The DPA received a complaint by an employee of Poste Italiane S.p.A

SEE ALSO Newsletter No. 554 of October 23, 2026 [Web Doc. No. 10310391] Decision of October 7, 2026 Register of Decisions No. 746 of October 7, 2026 THE DATA PROTECTION AUTHORITY AT today’s meeting, attended by Prof. Pasquale Stanzione, President; Prof. Ginevra Cerrina Feroni, Vice President; Dr. Agostino Ghiglia; and Dr. Luigi Montuori, Secretary General; HAVING REGARD TO Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016 (hereinafter, the “Regulation”); HAVING REGARD TO the Code on Data Protection, containing provisions for the adaptation of national law to Regulation (EU) 2016/679 (Legislative Decree No. 196 of June 30, 2003, as amended by Legislative Decree No. 101 of August 10, 2018, hereinafter the “Code”); HAVING REGARD TO the complaint filed pursuant to Art. 77 of the Regulation by Ms. XX, domiciled at the office of XX, against Deutsche Bank S.p.A.; HAVING EXAMINED the documentation on file; HAVING CONSIDERED the observations submitted by the Secretary General pursuant to Art. 15 of the Data Protection Authority’s Regulation No. 1/2000; RAPPORTEUR: Prof. Pasquale Stanzione; PREAMBLE 1. Complaint. In a complaint filed on January 5, 2024, the complainant, an employee of Poste Italiane (hereinafter also referred to as “Poste” or the “Company”), represented that, following a loan application submitted to Deutsche Bank (hereinafter also referred to as the “Bank”) —via the portal made available by the Bank to Poste for its employees—the Bank “when denying the loan, entered into the platform (accessible to all Poste Italiane S.p.A. staff responsible for managing loan applications, as well as to all staff accessing the system via the workstation of the manager of the Portacomaro Stazione Post Office—Municipality of Asti)—information stating that the applicant” had outstanding financial obligations, specifying the relevant amount and the net income received by the data subject. The complainant also specified that the form, published on the Poste portal and to be completed for the submission of the loan application, “does not include a field for entering the applicant’s salary amount, as this information is, by convention, provided directly by Poste Italiane S.p.A.” and that, in the disclosure provided, the Bank states that “it will not disclose to Poste the credit information and personal data found in the SIC CRIF [Credit Information Systems, hereinafter SIC], but will transmit only the outcome of the verification […] to Poste, which, in its capacity as an external processor, will communicate it to the Applicant.” Following the requests submitted to Deutsche Bank and Poste, in which the data subject objected to the processing of her data and requested its erasure, the two entities provided responses, respectively, which the data subject deemed unsatisfactory. Given that the Office, based on a preliminary review of the complaint and the related documentation, deemed it necessary—in order to fully investigate the matter—to initiate an investigation, not only against Deutsche Bank but also against Poste (the entity against which the data subject had not chosen to file a complaint), by a letter dated January 29, 2024 (Ref. No. 11166), it invited the complainant to indicate her interest in proceeding with the complaint against Poste as well—her own employer—a circumstance which the complainant confirmed in a letter dated February 12, 2024. The investigative proceedings conducted. The office then initiated a complex investigation involving Deutsche Bank and Poste, sending specific requests pursuant to Art. 157 of the Code in order to obtain information and documentation useful for clarifying the contractual relationships between the Bank and Poste, the respective roles they played for privacy purposes, as well as the methods of data processing related to loan applications and the data exchanged between them. Following the request for information sent on July 23, 2024 (Ref. No. 90731), the Bank, in a letter dated August 5, 2024, requested an extension of the previously set deadline for submitting the requested clarifications. The Office granted the request, based on the reasons stated therein, and set the deadline for September 12, 2024 (letter No. 98858 dated August 12, 2024). In a letter dated September 12, 2024, Deutsche Bank, in recounting the facts of the complaint, stated that it believed it had acted in accordance with the principles of lawfulness, fairness, and transparency in the processing of the data subject’s personal data, and that it had, following the data subject’s request, carried out the erasure of the data pertaining to her and had “promptly” informed the data subject thereof. With regard to the additional aspects covered by the request for information, the Bank represented the following: - the business relationship with Poste is governed by an agreement concerning the “BancoPosta” loan, which the Bank may extend to Poste customers under certain conditions; - Under this agreement, for privacy purposes, the two companies act as independent controllers of processing; however, the Bank also acts as a processor for Poste, pursuant to Article 4, paragraph 1, no. 8 of the Regulation, “with regard to the data communicated by Poste concerning the assessment criteria for the loan applicant, which Poste itself sends to the Bank; At the same time, Poste acts as a data processor for the Bank “with regard to the data communicated by the Bank to Poste concerning the outcome of the preliminary review of the loan application”; - The processing of personal data of individuals who submit a loan application through Poste takes place “using two separate IT systems, ownership of which is attributable, separately, to each party […] the two separate and distinct applications exchange data flows via an online web service” as follows: - In the preliminary phase, the customer asks Poste to run a simulation for a loan application with a specified amount and number of installments; the request is received by the Bank, which, using the same application, draws up a financial plan and transmits the processed information to Poste; if the customer accepts the offer, Poste asks the customer to sign and complete the necessary documentation; - In the intermediate phase, Poste transmits the application data to the Bank via web services, and the Bank then performs a creditworthiness assessment; - In the final phase, three outcomes are possible: approval of the application and subsequent disbursement of the loan; rejection of the application; or a request to add a co-borrower or modify the terms of the loan application. - The outcome of the application is represented by a code called “application status,” which the Bank communicates to Poste; if necessary, the Bank’s operator may also enter additional information in the application’s notes field; - Upon receiving the outcome of the application from the Bank, Poste “updates its system with the ‘case status’ code and any notes […] visible solely and exclusively to certain employees (specifically, sales staff only) within the relevant corporate departments of Poste”; - Once the decision-making phase is complete, “the customer receives a notification from the Bank providing the final outcome of the decision, which may be approval […] or a denial of the request […], while the customer does not receive—nor is permitted to view—any information regarding the Bank’s creditworthiness analysis, which remains information exchanged and processed solely between the two intermediaries.” On March 18, 2025, the Bank, at the Office’s request, sent a further note to better clarify the roles played by the Bank itself and by Poste, given that, although acting as independent controllers, at certain stages of the loan application process, they had designated each other as processors. In this regard, the Bank, while confirming that “the subjective role, for the purposes of processing personal data collected by the parties in the course of activities carried out in fulfillment of the obligations assumed under the Agreement itself, is that of independent controllers pursuant to Art. 4, paragraph 1, No. 7 of the European General Data Protection Regulation,” has also represented that, over time, taking into account the mutual “interest in exchanging additional data lawfully collected from potential customers” and in order to improve the processes related to “the performance of activities preparatory to the promotion and placement of the BancoPosta loan product,” it was agreed—“limited to certain data”—to supplement the agreements, providing that: - “with regard to data for which only Poste is the Data Controller (since this data was collected by Poste within the scope of its contractual relationships with customers), which Poste has disclosed to DB and which concerns only the assessment criteria for the loan applicant […] Poste has appointed DB as the processor of personal data—pursuant to Article 4, paragraph 1, no. 8 of the Regulation; - in a manner entirely analogous to the preceding point, with regard to data for which DB alone is the Data Controller and which DB has disclosed to Poste, and which concern certain data collected as part of the preliminary checks conducted following the loan application […], DB has appointed Poste as the processor of personal data—pursuant to Article 4, paragraph 1, no. 8 of the Regulation”; - the additions set forth above enabled the Parties to better fulfill their respective contractual obligations, ensuring the Bank a more effective assessment of “credit risk in the evaluation process” and Poste “better commercial management of the customer […] in order to direct the customer toward other solutions [more suited] to their financing needs, as well as to inform the customer correctly and promptly regarding the reasons why the loan application was not approved”; - the Bank does not disclose to Poste “the data collected from Credit Information Systems but provides Poste with certain data […] to enable Poste itself to manage the relationship with the customer and their financing needs by resorting, where appropriate, to other financial intermediaries that adopt credit policies different from those adopted by DB, or to provide the customer with the reasons underlying the denial of the requested loan.” As part of the parallel investigation conducted against Poste, the Office obtained documents and clarifications necessary for the purposes of its assessments regarding the Bank as well, on September 12, 2024. 3. The initiation of the proceedings. Based on the information obtained during the preliminary investigation from Poste and the Bank, the Office served Deutsche Bank, by letter ref. no. 99977 dated July 16, 2025, the notice initiating proceedings for the adoption of the measures referred to in Articles 58(2) and 83 of the Regulation, in accordance with the provisions of Article 166(5), regarding the violation pertaining to the correct identification of the actual controller, as well as the principles of lawfulness and transparency regarding the information provided to data subjects in the context of the collaborative relationship with Poste (Articles 5(1)(a), 13, and 28 of the GDPR). In a letter dated August 1, 2025, Deutsche Bank requested an extension to file its defense briefs pursuant to Article 13, paragraph 3, of the Data Protection Authority’s Regulation No. 1/2019 (concerning internal procedures with external relevance, aimed at carrying out the tasks and exercising the powers entrusted to the Data Protection Authority), which the Office granted, setting the deadline for September 15, 2025 (letter No. 109001 dated August 5, 2025). The Bank submitted its defense briefs on September 15, 2025, in which it further clarified certain aspects already outlined in its communication of September 12, 2024 (see point 2 of this document). In particular, as a preliminary matter, it sought to emphasize that the assessments prepared by the Bank regarding loan and credit applications are accessible “in accordance with the ‘need-to-know’ security principle, exclusively to a very limited number of individuals (including the data subject herself) based on the territorial segregation of areas of responsibility”. With regard to the other issues raised, the Bank’s representative stated the following: - Pre-scoring activities (which take place during the so-called “Preliminary Phase”) must be kept separate from the actual creditworthiness assessment activities and are governed by two distinct disclosure documents; - During the preliminary phase, the customer receives three documents: “SECCI/IEBCC Pre-Contractual Form; Data Verification Form for the Loan Application; SECCI/IEBCC Contractual Form; and Banco Posta Loan Application Form”; - During the pre-scoring phase, the processing of the data subjects’ personal data—which is provided by completing the Data Verification Form for the Loan Application, which also contains the privacy notices from Poste and the Bank—is carried out by the Bank “to fulfill specific requests from the data subject prior to the conclusion of the contract in order to conduct a preliminary verification of the loan application data; assess the loan option best suited to the customer; and perform a check in the credit information systems”; - only after completing these verifications, “may the personalized IEBCC be submitted to the Applicant along with the corresponding binding loan application for possible signing”; - during the preliminary phase, “the outcome of the verifications conducted by the Bank […] consists solely and exclusively of the transmission of alphanumeric codes” indicating “the customer is not eligible for financing […]; Transfer of the file to the law firm […]; addition of a guarantor […]; adjustment of the amount/adjustment of the term […]"; - once the pre-scoring phase is complete, the customer signs the proposed contract contained in the “Banco Posta Loan Application Form,” which includes “in addition to the general terms and conditions relating to the loan” the disclosure regarding the “management of the pre-contractual and (if accepted by the Bank) contractual relationship”; - During the intermediate phase, the Bank initiates the creditworthiness assessment, as indicated in the Banco Posta Loan Application Form. All of this information is included in a report in which the data verified in the credit information systems constitutes only one of the sections contained in the report, which “is never shared with Poste”; - The outcome of the creditworthiness assessment (not to be confused with “the outcome of the pre-scoring assessment”) may include information listed in the “notes field,” with the purpose of providing “guidance to Poste regarding the reasons forany rejection of a loan or the need to adjust the request,” thereby allowing Poste (which has direct contact with the customer) “to understand the issues related to the applicant’s situation, […] which enable the intermediary to explain the reasons for rejecting the application to the applicant”; - in the specific case that is the subject of the complaint, the notes field regarding the data subject’s situation “included information collected directly from the SIC” because some of this data was deemed relevant for better explaining to the data subject the reasons for the loan denial; - Bank staff fill out the “notes” field only at the final stage; therefore, the Bank cannot be accused of violating the mandatory provisions of the privacy notice regarding pre-scoring activities; - With regard to the respective roles, the Bank specified the various stages in which it acts as an independent controller and those in which it acts as a processor, clarifying that the tasks assigned to Poste, as processor, are set forth in the documentation attached to the Supplementary Agreement. Finally, the Bank requested a hearing but subsequently decided to withdraw that request, notifying this Authority of its decision in a letter dated March 27, 2026. 4. The outcome of the preliminary investigation and the proceedings for the adoption of corrective and sanctioning measures pursuant to Art. 58(2) of the Regulation. As a preliminary matter, it should be noted that this preliminary investigation, although initiated in response to a complaint, was subsequently expanded ex officio to examine certain aspects relating, more generally, to the processing of data subjects’ personal data in the context of the promotion and placement of the “BancoPosta Product.” During the investigation, the Office noted, first of all, that Deutsche Bank, in coordination with Poste, had carried out the erasure of the data subject’s information and promptly informed her of this action. As for the general aspects of the data processing under review, these concerned: the respective roles played by Poste and the Bank, the data exchanged between them, and the privacy notice provided to data subjects pursuant to Art. 13 of the GDPR. That said, following the conclusion of the preliminary investigation, and taking into account the findings from the statements made by the Bank during the proceedings (for the accuracy of which the author is liable pursuant to and for the purposes of Article 168 of the Code “False statements to the Data Protection Authority and suspension of the Authority’s duties or powers”), as well as the documentation included in the case file, noting that the clarifications provided by Deutsche Bank in its defense briefs submitted on September 15, 2025, have offered a clearer and more complete picture of the various stages of the credit disbursement process associated with the BancoPosta product and the processing of data subjects’ information in this context, the following is stated. It is noted that “the outcome of the verification” to which explicit reference is made in the information contained in the “Data Verification Form for the Loan Application” is not to be understood as a final assessment of the loan application, but rather pertains to the so-called pre-scoring of the preliminary phase, which is carried out through a preliminary verification of the data subject’s information—accessed via the SICs—the identification of the loan best suited to their needs, and the subsequent transmission of alphanumeric codes to Poste. The final assessment, however, takes place at a later stage of the “BancoPosta personal loan application” process when the data subject signs the “BancoPosta Loan Application Form,” to which additional disclosure information is attached. At this stage (the so-called “final stage”), the “outcome” is transmitted to Poste so that it can be communicated to the applicant; at this stage, the Bank has the discretion to enter any information regarding the outcome of the application in the “Notes to Intermediary” field. That said, in order to properly contextualize the matter, it is deemed appropriate to refer to the provisions contained in Presidential Decree No. 144 of March 14, 2001 (Regulation on the Simplification of Bancoposta Services), which established the governing rules for Poste Italiane S.p.A.’s financial activities with the public. The aforementioned Regulation prohibits Poste Italiane from granting loans to the public and permits it to engage in the promotion and placement of banking and financial products and services off-premises, acting as an intermediary on behalf of banks and financial companies, which serve as the lenders, and whose relationships are governed by specific agreements and conventions (Art. 2, paragraphs 8 and 9-bis of the aforementioned Presidential Decree) From the context outlined above, it is clear that the duties and accountability that fall upon Poste and the Bank, while interrelated, are different and distinct, including with regard to the contractual relationship that each maintains with the data subject. This is confirmed by the evidence gathered during the preliminary investigation, an examination of which reveals that, during the loan application and verification phase, Poste collects and verifies the data of the data subjects and any co-obligors, including for the purpose of matching the financial product that best meets the applicant’s needs and financial capacity; it then transmits the data to the Bank, including—where the request comes from a checking account holder—the transmission, in aggregated form, of indicators generated by existing relationships with Poste (average balance, checking account balance, etc.); finally, upon completion of the preliminary review, it notifies the data subject of the outcome of the request. The Bank, as the lender, conducts the preliminary review to assess the data subject’s creditworthiness; based on the outcome of this review, it decides whether to grant or deny the loan, a decision that is “subject to the Bank’s sole, discretionary, and final judgment,” (see “Data Verification Form for Loan Application”); once its decision has been made, it forwards the outcome of the request to Poste so that it may communicate it to the loan applicant. The Bank, in accordance with the sector’s regulatory framework (Articles 120-undecies, paragraph 1, and 124-bis, paragraph 1, of the Consolidated Banking Act, hereinafter TUB), therefore carries out the activities typical of a lender, in relation to which it determines the purposes and means of processing, acting as an independent controller pursuant to Art. 4, No. 7 of the Regulation. At the same time, Poste retains independent data controller status within the scope of its separate relationship with the data subject, acting as an intermediary and maintaining an independent relationship with the data subject, which continues even following a potential negative assessment by the Bank, following which Poste may propose other financing solutions to its customer (by approaching other banks) that offer terms better suited to the customer’s needs and credit situation. It follows from the foregoing that, even during the exchange of data subjects’ information, the Bank and Poste act as independent controllers, since each operates on the basis of separate contractual relationships with the customer, within the limits of what is necessary for the performance of a contract to which the data subject is a party or for the implementation of precontractual measures taken at the data subject’s request (Art. 6(1)(b) of the Regulation). Based on the information gathered, it appears that the Bank independently determines the processing purposes and essential means, which are related to the assessment of the data subject’s creditworthiness—for which it is necessary to receive data regarding the loan applicant from Poste—and exclusively makes the decision regarding the granting or denial of the loan; Poste, on the other hand, operates within the framework of a separate relationship with the data subject and processes personal data for its own purposes, related to its brokerage activities. It follows, therefore, that the processing activities carried out by Poste and the Bank, including the disclosure of data, did not take place (as claimed by the two companies) in the interest of one party on behalf of the other, but rather fall within the limits of what is necessary for the performance of their respective contractual relationships or the precontractual measures requested by thedata subject (Article 6(1)(b) of the Regulation), without prejudice to the independent accountability of each controller regarding the lawfulness, fairness, transparency, and relevance of the processing carried out. This approach is also confirmed by the “Guidelines 07/2020 on the concepts of controller and processor under the GDPR” adopted by the EDPB on July 7, 2021. In these guidelines, while emphasizing that the role of “controller” is based on a factual rather than a formal analysis,” it is also clarified that “The roles of controller and processor are functional concepts: they aim to allocate accountability according to the roles actually performed. This implies that the legal status of a party as a ‘controller’ or ‘processor’ must, in principle, be determined by the activities actually carried out in a specific situation, rather than by its formal designation as a ‘controller’ or ‘processor’ (for example, in a contract)” (see paragraph 12 of the aforementioned Guidelines). In light of this conclusion, it must be held that the decision by Deutsche Bank and Poste to designate each other as processors (pursuant to Article 28 of the Regulation) during the phase of communicating the personal data of data subjects—although it reflects specific choices made by them and documented in “Agreements” signed by both parties—does not comply with the statutory provisions, according to which the processor is the entity “that processes personal data on behalf of the controller” (Article 4(8) of the Regulation) and who “is required to follow the instructions given by the controller […] regarding the processing purpose and the essential elements constituting the means thereof” (see EDPB, Guideline No. 07/2020, cit., p. 28), nor is it supported by a factual assessment of the relationship, which instead shows that the disclosure of information is not carried out by one party in the interest of the other, but rather by each party for its own purposes, as necessary for the performance of their respective contractual relationships or the precontractual measures requested by the data subject; it follows, therefore, that the Parties act as independent controllers of processing. The subjective characterization proposed by Poste and the Bank therefore does not correspond to the factual reality of the processing, with immediate repercussions also on the compliance of the privacy notice issued with personal data protection regulations, pursuant to Art 13 of the Regulation. In fact, in the present case, the privacy notice is not adequately formulated, given that, with regard to the processing of data subjects’ personal data carried out in connection with the promotion and placement of the “BancoPosta Product,” it should have specified the recipients or categories of recipients of the data subjects’ personal data (Article 13, para 1, subparagraph (e) of the Regulation), as well as additional information to ensure, in accordance with the general principles set forth in Article 5 of the Regulation, fair and transparent processing with respect to the data subjects. Having duly considered the matter, for all the reasons outlined above, it appears that the data controller has engaged in conduct contrary to Article 5(1)(a) and Article 13 of the Regulation with regard to the information provided to data subjects. 5. Conclusions: Declaration that the processing is unlawful. Corrective measures pursuant to Art. 58(2) of the Regulation. In light of the overall findings, the Authority considers that the statements, documentation, and explanations provided by the controller during the investigation do not sufficiently address the concerns notified by the Office in the notice initiating the proceedings and are, therefore, insufficient to warrant dismissal of the case, especially since none of the cases provided for in Art. 11 of the Data Protection Authority’s Regulation No. 1/2019 apply. The processing of personal data carried out by Deutsche Bank is, in fact, unlawful, under the terms set forth above, with regard to the violation of the principles of fairness and transparency, as it was carried out in violation of Articles 5(1)(a) and 13 of the Regulation. The violation of the aforementioned provisions entails the imposition of the administrative sanction provided for in Art. 83(5)(a) and (b) of the Regulation. With regard to the corrective powers referred to in Article 58(2) of the Regulation, in light of the circumstances of this specific case, Deutsche Bank is hereby ordered—with respect to the processing of data subjects’ personal data carried out in connection with the promotion and placement of the “BancoPosta Product”—— to prepare a privacy notice that, in order to ensure fair and transparent processing with respect to data subjects (Article 5 of the Regulation), when listing the recipients or categories of recipients of personal data (Article 13(1)(e) of the Regulation), takes into account the specific role played by Poste, as an independent controller. 6. Adoption of an injunction ordering the imposition of an administrative fine and ancillary penalties (Articles 58(2)(i) and 83 of the Regulation; Article 166, paragraph 7, of the Code). The Data Protection Authority, pursuant to Art. 58(2), subparagraph (i) of the Regulation and Article 166 of the Code, has the power to impose an administrative fine provided for in Article 83, para 5, of the Regulation, through the adoption of an injunction order (Article 18. Law No. 689 of November 24, 1981), in connection with the processing of personal data carried out by Deutsche Bank S.p.A., which has been found to be unlawful, as set forth above. With regard to the factors listed in Article 83(2) of the Regulation, for the purposes of imposing the administrative fine and determining its amount—taking into account that the fine must “in any event [be] effective, proportionate, and dissuasive” (Article 83(1) of the Regulation), it is noted that, in the present case, the following circumstances were taken into account: - With regard to the severity of the violations, their nature was deemed significant, as they concerned non-compliance with the general principles of data processing, and in particular the principles of fairness and transparency regarding the content of the privacy notice provided to data subjects —that is, all customers who applied for a loan related to products offered by BancoPosta—to have accurate and transparent information regarding the processing of their data (Art. 83(2)(a) of the Regulation); - with regard to the subjective element, consideration was given to the negligent nature of the violation, attributable to an erroneous interpretation of the respective roles played during certain stages of the BancoPosta loan application process (Art. 83(2)(b) of the Regulation); - the data controller’s adoption of certain measures designed to mitigate or eliminate the consequences of the breach (Art. 83(2)(c) of the Regulation). In this regard, the following should be viewed favorably: the fact that Deutsche Bank carried out the erasure of the data subject’s information and promptly notified her, as well as the steps it took to raise awareness among the “staff […] responsible for conducting creditworthiness assessments for the BancoPosta Product, by sending an internal organizational memo reminding them to avoid, as much as possible, the use of credit information and personal data in free-text fields”; - the absence of previous rulings by the Authority against the Bank regarding the same matter, as well as the absence of complaints similar to the one that is the subject of this decision (Articles 83(2)(e) and 83(para) of the Regulation); - the fact that the Bank cooperated with the Authority during the proceedings (Article 83, para 2, subparagraph f) of the Regulation). In light of the above factors and the assessments made, it is deemed appropriate, in this case, to impose on Deutsche Bank S.p.A. an administrative fine in the amount of 33,000.00 euros (thirty-three thousand euros). Finally, it is considered that the conditions set forth in Article 17 of the Data Protection Authority’s Regulation No. 1/2019 are met. THAT BEING SAID, THE DATA PROTECTION AUTHORITY pursuant to Articles 57(1)(f) and 83 of the Regulation, finds that the processing carried out by Deutsche Bank, represented by its current legal representative, with registered office in Milan, Piazza del Calendario No. 3, Tax ID/VAT No. 01340740156, pursuant to Article 143 of the Code, for violating Articles 5(1)(a) and 13 of the Regulation; pursuant to Article 58(2)(d) of the Regulation, orders the aforementioned Bank to comply, within 6 months from the date of notification of this decision, with the requirements set forth in para 5 of this decision, while at the same time requiring the Bank to provide, within the aforementioned deadline, a properly documented response in accordance with Article 157 of the Code; failure to provide such a response may result in the imposition of the administrative fine provided for in Article 83, para 5, subparagraph (e) of the Regulation; ORDERS pursuant to Article 58, para 2, subparagraph (i), of the Regulation, that Deutsche Bank pay the sum of 33,000.00 euros (thirty-three thousand euros) as an administrative fine for the violations set forth in this order; DIRECTS Deutsche Bank S.p.A. to pay the aforementioned sum of 33,000.00 euros (thirty-three thousand euros) in accordance with the procedures set forth in the attachment, within thirty days of the service of this order, failing which the necessary enforcement measures will be taken pursuant to Art. 27 of Law No. 689/1981. It is noted that the offender retains the right to settle the dispute by paying—again in accordance with the procedures set forth in the attachment—an amount equal to half of the imposed penalty, within the time limit set forth in Article 10, paragraph 3, of Legislative Decree No. 150 of September 1, 2011, provided for the filing of an appeal as indicated below; ORDERS — pursuant to Article 17 of Regulation No. 1/2019, that the violations and the measures adopted in accordance with Article 58, para 2, of the Regulation be recorded in the Authority’s internal register provided for in Article 57, para 1, letter u), of the Regulation. - pursuant to Article 154-bis, paragraph 3, of the Code and Article 37 of the Data Protection Authority’s Regulation No. 1/20129, the publication of this decision on the Authority’s website; - Pursuant to Article 166, paragraph 7, of the Code and Article 16, paragraph 1, of the Data Protection Authority’s Regulation No. 1/20129, the publication of the injunction order on the Data Protection Authority’s website. Pursuant to Article 78 of the Regulation, as well as Article 152 of the Code and Article 10 of Legislative Decree No. 150/2011, an appeal against this order may be filed with the ordinary courts by submitting a petition to the ordinary court of the jurisdiction specified in the aforementioned Art 10, within thirty days from the date of notification of the order, or within sixty days if the appellant resides abroad. Rome, October 7, 2026 THE CHAIRMAN Stanzione THE RAPPORTEUR Stanzione THE SECRETARY GENERAL Montuori SEE ALSO Newsletter No. 554 of October 23, 2026 [Web Doc. No. 10310391] Decision of October 7, 2026 Register of Decisions No. 746 of October 7, 2026 THE DATA PROTECTION AUTHORITY AT today’s meeting, attended by Prof. Pasquale Stanzione, Chair; Prof. Ginevra Cerrina Feroni, Vice Chair; Dr. Agostino Ghiglia; and Dr. Luigi Montuori, Secretary General; HAVING REGARD TO Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016 (hereinafter, the “Regulation”); HAVING REGARD TO the Code on Data Protection, containing provisions for the adaptation of national law to Regulation (EU) 2016/679 (Legislative Decree No. 196 of June 30, 2003, as amended by Legislative Decree No. 101 of August 10, 2018, hereinafter the “Code”); HAVING REGARD TO the complaint filed pursuant to Article 77 of the Regulation by Ms. XX, domiciled at the office of XX, against Deutsche Bank S.p.A.; HAVING EXAMINED the documentation on file; HAVING CONSIDERED the observations submitted by the Secretary General pursuant to Art. 15 of the Data Protection Authority’s Regulation No. 1/2000; RAPPORTEUR: Prof. Pasquale Stanzione; PREAMBLE 1. Complaint. In a complaint filed on January 5, 2024, the complainant, an employee of Poste Italiane (hereinafter also referred to as “Poste” or the “Company”), represented that, following a loan application submitted to Deutsche Bank (hereinafter also referred to as the “Bank”), —via the portal made available by the Bank to Poste for its employees—the Bank “when denying the loan, entered into the platform (accessible to all Poste Italiane S.p.A. staff responsible for managing loan applications, as well as to all staff accessing the system via the workstation of the manager of the Portacomaro Stazione Post Office—Municipality of Asti)—information stating that the applicant” had outstanding financial obligations, specifying the relevant amount and the net income received by the data subject. The complainant also specified that the form, published on the Poste portal and to be completed for the submission of the loan application, “does not include a field for entering the applicant’s salary amount, as this information is, by convention, provided directly by Poste Italiane S.p.A.” and that, in the disclosure provided, the Bank states that “it will not disclose to Poste the credit information and personal data found in the SIC CRIF [Credit Information Systems, hereinafter SIC], but will transmit only the outcome of the verification […] to Poste, which, in its capacity as an external processor, will communicate it to the Applicant.” Following the requests submitted to Deutsche Bank and Poste, in which the data subject objected to the processing of her data and requested its erasure, the two entities provided responses, respectively, which the data subject deemed unsatisfactory. Given that the Office, based on a preliminary review of the complaint and the related documentation, deemed it necessary—in order to fully investigate the matter—to initiate an investigation, not only against Deutsche Bank but also against Poste (the entity against which the data subject had not chosen to file a complaint), by a letter dated January 29, 2024 (Ref. No. 11166), it invited the complainant to indicate her interest in proceeding with the complaint against Poste as well—her own employer—a circumstance which the complainant confirmed in a letter dated February 12, 2024. The investigative proceedings conducted. The office then initiated a complex investigation involving Deutsche Bank and Poste, sending specific requests pursuant to Art. 157 of the Code in order to obtain information and documentation useful for clarifying the contractual relationships between the Bank and Poste, the respective roles they played for privacy purposes, as well as the methods of data processing related to loan applications and the data exchanged between them. Following the request for information sent on July 23, 2024 (Ref. No. 90731), the Bank, in a letter dated August 5, 2024, requested an extension of the previously set deadline for submitting the requested clarifications. The Office granted the request, based on the reasons stated therein, and set the deadline for September 12, 2024 (letter No. 98858 dated August 12, 2024). In a letter dated September 12, 2024, Deutsche Bank, in recounting the facts of the complaint, stated that it believed it had acted in accordance with the principles of lawfulness, fairness, and transparency in the processing of the data subject’s personal data, and that it had, following the data subject’s request, carried out the erasure of the data pertaining to her and had “promptly” informed the data subject thereof. With regard to the additional aspects covered by the request for information, the Bank represented the following: - the business relationship with Poste is governed by an agreement concerning the “BancoPosta” loan, which the Bank may grant to Poste customers under certain conditions; - Under this agreement, for privacy purposes, the two companies act as independent controllers of processing; however, the Bank also acts as a processor for Poste, pursuant to Article 4, paragraph 1, no. 8 of the Regulation, “with respect to the data communicated by Poste regarding the assessment criteria for the loan applicant, which Poste itself sends to the Bank; at the same time, Poste acts as a data processor for the Bank “with regard to the data communicated by the Bank to Poste concerning the outcome of the preliminary review of the loan application”; - The processing of personal data of individuals who submit a loan application through Poste takes place “using two separate IT systems, ownership of which is attributable, separately, to each party […] the two separate and distinct applications exchange data flows via an online web service” as follows: - In the preliminary phase, the customer asks Poste to run a simulation for a loan application with a specified amount and number of installments; the request is received by the Bank, which, using the same application, draws up a financial plan and transmits the processed information to Poste; if the customer accepts the offer, Poste asks the customer to sign and complete the necessary documentation; - In the intermediate phase, Poste transmits the application data to the Bank via web services, and the Bank then conducts a creditworthiness assessment; - In the final phase, three outcomes are possible: approval of the application and subsequent disbursement of the loan; rejection of the application; or a request to add a co-borrower or modify the terms of the loan application. - The outcome of the request is represented by a code called “case status,” which the Bank communicates to Poste; and, if necessary, the Bank’s operator may also enter additional information in the application’s notes field; - Upon receiving the outcome of the request from the Bank, Poste “updates its system with the ‘case status’ code and any notes […] visible solely and exclusively to certain employees (specifically, sales staff only) within the relevant departments of Poste”; - Once the decision-making phase is complete, “the customer receives a notification from the Bank providing the final outcome of the decision, which may be approval […] or a denial of the request […], while the customer does not receive—nor is permitted to view—any information regarding the Bank’s creditworthiness analysis, which remains information exchanged and processed solely between the two intermediaries.” On March 18, 2025, the Bank, at the Office’s request, sent a further note to better clarify the roles played by the Bank itself and by Poste, given that, although they act as independent controllers, at certain stages of the loan application process, they had designated each other as processors. In this regard, the Bank, while confirming that “the subjective role, for the purposes of processing personal data collected by the parties in the course of activities carried out in fulfillment of the obligations assumed under the Agreement itself, is that of independent controllers pursuant to Article 4, paragraph 1, No. 7 of the European General Data Protection Regulation,” has also represented that, over time, taking into account the mutual “interest in exchanging additional data lawfully collected from potential customers” and in order to improve the processes related to “activities preparatory to the promotion and placement of the BancoPosta loan product,” it was agreed—limited to “certain data”—to supplement the agreements, providing that: - “with regard to data for which only Poste is the Data Controller (since this data was collected by Poste within the scope of its contractual relationships with customers), which Poste has disclosed to DB and which concerns only the assessment criteria for the loan applicant […] Poste has appointed DB as the processor of personal data—pursuant to Article 4, paragraph 1, no. 8 of the Regulation; - in a manner entirely analogous to the preceding point, with regard to data for which DB alone is the Data Controller and which DB has disclosed to Poste, and which concern certain data collected as part of the preliminary checks conducted following the loan application […], DB has appointed Poste as the processor of personal data—pursuant to Article 4, paragraph 1, no. 8 of the Regulation”; - the above additions enabled the Parties to better fulfill their respective contractual obligations, ensuring the Bank a more effective assessment of “credit risk in the evaluation process” and Poste “better commercial management of the customer […] in order to direct the customer toward other solutions [more suited] to their financing needs, as well as to inform the customer correctly and promptly regarding the reasons why the loan application was not approved”; - the Bank does not disclose to Poste “the data collected from Credit Information Systems but provides Poste with certain data […] to enable Poste itself to manage the relationship with the customer and their financing needs by resorting, if necessary, to other financial intermediaries that adopt credit policies different from those adopted by DB, or to provide the customer with the reasons underlying the denial of the requested loan.” As part of the parallel investigation conducted against Poste, the Office obtained documents and clarifications necessary for the purposes of its assessments regarding the Bank as well, on September 12, 2024. 3. The Initiation of Proceedings. Based on the evidence gathered during the preliminary investigation from Poste and the Bank, the Office served Deutsche Bank, by letter ref. no. 99977 dated July 16, 2025, the notice initiating proceedings for the adoption of the measures referred to in Articles 58(2) and 83 of the Regulation, in accordance with the provisions of Article 166(5), regarding the violation pertaining to the correct identification of the actual controller, as well as the principles of lawfulness and transparency regarding the information provided to data subjects in the context of the collaborative relationship with Poste (Articles 5(1)(a), 13, and 28 of the GDPR). In a letter dated August 1, 2025, Deutsche Bank requested an extension to file its defense briefs pursuant to Art. 13, paragraph 3, of the Data Protection Authority’s Regulation No. 1/2019 (concerning internal procedures with external relevance, aimed at carrying out the tasks and exercising the powers entrusted to the Data Protection Authority), which the Office granted, setting the deadline for September 15, 2025 (letter No. 109001 dated August 5, 2025). The Bank submitted its defense briefs on September 15, 2025, in which it further clarified certain aspects already outlined in its communication of September 12, 2024 (see point 2 of this document). In particular, as a preliminary matter, it sought to emphasize that the assessments prepared by the Bank regarding loan and credit applications are accessible “in accordance with the ‘need-to-know’ security principle, exclusively to a very limited number of individuals (including the data subject herself) based on the territorial segregation of areas of responsibility”. With regard to the other issues raised, the Bank’s representative stated the following: - Pre-scoring activities (which take place during the so-called “Preliminary Phase”) must be kept separate from the actual creditworthiness assessment activities and are governed by two distinct disclosure documents; - During the preliminary phase, the customer receives three documents: “SECCI/IEBCC Pre-Contractual Form; Data Verification Form for the Loan Application; SECCI/IEBCC Contractual Form; and Banco Posta Loan Application Form”; - During the pre-scoring phase, the processing of the data subjects’ personal data—which is provided by completing the Data Verification Form for the Loan Application, which also contains the privacy notices from Poste and the Bank—is carried out by the Bank “to fulfill specific requests from the data subject prior to the conclusion of the contract in order to conduct a preliminary verification of the loan application data; assess the loan option best suited to the customer; and perform a check in the credit information systems”; - only after completing these verifications, “may the personalized IEBCC be submitted to the Applicant along with the corresponding binding loan application for possible signing”; - during the preliminary phase, “the outcome of the verifications conducted by the Bank […] consists solely and exclusively of the transmission of alphanumeric codes” indicating “the customer is not eligible for financing […]; Transfer of the file to the law firm […]; addition of a guarantor […]; adjustment of the amount/adjustment of the term […]"; - once the pre-scoring phase is complete, the customer signs the proposed contract contained in the “Banco Posta Loan Application Form,” which includes “in addition to the general terms and conditions relating to the loan” the disclosure regarding the “management of the pre-contractual and (if accepted by the Bank) contractual relationship”; - During the intermediate phase, the Bank initiates the creditworthiness assessment, as indicated in the Banco Posta Loan Application Form. All of this information is included in a report in which the data verified in the credit information systems constitutes only one of the sections contained in the report, which “is never shared with Poste”; - The outcome of the creditworthiness assessment (not to be confused with “the outcome of the pre-scoring assessment”) may include information listed in the “notes field,” with the purpose of providing “guidance to Poste regarding the reasons forany rejection of a loan or the need to adjust the request,” thereby allowing Poste (which has direct contact with the customer) “to understand the issues related to the applicant’s situation, […] which enable the intermediary to explain the reasons for rejecting the application to the applicant”; - in the specific case that is the subject of the complaint, the notes field regarding the data subject’s situation “included information collected directly from the SIC” because some of this data was deemed relevant for better explaining to the data subject the reasons for the loan denial; - Bank staff fill out the “notes” field only at the final stage; therefore, the Bank cannot be accused of violating the mandatory provisions of the privacy notice regarding pre-scoring activities; - With regard to the respective roles, the Bank specified the various stages in which it acts as an independent controller and those in which it acts as a processor, clarifying that the tasks assigned to Poste, as processor, are set forth in the documentation attached to the Supplementary Agreement. Finally, the Bank requested a hearing but subsequently decided to withdraw that request, notifying this Authority of its decision in a letter dated March 27, 2026. 4. The outcome of the preliminary investigation and the proceedings for the adoption of corrective and sanctioning measures pursuant to Art. 58(2) of the Regulation. As a preliminary matter, it should be noted that this preliminary investigation, although initiated in response to a complaint, was subsequently expanded ex officio to examine certain aspects relating, more generally, to the processing of data subjects’ personal data in connection with the promotion and placement of the “BancoPosta Product.” During the investigation, the Office noted, first of all, that Deutsche Bank, in coordination with Poste, had carried out the erasure of the data subject’s information and promptly informed her of this action. As for the general aspects of the data processing under review, these concerned: the respective roles played by Poste and the Bank, the data exchanged between them, and the privacy notice provided to data subjects pursuant to Art. 13 of the GDPR. That said, following the conclusion of the preliminary investigation, and taking into account the findings from the statements made by the Bank during the proceedings (for the accuracy of which the author is liable pursuant to and for the purposes of Article 168 of the Code “False statements to the Data Protection Authority and suspension of the Authority’s duties or powers”), as well as the documentation included in the case file, noting that the clarifications provided by Deutsche Bank in its defense briefs submitted on September 15, 2025, have offered a clearer and more complete picture of the various stages of the credit disbursement process associated with the BancoPosta product and the processing of data subjects’ information in this context, the following is stated. It is noted that “the outcome of the verification” to which explicit reference is made in the information contained in the “Data Verification Form for the Loan Application” is not to be understood as a final assessment of the loan application, but rather pertains to the so-called pre-scoring of the preliminary phase, which is carried out through a preliminary verification of the data subject’s information—accessed via the SICs—the identification of the loan best suited to their needs, and the subsequent transmission of alphanumeric codes to Poste. The final assessment, however, takes place at a later stage of the “BancoPosta personal loan application” process when the data subject signs the “BancoPosta Loan Application Form,” to which additional disclosure information is attached. At this stage (the so-called “final stage”), the “outcome” is transmitted to Poste so that it can be communicated to the applicant; at this stage, the Bank has the discretion to enter any information regarding the outcome of the application in the “Notes to Intermediary” field. That said, in order to properly contextualize the matter, it is deemed appropriate to refer to the provisions contained in Presidential Decree No. 144 of March 14, 2001 (Regulation on the Simplification of Bancoposta Services), which established the governing rules for Poste Italiane S.p.A.’s financial activities with the public. The aforementioned Regulation prohibits Poste Italiane from granting loans to the public and permits it to engage in the promotion and placement of banking and financial products and services off-premises, acting as an intermediary on behalf of banks and financial companies—which serve as the lenders—whose relationships are governed by specific agreements and conventions (Art. 2, paragraphs 8 and 9-bis of the aforementioned Presidential Decree) From the context outlined above, it is clear that the duties and accountability that fall upon Poste and the Bank, while interrelated, are different and distinct, including with regard to the contractual relationship that each maintains with the data subject. This is confirmed by the evidence gathered during the preliminary investigation, an examination of which reveals that, during the loan application and verification phase, Poste collects and verifies the data of the data subjects and any co-obligors, including for the purpose of matching the financial product that best meets the applicant’s needs and financial capacity; it then transmits the data to the Bank, including—where the request comes from a checking account holder—the transmission, in aggregated form, of indicators generated by existing relationships with Poste (average balance, checking account balance, etc.); finally, upon completion of the preliminary review, it notifies the data subject of the outcome of the request. The Bank, as the lender, conducts the preliminary review to assess the data subject’s creditworthiness; based on the outcome of this review, it decides whether to grant or deny the loan, a decision that is “subject to the Bank’s sole, discretionary, and final judgment,” (see “Data Verification Form for Loan Application”); once its decision has been made, it forwards the outcome of the request to Poste so that it may communicate it to the loan applicant. The Bank, in accordance with the sector’s regulatory framework (Articles 120-undecies, paragraph 1, and 124-bis, paragraph 1, of the Consolidated Banking Act, hereinafter TUB), therefore carries out the activities typical of a lender, in relation to which it determines the purposes and means of processing, acting as an independent data controller pursuant to Art. 4, No. 7 of the Regulation. At the same time, Poste retains independent data controller status within the scope of its separate relationship with the data subject, acting as an intermediary and maintaining an independent relationship with the data subject, which continues even following a potential negative assessment by the Bank, following which Poste may propose other financing solutions to its customer (by approaching other banks) that offer terms better suited to the customer’s needs and credit situation. It follows from the foregoing that, even during the phase of mutual exchange of data subjects’ information, the Bank and Poste operate as independent controllers, since each acts on the basis of separate contractual relationships with the customer, within the limits of what is necessary for the performance of a contract to which the data subject is a party or for the implementation of pre-contractual measures taken at the data subject’s request (Art. 6(1)(b) of the Regulation). Based on the information gathered, it appears that the Bank independently determines the processing purposes and essential means, which are related to the assessment of the data subject’s creditworthiness—for which it is necessary to receive data regarding the loan applicant from Poste—and exclusively makes the decision regarding the granting or denial of the loan; Poste, on the other hand, operates within the framework of a separate relationship with the data subject and processes personal data for its own purposes, related to its brokerage activities. It follows, therefore, that the processing activities carried out by Poste and the Bank, including the disclosure of data, did not take place (as claimed by the two companies) in the interest of one party on behalf of the other, but rather fall within the limits of what is necessary for the performance of their respective contractual relationships or the precontractual measures requested by thedata subject (Article 6(1)(b) of the Regulation), without prejudice to the independent accountability of each controller regarding the lawfulness, fairness, transparency, and relevance of the processing carried out. This approach is also confirmed by the “Guidelines 07/2020 on the concepts of controller and processor under the GDPR” adopted by the EDPB on July 7, 2021. In these guidelines, while emphasizing that the role of “controller” is based on a factual rather than a formal analysis,” it is also clarified that “The roles of controller and processor are functional concepts: they aim to allocate accountability according to the roles actually performed. This implies that the legal status of a party as a ‘controller’ or ‘processor’ must, in principle, be determined by the activities actually carried out in a specific situation, rather than by its formal designation as a ‘controller’ or ‘processor’ (for example, in a contract)” (see paragraph 12 of the aforementioned Guidelines). In light of this conclusion, it must be held that the decision by Deutsche Bank and Poste to designate each other as processors (pursuant to Article 28 of the Regulation) during the phase of communicating the personal data of data subjects—even though it reflects specific choices made by them and documented in “Agreements” signed by both parties—does not comply with the statutory provisions, according to which the processor is the entity “that processes personal data on behalf of the controller” (Art 4(8) of the Regulation) and who “is required to follow the instructions given by the controller […] regarding the processing purpose and the essential elements constituting the means thereof” (see EDPB, Guideline No. 07/2020, cit., p. 28), nor is it supported by a factual assessment of the relationship, which instead shows that the disclosure of information is not carried out by one party in the interest of the other, but rather by each party for its own purposes, as necessary for the performance of their respective contractual relationships or the precontractual measures requested by the data subject; it follows, therefore, that the Parties act as independent controllers of processing. The subjective characterization proposed by Poste and the Bank therefore does not correspond to the factual reality of the processing, with immediate repercussions also on the compliance of the privacy notice issued with personal data protection regulations, pursuant to Art 13 of the Regulation. In fact, in the present case, the privacy notice is not adequately formulated, given that, with regard to the processing of data subjects’ personal data carried out in connection with the promotion and placement of the “BancoPosta Product,” it should have identified the recipients or categories of recipients of the data subjects’ personal data (Article 13(1)(e) of the Regulation), as well as additional information to ensure, in accordance with the general principles set forth in Article 5 of the Regulation, fair and transparent processing with respect to the data subjects. Having due consideration of all the reasons set forth above, it appears that the data controller has engaged in conduct that violates Article 5(1)(a) and Article 13 of the Regulation with respect to the information provided to data subjects. 5. Conclusions: Declaration that the processing is unlawful. Corrective measures pursuant to Art. 58(2) of the Regulation. In light of the overall findings, the Authority considers that the statements, documentation, and explanations provided by the controller during the investigation do not sufficiently address the concerns notified by the Office in the notice initiating the proceedings and are, therefore, insufficient to warrant dismissal of the case, especially since none of the cases provided for in Art. 11 of the Data Protection Authority’s Regulation No. 1/2019 apply. The processing of personal data carried out by Deutsche Bank is, in fact, unlawful, under the terms set forth, with regard to the violation of the principles of fairness and transparency, as it was carried out in violation of Articles 5(1)(a) and 13 of the Regulation. The violation of the aforementioned provisions entails the imposition of the administrative sanction provided for in Art. 83(5)(a) and (b) of the Regulation. With regard to the corrective powers referred to in Art. 58(2) of the Regulation, in light of the circumstances of this specific case, Deutsche Bank is hereby ordered—with respect to the processing of data subjects’ personal data carried out in connection with the promotion and placement of the “BancoPosta Product”—— to prepare a privacy notice that, in order to ensure fair and transparent processing with respect to data subjects (Article 5 of the Regulation), when listing the recipients or categories of recipients of personal data (Art. 13(1)(e) of the Regulation), takes into account the specific role played by Poste as an independent controller. 6. Adoption of an injunction ordering the imposition of an administrative fine and ancillary penalties (Articles 58(2)(i) and 83 of the Regulation; Article 166(7) of the Code). The Data Protection Authority, pursuant to Art. 58(2), subparagraph (i) of the Regulation and Article 166 of the Code, has the power to impose an administrative fine provided for in Article 83, para 5, of the Regulation, through the adoption of an injunction order (Article 18. Law No. 689 of November 24, 1981), in connection with the processing of personal data carried out by Deutsche Bank S.p.A., which has been found to be unlawful, as set forth above. With regard to the factors listed in Article 83(2) of the Regulation, for the purposes of imposing the administrative fine and determining its amount—taking into account that the fine must “in any event [be] effective, proportionate, and dissuasive” (Article 83(1) of the Regulation), it is noted that, in the present case, the following circumstances were taken into account: - With regard to the severity of the violations, their nature was deemed significant, as they concerned non-compliance with the general principles of data processing, and in particular the principles of fairness and transparency regarding the content of the privacy notice provided to data subjects —that is, all customers who applied for a loan related to products offered by BancoPosta—to have accurate and transparent information regarding the processing of their data (Art. 83(2)(a) of the Regulation); - with regard to the subjective element, consideration was given to the negligent nature of the violation, attributable to an erroneous interpretation of the respective roles played during certain stages of the BancoPosta loan application process (Art. 83(2)(b) of the Regulation); - the data controller’s adoption of certain measures designed to mitigate or eliminate the consequences of the violation (Articles 83(2)(c) and 83(para) of the Regulation). In this regard, the following should be viewed favorably: the fact that Deutsche Bank carried out the erasure of the data subject’s information and promptly notified her, as well as the steps it took to raise awareness among the “staff […] responsible for conducting creditworthiness assessments for the BancoPosta Product, by sending an internal organizational memo reminding them to avoid, as much as possible, the use of credit information and personal data in free-text fields”; - the absence of previous decisions by the Authority against the Bank regarding the same matter, as well as the absence of complaints similar to the one that is the subject of this decision (Articles 83(2)(e) and 83(para) of the Regulation); - the fact that the Bank cooperated with the Authority during the proceedings (Article 83, para 2, subparagraph f) of the Regulation). In light of the above factors and the assessments made, it is deemed appropriate, in this case, to impose on Deutsche Bank S.p.A. an administrative fine in the amount of 33,000.00 euros (thirty-three thousand euros). Finally, it is considered that the conditions set forth in Art. 17 of the Data Protection Authority’s Regulation No. 1/2019 are met. NOW THEREFORE, THE DATA PROTECTION AUTHORITY pursuant to Articles 57(1)(f) and 83 of the Regulation, finds that the processing carried out by Deutsche Bank, in the person of its pro tempore legal representative, with registered office in Milan, Piazza del Calendario No. 3, Tax ID/VAT No. 01340740156, pursuant to Article 143 of the Code, for the violation of Articles 5(1)(a) and 13 of the Regulation; pursuant to Article 58(2)(d) of the Regulation, orders the aforementioned Bank to comply, within 6 months from the date of notification of this decision, with the requirements set forth in para 5 of this decision, while at the same time requiring the Bank to provide, within the aforementioned deadline, a properly documented response in accordance with Article 157 of the Code; failure to provide such a response may result in the imposition of the administrative fine provided for in Article 83, para 5, subparagraph (e) of the Regulation; ORDERS pursuant to Article 58, para 2, subparagraph (i), of the Regulation, that Deutsche Bank pay the sum of 33,000.00 euros (thirty-three thousand euros) as an administrative fine for the violations set forth in this order; DIRECTS Deutsche Bank S.p.A. to pay the aforementioned sum of 33,000.00 euros (thirty-three thousand euros) in accordance with the procedures set forth in the attachment, within thirty days of the service of this order, failing which the necessary enforcement measures will be taken pursuant to Art. 27 of Law No. 689/1981. It is noted that the offender retains the right to settle the dispute by paying—again in accordance with the procedures set forth in the attachment—an amount equal to half of the imposed penalty, within the time limit set forth in Article 10, paragraph 3, of Legislative Decree No. 150 of September 1, 2011, provided for the filing of an appeal as indicated below; ORDERS — pursuant to Article 17 of Regulation No. 1/2019, that the violations and the measures adopted in accordance with Article 58, para 2, of the Regulation be recorded in the Authority’s internal register provided for in Article 57, para 1, letter u), of the Regulation. - pursuant to Article 154-bis, paragraph 3, of the Code and Article 37 of the Data Protection Authority’s Regulation No. 1/20129, the publication of this decision on the Authority’s website; - Pursuant to Article 166, paragraph 7, of the Code and Article 16, paragraph 1, of the Data Protection Authority’s Regulation No. 1/20129, the publication of the injunction order on the Data Protection Authority’s website. Pursuant to Article 78 of the Regulation, as well as Article 152 of the Code and Article 10 of Legislative Decree No. 150/2011, an objection to this order may be filed with the ordinary courts by filing an appeal with the ordinary court of the jurisdiction specified in the aforementioned Art 10, within thirty days from the date of notification of the order, or within sixty days if the appellant resides abroad. Rome, October 7, 2026 THE CHAIRMAN Stanzione THE RAPPORTEUR Stanzione THE SECRETARY GENERAL Montuori