information content transmitted to Major 1 S.r.l., to the variables relevant to the CGS-X for that sector, and to the subsequent update of the XML response schemas to modify the aforementioned schema” (see supplementary note of May 29, 2026, p. 2). This was done in order to “overcome the critical issues and strengthen compliance controls in line with the principles of privacy by design and by default” (see the Company’s note dated September 15, 2025, pp. 4, 16, 17, and 19); e) with regard to the subjective element of the violation, “in the present case, the existence of intent or negligence on the part of Experian should be ruled out.” All of this, in recital, was carried out in accordance with the interpretation of Articles 22 and 15 at the time of the events, para 1, subparagraph h), of the Regulation, as derived from the application of the “Code of Conduct for Information Systems Managed by Private Entities Regarding Consumer Credit, Creditworthiness, and Timeliness of Payments.”

The latter “constituted [at that time] the primary sector-specific reference available regarding the interpretation and application of the rules established by the Regulation in the specific sector of credit scoring.” In this regard, the Company argued that article 10, paragraph 1, of the aforementioned Code of Conduct imposes “on the participant—and not on the operator—the obligation to provide an explanation of the scoring logic.” The Company also pointed out that the judgement of the Court of Justice of February 27, 2025, C-203/22, “was issued after the period during which Experian allegedly engaged in the conduct at issue” (see minutes of the hearing of May 21, 2026, pp. 2 and 3); f) regarding the number of customers affected by the violation, this figure does not correspond to the 561 data subjects who submitted requests to Experian between January 2022 and June 2024, as indicated in the notice pursuant to Art. 166, paragraph 5 of the Code, but must be attributed exclusively to the six individuals whose complaints formed the basis of the proceedings (see minutes of the hearing of May 21, 2026, pp. 3 and 4).

The Company also emphasized the significant efforts it has made, following the initiation of the proceedings by the Data Protection Authority, to further align its activities with the regulations governing data protection. In this regard, in June 2025, Experian Italia S.p.A. “published a Frequently Asked Questions (FAQ) section dedicated to credit scoring,” in which the “technical aspects of credit scoring were explained in detail using language that is accessible and understandable even to a non-specialist audience” (see the Company’s statement of September 15, 2025, pp. 7, 19). More generally, the Company reiterated that it had already adopted, following the inspection findings, a series of measures to protect data subjects, such as: “updating the response templates (June 2024 and January 2025), realigning the retention period to twelve months (March 2025), revising the XML schemas, implementing internal quality control procedures, [as well as] measures that further increase transparency toward data subjects (..)

(June 5, 2025)” (see the Company’s note dated September 15, 2025, p. 20). Finally, it stated that it had promoted and adhered to the “Code of Conduct for Information Systems Managed by Private Entities Regarding Consumer Credit, Reliability, and Timeliness of Payments,” approved by resolution of the Data Protection Authority on October 6, 2022, and that it had actively participated, in 2024, “in various initiatives aimed at updating the [aforementioned] Code” (see the Company’s note dated September 15, 2025, p. 21). 4. The Authority’s Assessments. First of all, it is noted that, unless the act constitutes a more serious offense, anyone who, in proceedings before the Data Protection Authority, falsely declares or attests to facts or circumstances, or produces false documents or records, is liable pursuant to Art. 168 of the Code, “False Statements to the Data Protection Authority and Interruption of the Performance of the Data Protection Authority’s Duties or the Exercise of Its Powers.”

In light of the evidence gathered during the preliminary investigation described above, it has been established that Experian Italia S.p.A. provided inadequate and incomplete responses to the requests submitted by data subjects to exercise their rights under Articles 15–22 of the Regulation. This pertains specifically to the processing of personal data carried out by Experian Italia S.p.A. for the purpose of providing the “CGS-X” service. In this context, it also violated Article 5(1)(c) and Article 25 of the Regulation, as explained in greater detail below. Having duly set this out, it should be noted at the outset that, for the purposes of addressing the issues covered by this decision, it is necessary to take into account the specific context underlying the processing activities carried out in the cases at hand. 4.1. The processing of personal data within the framework of credit information systems and Judgement C-634/21 of the Court of Justice of the European Union dated December 7, 2023.

In its judgement of December 7, 2023, in Case No. C-634/21, the Court of Justice of the European Union (hereinafter “the Court”) ruled on the interpretation of Article 22 of the Regulation with regard to the processing of personal data carried out within the framework of credit information systems. In that judgment, the Court clarified that the applicability of the aforementioned provision is subject to the fulfillment of three cumulative conditions relating to the existence of a “decision,” that such a decision is “based solely on automated processing, including profiling,” and that it produces “legal effects [concerning the data subject]” or “significantly affects him or her in a similar manner” (see para. 43, CJEU Judgement, C-634/21, cited above). The Court noted in particular that the concept of “decision,” within the meaning of Article 22(1) of the Regulation, may include various acts, including those which, although they do not have direct legal effects on the data subject, nevertheless have a similar and significant impact on the data subject (see, to that effect, also Recital 71 of the Regulation).

That concept, therefore, is “broad enough to encompass the result of calculating a person’s creditworthiness in the form of a probability ratio relating to that person’s ability to meet future payment obligations.” This applies even where the result—as is the case here—is produced by a company that provides third parties with information regarding the creditworthiness of the data subjects (see para. 46, CJEU judgement, C-634/21, cited above). With regard to the additional conditions set forth in Art. 22 of the Regulation, the Court found that they were met in the specific context at hand. The ruling clarified, first of all, that the aforementioned decision is based exclusively on an automated calculation derived from the processing of the data subject’s personal data concerning the data subject’s reliability in terms of timely payments. Second, it held that the result of that calculation, in the form of a probability rate, significantly affects the individual, preventing them from accessing the requested service—such as the energy supply at issue in the present case.

On this point, the Court itself has in fact clarified that, in the aforementioned context, “the action of the third party to whom the probability rate is transmitted is guided ‘decisively’ by that rate” (see para. 48, CJEU judgement, C-634/21, cited above), as has emerged during the present proceedings with respect to the decisions made by Hera Comm S.p.A. and EstEnergy S.p.A. This interpretation is consistent with the rationale underlying Article 22 of the Regulation, which aims to ensure the protection of individuals’ fundamental rights and freedoms against the specific risks arising from the automated processing of personal data, including profiling (see para. 51, CJEU Judgement, C-634/21, cited). Moreover, a restrictive interpretation of the aforementioned provision would undermine the safeguards for data subjects provided for in the Regulation, since such data subjects would be unable to assert, against companies that provide information regarding the creditworthiness of data subjects, their right of access to data concerning them, as established by Art 15(1)(h) of the Regulation (see paragraphs 61–63, CJEU Judgement, C-634/21, cited above).

In conclusion, according to the Court, “Article 22(1) of the Regulation must be interpreted as meaning that the automated calculation, (...) of a probability score based on personal data relating to a person and concerning that person’s ability to meet future payment obligations constitutes an ‘automated individual decision-making process’ within the meaning of that provision, where the conclusion, performance, or termination of a contractual relationship with that person by a third party to whom that probability rate is communicated” (see para. 73, CJEU Judgement, C-634/21, cit.). It follows, therefore, that—contrary to the Company’s contention (see supra, para. 3(b) of this decision)—the processing operations carried out by Experian Italia S.p.A. in the cases at issue in this decision fall within the scope of the scenario outlined in the aforementioned judgement and, therefore, Articles 15(1)(h) and 22 of the Regulation apply to them, as explained in greater detail below (see paragraphs 4.2 and 4.3 of this decision).

Finally, it should be noted that the proceedings in question concerned solely the measures adopted by Experian Italia S.p.A. to ensure proper compliance with the obligations set forth in Article 15 et seq. of the Regulation regarding the exercise of rights; all of this in light of the specific instances of non-compliance that emerged during the investigation initiated by the Authority following the submission of the requests indicated in the preamble. With regard, however, to the broader issue concerning the conditions for lawfulness, pursuant to Art. 22(2) of the Regulation, of the processing of the data subject’s personal data by credit information system operators, as well as the safeguards that the controller is required to implement, pursuant to Article 22, paragraphs 3 and 4 of the Regulation, the Authority reserves the right to take any appropriate action necessary to verify the existence of the aforementioned conditions (see, on this subject, also the Authority’s statement of September 11, 2025, during the hearing of the President of the Data Protection Authority regarding “Draft Law AS 1578 on the Annual Market and Competition Law for 2025,” web doc.

No. 10166076). 4.2. Violations concerning the exercise of the right of access under Article 15 of the Regulation. First and foremost, following the preliminary investigation, it became apparent that the responses provided by Experian Italia S.p.A. to requests by data subjects to exercise their rights under Articles 15–22 of the Regulation—aimed at obtaining information regarding the “ESX Score”—were inadequate. Based on the evidence gathered during the preliminary investigation as well as subsequent assessments conducted by this Department, it has been established that Experian Italia S.p.A. provided, in response to requests to exercise rights under Articles 15–22 of the Regulation submitted by data subjects, inadequate and incomplete responses. In these responses, the Company limited itself to confirming the presence (or absence) of the data subjects’ records in the SIC and, if present, to communicating the personal data stored therein; without, however, providing any information regarding the score associated with the creditworthiness profile developed by the Company and made available to energy suppliers, nor regarding the criteria on which that profile was based.

Similarly, in these responses, the data subjects were not provided with information regarding the logic used to develop the aforementioned profile. In this regard, the Company represented that it had limited itself to providing the applicants with information concerning their status within the SIC, “since the [relevant] requests [pursuant to Article 15 of the GDPR] did not contain an explicit reference to the scores” (see minutes of Experian Italia S.p.A., dated June 14, 2024, p. 3). However, an examination of the documentation in the case file revealed that several of the requests under review, filed against Experian Italia S.p.A., contained an explicit reference to the fact that the refusal to supply energy by Hera Comm S.p.A. and/or EstEnergy S.p.A., was due to the assignment of a negative credit rating to them (see, in particular, the petitions: by Mr. XX, dated August 3, 2022; from Mr. XX, dated April 2, 2024; and from Mr. XX, dated September 18, 2023).

All of this, even though the information in question was—as ascertained during on-site inspections—still present in the controller’s systems as of the date of receipt of the aforementioned requests (see supra, para. 2.2. of this decision). On this point, it is worth noting that the right of access under Article 15 of the Regulation is primarily conceived as a tool designed to allow, in general, the data subject to exercise “control” over the personal data concerning him or her, ensuring that the data subject is fully aware of the information being processed and the actual methods of such processing; in accordance with the general provisions of the principle of lawfulness, fairness, and transparency (Art. 5(1)(a) of the Regulation). The purpose of the right of access is therefore primarily to disclose “what” data and “how” it has been processed by the controller in order to provide the data subject with the means to “know and verify the lawfulness and accuracy of the processing” concerning them (see Recital 63 of the Regulation; European Data Protection Board, “Guideline 1/2022 on the Rights of Data Subjects—Right of Access,” adopted on March 28, 2023, paragraphs 10–13).

Pursuant to Article 15 of the Regulation, therefore, the data controller, when responding to a request for access, may not limit itself to providing “a general description of the data [or] a mere reference to the categories of data processed,” nor may it omit information in its possession that relates to the data subject; on the contrary, the data controller is required to provide access to “all the information referred to in Article 15” pertaining to the data subject and actually subject to processing. Such information “must be complete, accurate, and up-to-date, corresponding as far as possible to the status of the data processing at the time the request was received” and must be provided “in a concise, transparent, intelligible, and easily accessible form” to the data subject (see European Data Protection Board, “Guidelines 1/2022 on the Rights of Data Subjects—Right of Access,” op. cit., para. 34; Art 12(1) of the Regulation).

On this point, reference is also made to the provisions of the “Code of Conduct for Information Systems Managed by Private Entities Regarding Consumer Credit, Creditworthiness, and Timely Payments,” approved by resolution of the Data Protection Authority on October 6, 2022, which sets forth specific obligations for the operator of an SIC aimed at ensuring a prompt and timely response by the operator to requests submitted by data subjects to exercise their rights (see Art. 9). In this regard, the Company’s interpretation of Article 10, paragraph 1, of the Regulation—according to which “the participant—and not the operator——the obligation to provide an explanation of the scoring logic” pertaining to the data contained in a SIC, where such data is processed through automated decision-making processes (see para 3(e) of this decision). On this point, it should be clarified that the aforementioned provision, while recognizing the data subject’s specific right to contact the participant under the terms set forth above (see, in particular, Art. 10, paragraph 1, subparagraph d) of the Code of Conduct), does not exempt Experian Italia S.p.A. from fulfilling the obligations of the controller regarding the exercise of data subjects’ rights, pursuant to Articles 12 and 15 of the Regulation.

Furthermore, the Company’s argument regarding its adoption of a “layered approach” aimed at avoiding an overload of information in the responses provided to data subjects’ requests under Art. 15 of the Regulation (see paragraph 3(a) of this decision). This is because “the use [of such an approach] is not considered appropriate (...) in all situations.” Indeed, such an approach may be justified “only if the controller processes a large amount of personal data concerning the data subject making the request, and when the data subject has obvious difficulty in grasping or understanding the information if it is provided all at once” (see European Data Protection Board, “Guideline 1/2022 on the Rights of Data Subjects—Right of Access,” op. cit., para. 147). Similarly, the layered approach “must be used in such a way as not to restrict the right of access” or “impose an additional burden on the data subject.”

It follows that “the controller must be able to demonstrate that the use [of the aforementioned approach] offers added value to the data subject, in that it helps the data subject understand the information provided” (see European Data Protection Board, “Guideline 1/2022 on the Rights of Data Subjects—Right of Access,” op. cit., paragraphs 143 and 147). Conversely, in the cases under consideration, the conditions set forth above are not met. This is because, although the data controller has received a significant number of requests pursuant to Article 15 of the Regulation, for the purposes of applying this approach, what is relevant is rather the “large amount” of personal information processed by the data controller in relation to the individual data subject. In fact, this circumstance does not apply to the requests made by the petitioners, which were specifically aimed at obtaining only the personal information on the basis of which the supply of energy was denied.

Furthermore, the response procedures adopted by the data controller in the case at hand effectively limited the right of access exercised by the data subjects, providing them with no added value. All of this is particularly relevant given that the responses provided by Experian Italia S.p.A. did not include information regarding the “ESX Score,” the additional sub-scores, or the logic and criteria applied to the calculation system. It should also be noted that the specific context underlying the requests to exercise the right of access submitted by the data subjects requires particular attention on the part of the controller, including with regard to the obligation to provide “meaningful information on the logic used, as well as [on] the significance and [the] expected consequences of such processing for the data subject” (Article 15(1)(h) of the Regulation). With regard to the aforementioned provision, the Court of Justice of the European Union has recently provided useful practical guidance—both substantively, regarding the type of information that the data subject may require from the controller, and formally, regarding the manner in which such information must be provided by the controller (see CJEU judgement of February 27, 2025, C-203/22).

In particular, with regard to the phrase “meaningful information on the logic used,” the Court confirmed that this refers to “any relevant information concerning the procedure and principles for the automated processing of personal data in order to achieve a specific result” (see para. 58, CJEU decision No. C-203/22, cited above). It follows, therefore, that the data subjects, in the case at hand, have the right to be fully informed of all the elements comprising the assessment of their creditworthiness, including those taken into account by the data controller for the purpose of assigning the score, as well as the calculation criteria used for that purpose (see, in this regard, Order of the Court of Cassation, Section I, No. 14381, dated May 25, 2021). With regard to the manner in which the aforementioned information must be provided, the Court of Justice of the European Union has reaffirmed the data controller’s obligation to provide it “in a concise, transparent, intelligible, and easily accessible form, using plain and clear language”; all in compliance with the principle of transparency set forth in Articles 5(1)(a) and 12(1) of the Regulation.

Therefore, “neither the mere communication of a complex mathematical formula, such as an algorithm, nor a detailed description of all the stages of automated decision-making can satisfy these requirements, as neither of these methods would constitute a sufficiently concise and understandable explanation” (paragraphs 58–59, CJEU Decision No. C-203/22, cited above). Overall, the requirement to provide “meaningful information on the logic used,” pursuant to Article 15(1)(h) of the Regulation, thus amounts to an obligation on the part of the controller to “describe the procedure and the principles actually applied in such a way that the data subject can understand which of [his or her] personal data have been used and in what manner (…), without the complexity of the operations to be carried out in the context of the automated decision-making process exempting the controller from its duty to explain” (para. 61, CJEU Decision No. C-203/22, cited above).

In light of the foregoing, it follows that Experian Italia S.p.A., in the cases at issue, acted in violation of Articles 5(1)(a), para 1, 12, and 15 of the Regulation, as a result of which Hera Comm S.p.A. and/or EstEnergy S.p.A. subsequently denied the data subjects the activation of the relevant energy supply. Finally, the Company’s arguments regarding the fact that the aforementioned violation cannot be established because it occurred prior to the issuance of the aforementioned Decision No. C-203/22 (see para 3, subparagraph e) of this decision) cannot be accepted. That decision, in fact, provides interpretive clarifications regarding regulatory obligations (Articles 12 and 15(1)(h) of the Regulation) that were, in any case, fully in force at the time the conduct in question occurred. On this point, it is worth noting, however, that the responses provided by Experian Italia S.p.A. to the data subjects, in the case at hand, contained no indication regarding the “ESX Score” or any additional sub-scores.

Furthermore, they contained no reference to the “logic used” underlying the calculation of the credit risk profile. 4.3. The response template pursuant to Article 15 of the Regulation prepared following the Data Protection Authority’s investigation and other instances of non-compliance. It is worth noting that the aforementioned violations persist even with regard to the new feedback forms that Experian Italia S.p.A. has prepared, effective June 27, 2024 (see above, para. 2.2), in order to provide data subjects with more information, including regarding “the variables considered by the model and the score” assigned to them (see the Company’s note of April 18, 2025, p. 3). In particular, the preliminary investigation revealed that the Company, based on the updated models, provided Ms. XX on July 8, 2024, in response to her request, a response that is incomplete because it lacks the “E5-35” sub-score, despite the presence in the SIC of credit information pertaining to the data subject ([OMISSIS]); likewise, the response sent to Mr. XX on January 17, 2025, does not contain a reference to the “ESX-score” value, reporting only the value corresponding to the “ESX-index” (see Attachments Nos. 3 and 5 to the letter from Experian Italia S.p.A. dated April 18, 2025).

It follows from this that even the use of the new model, adopted by Experian Italia S.p.A. in June 2024 (and subsequently updated in January 2025), is capable of ensuring that the data subjects’ right of access, as provided for in Articles 12 and 15 of the Regulation, is effectively fulfilled with respect to the specific processing operations in question. The inadequacy of the responses provided by the Company as a whole has therefore effectively prevented the aforementioned data subjects from accessing the types of personal data actually used to process the relevant risk profile and from understanding the actual methods of using such information. Consequently, this prevented them from verifying the lawfulness and fairness of the processing, as well as the accuracy of the data used in the context in question, thereby compromising their ability to exercise, where applicable, the right to rectification in the event of inaccurate and/or incomplete data (see Art. 16 of the Regulation), and, at the same time, the right to “obtain human intervention from the controller, [to] express their opinion and contest the decision” taken against them by the controller (see Art. 22(3) of the Regulation).

This risk arises, in particular, in cases where, as found during the preliminary investigation, “even though [the data subject] was not listed in the SIC (..), an ESX Score was [nevertheless] assigned [to him]” associated with a level of unreliability, based exclusively on the data subject’s residential address (see paragraph 2.2 of this decision). All of this—given the particularly sensitive nature of the information processed by Experian Italia S.p.A. in the case at hand, as it pertains to customer creditworthiness—could have detrimental consequences on the fundamental rights and freedoms of the data subjects (such as, for example, as occurred in the cases in question, the refusal to sign an energy supply contract). The aforementioned unlawful conduct—during the period from January 1, 2022, to June 14, 2024—affected approximately 561 data subjects (see Experian Italia S.p.A.’s note dated April 18, 2025, p. 4).

In this regard, in fact, the Company’s argument that the relevant figure in the case at hand is not 561 but rather only the number of the six individuals whose complaints formed the basis of the proceedings cannot be accepted (see, supra, para. 3, subparagraph (f) of this decision). On this point, it should be noted that, contrary to the Company’s assertion (see minutes of the hearing of May 21, 2026), the scope of the proceedings in question cannot be limited exclusively to the cases of data subjects who filed reports and/or complaints with the Authority. This is because the Data Protection Authority, in the exercise of its supervisory duties—and given the large number of requests received by the Authority over time—has determined it necessary to initiate, pursuant to Article 21 of the Data Protection Authority’s Regulation No. 1/2019—a broader investigation aimed at assessing, as a whole, the methods and processing purposes generally carried out by Experian Italia S.p.A. in connection with the service provided by Major 1 S.r.l. and known as “CGS-X.”

It should also be noted that the Company’s assertions on this point have not been substantiated in any way by Experian Italia S.p.A. through the submission of appropriate supporting documentation. In order to determine the number of data subjects involved in these proceedings, therefore, only the Company’s express statement in its note dated April 18, 2025, regarding the figure of 561 data subjects is relevant (see p. 4; see also, in this regard, the minutes of the hearing held on May 21, 2026, pp. 3 and 4). Finally, with specific regard to the violation of Article 12 of the Regulation concerning eight months of XML log storage, as alleged in the Authority’s notice of July 16, 2025, it is considered that the conditions for adopting measures pursuant to Article 58 of the Regulation do not exist. Therefore, limited to this specific aspect, the request made by Experian Italia S.p.A. to dismiss the allegation regarding this specific instance of violation is granted (see para 3, subparagraph c) of this decision). 4.4.

The violation of the principles of privacy by design and privacy by default. During the proceedings, it emerged that Experian Italia S.p.A., in response to inquiries made by Major 1 S.r.l. through the “CGS-X,” transmits to Major 1 S.r.l. an XML file containing a wide range of information, as described in paragraph 2.1 of this decision. In particular, it was verified that the aforementioned file contains certain sub-scores—specifically, D4U and Dg3r—that are not necessary for calculating the “CGS-X Score.” In this regard, Major 1 S.r.l. has expressly stated that it does not use these sub-scores in the provision of the aforementioned service (see Major 1 S.r.l.’s statement of October 14, 2024, p. 3). More specifically, on this point, it should be noted that Experian Italia S.p.A., for the purpose of transmitting to Major 1 S.r.l. the information necessary to calculate the “CGS-X Score,” did not develop a custom XML schema for the sector relevant to the cases in question, but merely used the one originally designed for the banking sector alone; this schema, as such, contains data (in this case, the D4U and Dg3r sub-scores) that are not necessary for calculating the “CGS-X Score” pertaining instead to the specific utilities sector (see Major 1 S.r.l.’s minutes of October 14, 2024, p. 3).

Furthermore, although the Company subsequently agreed with Cerved Group S.p.A. “to limit the information necessary for calculating the CGS-X score for utilities” (see Annex 1 to the minutes of Experian Italia S.p.A. dated June 14, 2024), it did not subsequently modify the XML schema “accordingly, and [the latter therefore] remained as initially envisaged” (see the minutes of Experian Italia S.p.A. dated June 14, 2024, p. 2). Experian Italia S.p.A., therefore, on the one hand, in the context of identifying the procedures defining the methods for transmitting the data necessary for processing the “CGS-X Score” for utilities, failed to implement adequate technical and organizational measures aimed at effectively implementing the data protection principles set forth in Art 5 of the Regulation, nor to incorporate into the processing the necessary safeguards to meet the requirements of the Regulation; on the other hand, when designing the system in question, it failed to implement options and default settings to ensure that, by default, only the personal data necessary for the specific purpose of the processing in question were processed in accordance with the principle of data minimization set forth in Art. 5(1)(c) of the Regulation, only the personal data necessary for the specific processing purpose in question.

It should be noted that the data controller, pursuant to Article 25 of the Regulation, is obligated—from the planning stage of the processing and continuously throughout the processing—to establish appropriate measures and necessary safeguards that enable the effective implementation of the principles of data protection by design and by default, and to regularly verify the effectiveness of the measures and safeguards thus identified. It follows, therefore, that “by default, the controller must not collect more data than is necessary [and at the same time] must not process the data collected beyond what is necessary for its purpose”; furthermore, “once processing has begun, (..) the controller is required to maintain [privacy by design and by default] on an ongoing basis,” through “periodic assessments and reviews of the effectiveness of the measures and safeguards it has chosen” (see European Data Protection Board, “Guidelines 4/2019 on Article 25: Data Protection by Design and by Default,” adopted on October 20, 2020, paragraphs 37 and 42).

Experian Italia S.p.A., with regard to the processing at issue, therefore used an XML template designed for the provision of a service intended for a sector other than utilities, thereby engaging in conduct contrary to Article 25 of the Regulation. The use of the aforementioned template also effectively resulted, as extensively explained above, in the transmission to Major 1 S.r.l. of information that exceeded the specific purpose pursued; all of which also constitutes a violation of the principle of data minimization set forth in Art. 5(1)(c) of the Regulation. Finally, with regard to the comments submitted by the Company (see para 3(d) of this decision), it should be noted that, for the purposes of assessing the conduct of Experian Italia S.p.A. with respect to the application of Art. 25 of the Regulation—contrary to what the latter has argued—it is irrelevant whether or not the data subjects in this case suffered any harm.

Indeed, the core purpose of the aforementioned provision is precisely to ensure adequate and effective data protection by design and by default. This means, therefore, that data controllers must be able to demonstrate that they have adopted, from the outset, adequate measures and safeguards to ensure compliance with data protection principles and that the effectiveness of such measures is regularly verified; however, these conditions were not met in the case at hand. 5. Conclusions: Declaration that the processing is unlawful. Corrective measures pursuant to Art. 58(2) of the Regulation. In light of the overall findings, the Authority considers that the statements, documentation, and explanations provided by the controller during the investigation do not sufficiently address the objections notified by the Office in thenotice of initiation of proceedings and are therefore insufficient to warrant the dismissal of this proceeding; moreover, none of the cases provided for in Art. 11 of the Data Protection Authority’s Regulation No. 1/2019 apply.

The processing of personal data carried out by Experian Italia S.p.A., which is the subject of this decision, was therefore conducted in violation of Articles 5(1)(a) and (c), 12, 15, and 25 of the Regulation. With regard to the exercise of the corrective powers referred to in Article 58(2) of the Regulation, although it is acknowledged that Experian Italia S.p.A., during the proceedings, voluntarily adopted some initial measures aimed at bringing the processing of customer data into compliance with the Regulation, these measures do not appear adequate for the reasons already explained (see above, paragraphs 2.2 and 3 of this decision). It is therefore deemed necessary, in light of the critical issues identified with respect to the controller, to order the controller, pursuant to Article 58(2)(c) and (d) of the Regulation, to implement the following corrective measures: a) updating the template for responding to requests for access, pursuant to Art. 15 of the Regulation, prepared by the Company as of January 2025, in order to include therein information regarding the E5-35 sub-score and the “ESX-score,” as well as the logic and criteria applied to the calculation system, and the simultaneous transmission of this information to Messrs.

XX, XX, XX, XX, XX, and XX; b) revision of the policy titled “Procedures for Responding to Data Subjects (Consumer Service),” version 8.0 dated April 15, 2025, with specific reference to paragraphs 4.1. and 5.1. thereof, with a view to ensuring, for the reasons set forth in paragraph 4.2 of this decision, that the data subject is not required to submit multiple access requests to Experian Italia S.p.A. in order to obtain all information pertaining to the “ESX Score” processed in the context under review. It is therefore necessary that the aforementioned policy provide that—following the submission of a request pursuant to Art. 15 of the Regulation to learn “one’s credit score(s)” – the Company uses, as a first step and in its response pursuant to Art. 12 of the Regulation, the updated model referred to in point (a); c) the adoption of a procedure designed to ensure that the data subject can fully exercise the right to rectification, pursuant to Article 16 of the Regulation, in the event of the processing of inaccurate and/or incomplete data relating to the “ESX Score” assigned to the data subject.

This applies, in particular, when the aforementioned score is primarily based on the level of risk associated with the data subject, in relation to their residential address (the so-called Geodelphi indicator). All of this is to be considered in light of the fact that, even if the data subject is not listed in the SIC, an “ESX Score” is still generated based on the aforementioned indicator; d) the completion of modifications to the XML schema to be transmitted to Major1 S.r.l., aimed at eliminating sub-scores not necessary for the calculation of the “CGS-X Score,” specifically, the D4U and DG3r indices (see above, para 4.4 of this decision). Finally, it should be noted that the violations, as established in accordance with the terms set forth in the reasoning, cannot in any way be considered “minor” within the meaning of Recital 148 of the Regulation; this is in light of the multiple violations alleged and the number of data subjects involved, as well as the additional factors explained in greater detail in paragraph 6 of this decision. 6.

Injunction Order. The Data Protection Authority, pursuant to Article 58, para 2, subparagraph (i) of the Regulation and Article 166 of the Code, has the power to impose an administrative fine provided for in Article 83 of the Regulation, by issuing an injunction order (Article 18. Law No. 689 of November 24, 1981), in connection with the processing of personal data carried out by Experian Italia S.p.A., which has been found to be unlawful, as set forth herein. The violation of the provisions referred to above entails the application of the administrative fine provided for in Art. 83, para. 4, subparagraph (a), and para. 5, subparagraphs (a) and (b), of the Regulation. Having determined that Art. 83(3) of the Regulation must be applied, which provides that “if, in relation to the same processing or related processing operations, a controller […] intentionally or negligently violates several provisions of this Regulation, the total amount of the administrative fine shall not exceed the amount specified for the most serious violation,” the total amount of the fine is calculated so as not to exceed the maximum amount provided for in Art. 83(5) of the Regulation.

With regard to the factors listed in Art. 83(2) of the Regulation for the purposes of imposing the administrative fine and determining its amount, and taking into account that the fine must be “effective, proportionate, and dissuasive in each individual case” (Article 83(1) of the Regulation), it is noted that, in the case at hand, the following circumstances were taken into account: - the significant severity of the violation (Article 83(2)(a) of the Regulation), in relation to its nature (concerning non-compliance with provisions on transparency and data subject rights, as well as the principles of data minimisation, privacy by design, and privacy by default), the manner in which it occurred (multiple instances of unlawful conduct repeated over time), and its duration (approximately 2.5 years). Also considered relevant for this purpose are the characteristics and processing purposes, as well as the large number of data subjects involved and the nature of the harm they suffered.

All of this, given that: the operations in question were carried out to develop a risk profile regarding the data subjects’ reliability in terms of timely payments, an activity that falls within the controller’s core business; the unlawful conduct affected 561 data subjects; the established violations contributed, in most cases, to the denial of contracts for the supply of electricity and/or gas to the data subjects, to their detriment; - the negligent nature of the conduct and the data controller’s significant degree of accountability regarding the technical and organizational measures implemented (Articles 83(2)(b) and (d) of the Regulation). All of this, with particular regard to the deficiency and inadequacy—in the specific context at hand—of the measures and processes implemented by the Company concerning compliance with obligations related to the exercise of data subject rights, as well as the principles of privacy by design and privacy by default.

With regard to the subjective element, the following circumstances are taken into account: with respect to the processing activities carried out by Experian Italia S.p.A. for the purpose of calculating the “ESX Score,” the company erroneously considered the provision of Article 22 of the Regulation to be inapplicable; - the fact that there are no previous violations committed by the controller or previous measures referred to in Article 58 of the Regulation concerning the same subject matter (Article 83(2)(e) and (i) of the Regulation). On this point, it should be noted that Decision No. 630 of October 23, 2025 (web doc. No. 10196194), adopted against Experian Italia S.p.A., was not taken into account for this purpose. This is because the preliminary investigation pertaining to this decision was conducted concurrently with the one that led to the adoption of the aforementioned measure; - the adoption by the data controller of measures to mitigate or eliminate the consequences of the violation (Articles 83(2)(c) and 83(para) of the Regulation).

In this regard, it should be viewed favorably that Experian Italia S.p.A., once it became aware of the violation, voluntarily adopted some initial measures to mitigate the effects of the unlawful processing, even though these measures were only partially effective in reducing the risks; - the fact that the Company actively cooperated with the Authority during the proceedings (Article 83(2)(f) of the Regulation); - the nature of the information subject to the breach (Article 83(2)(g) of the Regulation), which, although not classified as special categories of data, is nonetheless considered sensitive as it reflects the reliability of customers’ payment timeliness; this also taking into account the potential economic and social consequences that may arise for the data subjects as a result of their unlawful processing; - other mitigating factors (Article 83(2)(k) of the Regulation), such as, first and foremost, the Company’s implementation of initiatives aimed at promoting awareness of the right to personal data protection through its official website; with particular reference, given the specific case at hand, to the initiative launched in June 2025 through the publication of a Frequently Asked Questions (FAQ) section dedicated exclusively to credit scoring (see above, para 3 of this decision).

Consideration was also given to Experian Italia S.p.A.’s adherence to the “Code of Conduct for Information Systems Managed by Private Entities Regarding Consumer Credit, Reliability, and Timeliness of Payments,” approved, pursuant to Article 41 of the Regulation, by a resolution of the Data Protection Authority dated October 6, 2022. It is further considered that, in the present case, the following factors are relevant in light of the aforementioned principles of effectiveness, proportionality, and deterrence to which the Authority must adhere when determining the amount of the sanction (Articles 83, para 1, of the Regulation): the economic circumstances of the offender, determined based on the Company’s turnover as reported in the financial statements as of March 31, 2025 (the most recent available). In light of the above factors and the assessments made, it is deemed appropriate, in the present case, to impose on Experian Italia S.p.A. an administrative penalty in the amount of 120,000.00 euros (one hundred twenty thousand/00).

In this context, it is also deemed that, pursuant to Article 166, paragraph 7, of the Code and Article 16, paragraph 1, of the Data Protection Authority’s Regulation No. 1/2019, this section containing the injunction order must be published on the Data Protection Authority’s website. This is in light of the specific nature of the data subject to the processing at issue—as it pertains to the data subject’s creditworthiness—as well as the nature of the violations found, which affected the general principles of processing, in particular the principle of transparency and the obligations regarding the exercise of the data subject rights. Finally, it is considered that the conditions set forth in Art. 17 of the Data Protection Authority Regulation No. 1/2019 are met. IN VIEW OF THE FOREGOING, THE DATA PROTECTION AUTHORITY - declares, pursuant to Article 57(1)(f) of the Regulation, that the processing carried out by Experian Italia S.p.A., with its registered office in Rome, VAT No. 06016221001, as detailed in the reasoning, for violating Article 5(1)(a) and (c) and Articles 12, 15, and 25 of the Regulation; - orders, pursuant to Article 58(2)(c) and (d) of the Regulation, the aforementioned Company to comply, within six months from the date of notification of this decision, the requirements set forth in para 5 of this decision, while requiring the company to provide, within the aforementioned deadline, an adequately documented response pursuant to Art 157 of the Code; failure to provide such a response may result in the imposition of the administrative fine provided for in Article 83, para 5, letter e) of the Regulation; ORDERS pursuant to Article 58, para 2, subparagraph (i) of the Regulation, Experian Italia S.p.A. is hereby ordered to pay the sum of 120,000.00 euros (one hundred twenty thousand/00) as an administrative fine for the violations set forth in this order; ORDERS pursuant to Article 58, para 2, subparagraph i) of the Regulation, that the same company pay the aforementioned sum of 120,000.00 euros (one hundred twenty thousand/00), as an administrative fine for the violations set forth in this order, in accordance with the procedures outlined in the attachment, within thirty days of the notification of this order, failing which the necessary enforcement measures will be taken pursuant to Art. 27 of Law No. 689/1981.

It is noted that, pursuant to Article 166, paragraph 8 of the Code, the offender retains the right to settle the dispute by paying an amount equal to half of the imposed penalty within the time limit set forth in Article 10, paragraph 3, of Legislative Decree No. 150 of September 1, 2011, set for filing an appeal as indicated below; ORDERS - pursuant to Article 166, paragraph 7, of the Code and Article 16, paragraph 1, of the Data Protection Authority’s Regulation No. 1/2019, the publication of the injunction order on the Data Protection Authority’s website; - pursuant to Article 154-bis, paragraph 3, of the Code and Article 37 of the Data Protection Authority’s Regulation No. 1/2019, the publication of this order on the Authority’s website; - pursuant to Article 17 of the Authority’s Regulation No. 1/2019, the recording of the violations and the measures adopted in accordance with Article 58(2) of the Regulation in the Authority’s internal register provided for in Article 57(1)(u) of the Regulation.

Pursuant to Article 78 of Regulation (EU) 2016/679, as well as Article 152 of the Code and Article 10 of Legislative Decree No. 150 of September 1, 2011, an objection to this decision may be filed with the ordinary courts by filing an appeal with the ordinary court of the jurisdiction specified in the aforementioned Art 10, within thirty days from the date of notification of the decision, or within sixty days if the appellant resides abroad. Rome, July 3, 2026 THE PRESIDENT Stanzione THE RAPPORTEUR Ghiglia THE SECRETARY GENERAL Montuori