Italian DPA investigates Deutsche Bank and Poste Italiane over unlawful loan data

SEE ALSO Newsletter No. 554 of October 23, 2026 [Web Doc. No. 10310707] Decision of October 7, 2026 Register of Decisions No. 747 of October 7, 2026 THE DATA PROTECTION AUTHORITY AT today’s meeting, attended by Prof. Pasquale Stanzione, President; Prof. Ginevra Cerrina Feroni, Vice President; Dr. Agostino Ghiglia; and Dr. Luigi Montuori, Secretary General; HAVING REGARD TO Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016 (hereinafter, the “Regulation”); HAVING REGARD TO the Code on Data Protection, containing provisions for the adaptation of national law to Regulation (EU) 2016/679 (Legislative Decree No. 196 of June 30, 2003, as amended by Legislative Decree No. 101 of August 10, 2018, hereinafter the “Code”); HAVING REGARD TO the complaint filed pursuant to Art. 77 of the Regulation by Ms. XX, domiciled at the office of XX, against Poste Italiane S.p.A.; HAVING EXAMINED the documentation on file; HAVING CONSIDERED the observations made by the Secretary General pursuant to Art. 15 of the Data Protection Authority’s Regulation No. 1/2000; RAPPORTEUR: Prof. Pasquale Stanzione; PREAMBLE 1. Complaint. In a complaint filed on January 5, 2024, the complainant, an employee of Poste Italiane (hereinafter also referred to as “Poste” or the “Company”), represented that, following a loan application submitted to Deutsche Bank (hereinafter also referred to as the “Bank”) —via the portal made available by the Bank to Poste for its employees—the Bank “when denying the loan, entered into the platform (accessible to all Poste Italiane S.p.A. staff responsible for managing loan applications, as well as to all staff accessing the system via the workstation of the manager of the Portacomaro Stazione Post Office—Municipality of Asti)—information stating that the applicant” had outstanding financial obligations, specifying the relevant amount and the net income received by the data subject. The complainant also specified that the form, published on the Poste portal and to be completed for the submission of the loan application, “does not include a field for entering the applicant’s salary amount, as this information is, by convention, provided directly by Poste Italiane S.p.A.” and that, in the disclosure provided, the Bank states that “it will not disclose to Poste the credit information and personal data found in the SIC CRIF [Credit Information Systems, hereinafter SIC], but will transmit only the outcome of the verification […] to Poste, which, in its capacity as an external processor, will communicate it to the Applicant.” Following the requests submitted to Deutsche Bank and Poste, in which the data subject contested the processing of her data and requested its erasure, the companies provided responses, which the data subject deemed unsatisfactory. Given that the Office, based on a preliminary review of the complaint and the related documentation, deemed it necessary—in order to fully investigate the matter—to initiate a preliminary inquiry, not only against Deutsche Bank but also against Poste (the entity against which the data subject had not chosen to file a complaint), by a letter dated January 29, 2024 (Ref. No. 11166), it invited the complainant to indicate her interest in proceeding with the complaint against Poste as well—her own employer—a circumstance which the complainant confirmed in a letter dated February 12, 2024. 2. The Preliminary Investigation Conducted. The Office then launched a comprehensive preliminary investigation into Deutsche Bank and Poste, sending specific requests for information, pursuant to Art. 157 of the Code, in order to obtain information and documentation useful for clarifying the contractual relationships between the aforementioned companies and the roles they play, for privacy purposes, as well as the methods of data processing related to loan applications and the data exchanged between the Bank and Poste. Following the request for information sent on July 23, 2024 (Ref. No. 90736), Poste, in a letter dated August 7, 2024, requested an extension of the previously set deadline for submitting the requested clarifications. The Office granted the request, based on the reasons stated therein, and set the deadline for September 12, 2024 (letter No. 104376 dated September 4, 2024). In a letter dated September 12, 2024, Poste, in recounting the facts of the complaint, stated that it had proceeded “without delay […] in consultation with the Bank, […] to carry out the erasure of the reported data from the company’s filing system,” notifying the data subject, to whom it had also been made clear “that all Poste Italiane employees who, in the performance of their duties, had accessed the loan file were authorized to perform data processing and had been duly trained in this regard.” With regard to the additional aspects covered by the request for information, Poste Italiane stated the following concerning the requested details: - regarding the respective roles of Deutsche Bank S.p.A. and Poste Italiane S.p.A., the lending activities carried out in this context are governed by the “BancoPosta Loan Agreement,” signed between the Bank and Poste Italiane; - “the processing of personal data […] of data subjects applying for a BancoPosta Loan is carried out by the Bank and by Poste Italiane in their capacity as independent controllers. However: - with regard to Poste Italiane’s communication to the Bank of the assessment criteria for the loan applicant, the Bank acts as a processor on behalf of Poste Italiane in relation to the Data communicated by the latter; - with regard to the Bank’s transmission to Poste Italiane of the outcome of the preliminary review of the loan application, Poste Italiane acts as a processor on behalf of the Bank with respect to the Data communicated by the Bank”; - loan applications are processed through an independent IT system operated by Poste Italiane, which is linked to the Bank’s system for the purpose of integrating data flows; - Data is collected directly from the data subjects at the time of the loan application. “The following information provided by the Bank to Poste Italiane is an exception to this rule: - “pre-scoring” assessment of the loan application; - status of the loan application”; as well as “the information provided by Poste Italiane to the Bank, consisting of a score calculated by aggregating indicators derived from existing financial relationships with Poste Italiane itself and therefore based on information already present in Poste Italiane’s filing system”; - following the creditworthiness assessment of the data subjects—which “can only be performed by the Bank and falls fully and exclusively within the Bank’s prerogatives”—the Bank also communicates the “application statuses” to Poste Italiane: “- application uploaded, in progress (at the Bank or Poste Italiane), or ready for approval; - application approved; - application rejected.” As part of the parallel investigation conducted against the Bank, the Office obtained the documents and clarifications necessary for its assessments, including those related to the data processing carried out by Poste Italiane and Deutsche Bank on September 12, 2024, and March 18, 2025. 3. Initiation of the proceedings. Based on the evidence gathered during the preliminary investigation from Poste and the Bank, the Office notified Poste, via letter ref. no. 99987 dated July 16, 2025, the notice initiating proceedings for the adoption of the measures referred to in Articles 58(2) and 83 of the Regulation, in accordance with the provisions of Article 166, paragraph 5, regarding the correct identification of the actual controller responsible for data processing, as well as the principles of lawfulness and transparency with respect to the information provided to data subjects in the context of the collaborative relationship with the Bank (Articles 5(1)(a), 13, and 28 of the GDPR). In a letter dated August 1, 2025, Poste requested an extension to file its defense briefs pursuant to Art. 13, paragraph 3, of the Data Protection Authority’s Regulation No. 1/2019 (concerning internal procedures with external relevance, aimed at carrying out the tasks and exercising the powers entrusted to the Data Protection Authority), which the Office granted, setting the deadline for September 15, 2025 (letter No. 109001 dated August 5, 2025). In its defense briefs filed on September 15, 2025, Poste provided clarifications regarding the issues in dispute. In particular, with regard to the privacy notice: - given that “the processing does not present any particular or anomalous characteristics compared to the typical processing carried out not only by the Company,” but also by other entities operating “in the context of the management and brokerage of loan applications,” in order to avoid violating the requirements regarding concise and transparent information (Article 12, paragraph 1 of the GDPR and the “Guidelines on Transparency under Regulation 2016/679” adopted by the Art 29 Working Party for Data Protection) and “the risk of information overload,” Poste has decided to “prioritize a concise approach in providing the information referred to in Article 13 of the Regulation”; - with this in mind, it decided to “prioritize efficiency, in order to increase the likelihood that the Complainant would actually read and analyze the Privacy Notice with due attention” rather than “effectiveness (i.e., providing the Complainant with an extremely detailed privacy notice regarding the individual aspects of the processing), […]—taking into account the standardized nature of the processing and the simultaneous delivery to the Complainant of an already substantial body of documentation related to the loan application”; - in emphasizing that “the content and methods of providing data subjects with information on the processing of personal data must be defined on a case-by-case basis by the controller, based on the principles of accountability and data protection by design—as well as a risk-based approach—as defined in the Regulation” it stated that in the case at hand, “having identified a concrete risk of so-called ‘privacy fatigue’ (understood as a sense of discouragement and psychological fatigue on the part of the data subject regarding the complexity and volume of materials to review and the obligations to manage in relation to data protection)—it was deemed appropriate to draft the Privacy Notice in more general and concise terms, yet in a manner that is more immediately accessible;. - “without this in any way constituting an assumption of accountability in this regard,” it stated that in 2025 it had updated the privacy notice to include “a more granular description of the processing of customers’ personal data carried out by the Company” and that it is in the process of finalizing “a draft of a specific privacy notice regarding the processing of personal data carried out in the context of credit intermediation activities.” With regard to the respective roles, Poste stated, concerning the designation of Deutsche Bank as the processor, that: - “the appointment of the Bank as a processor was the result of an assessment conducted by the Bank itself and by the Company during the initial phase of implementing the Regulation and under conditions of significant legal uncertainty”; - “even if an erroneous identification of the roles in the processing were to be confirmed, it must be regarded as the result of an error in legal analysis committed by the Bank and the Company in total good faith and in the absence of a clear, established, and unequivocal reference practice for application and/or decision-making on the matter”; - that it has initiated, “without this in any way constituting an assumption of accountability in this regard […] a working group with the Bank to revise the existing contractual agreements regarding data protection and, consequently, to remove the Bank’s designation as a processor.” Regarding the role played by Poste as a processor, which: - falls within the “activities entrusted to the credit intermediary (i.e., the Company) by the lender (i.e., the Bank), namely the task of clarifying and explaining to the data subject the reasons for the rejection of the loan application”; - this approach appears to be in line with consumer credit regulations (Art. 121, para. 1, subpar. h) of Legislative Decree No. 385 of September 1, 1993), according to which “in credit intermediation activities, the presentation or proposal of credit agreements or the performance of other preparatory activities in view of the conclusion of such agreements. In other words, the credit intermediation activities carried out by the Company in its capacity as Processor on behalf of the Bank included—and continue to include—an indispensable advisory component consisting of support for the interested customer: - in preparing a loan application; - in analyzing and understanding the reasons for any rejection of the application; - in identifying the possibility of submitting a new application by including elements that could increase the likelihood of approval (for example, adding new personal or collateral guarantees) or by selecting other credit solutions better suited to the characteristics of the data subject; - in processing the data provided by the Bank “did not exceed the scope defined in the appointment as Processor issued by the Bank itself, as the activities of consulting, analyzing the reasons for the rejection of loan applications, and identifying possible alternative solutions constitute the typical functional elements of credit intermediation.” 4. The outcome of the preliminary investigation and the proceedings for the adoption of corrective and sanctioning measures pursuant to Art 58, para 2, of the Regulation. As a preliminary matter, it should be noted that this preliminary investigation, although initiated in response to a complaint, was subsequently expanded ex officio to examine certain aspects relating, more generally, to the processing of data subjects’ personal data in the context of the promotion and placement of the “BancoPosta Product.” During the investigation, the Office noted, first of all, that Poste, in consultation with the Bank, had carried out the erasure of the data subject’s information and promptly informed her of this action. As for the general aspects of the data processing under review, these concerned: the respective roles played by Poste and the Bank, the data exchanged between them, and the privacy notice provided to data subjects pursuant to Art. 13 of the GDPR. That said, following the preliminary investigation and taking into account the statements made by Poste during the proceedings (for the accuracy of which the author is liable pursuant to and for the purposes of Art. 168 of the Code “False statements to the Data Protection Authority and suspension of the Authority’s duties or powers”), as well as the documentation included in the case file—including that provided by Deutsche Bank— and noting that the clarifications provided by Poste in its defense briefs submitted on September 15, 2025, have offered a clearer and more complete picture of the various stages of the credit disbursement process associated with the BancoPosta product and the processing of data subjects’ information in this context, the following is stated. With regard to the privacy notice, it is noted, first of all, that the principle of transparency established by Art. 5(1), subparagraph (a) of the GDPR is not purely formal in nature, nor does it constitute a mere bureaucratic formality; rather, it enshrines the data subject’s right to clearly understand all aspects related to the processing of their data. The choice of the methods by which the controller provides the privacy notice to data subjects and the content thereof falls within the “discretionary assessment made by the Company based on the principle of accountability.” In its briefs, Poste stated that, wishing to avoid “making the Privacy Notice itself too verbose,” […] it consciously decided not to proceed” with a more detailed and extensive description of the processing, prioritizing efficiency—that is, a notice that is easy and immediately understandable for data subjects—over effectiveness, which would consist of “an extremely detailed notice regarding the individual aspects of the processing.” It is essential to emphasize that the decision to draft a privacy notice in accordance with Art. 12(1) of the GDPR—and thus concise and transparent—certainly implies that it must be structured in a clear and succinct manner, avoiding an excess of information that would compromise its comprehensibility. At the same time, however, the privacy notice must be effective—that is, capable of making the data subject truly aware of the processing of their data, the related purposes, the possible risks, the safeguards provided, and the ways in which they can exercise control over the flow of information concerning them. The application of the principles of “conciseness” and completeness are not, in fact, alternative requirements; for the privacy notice to be considered adequate, both must be met; therefore, choosing to prioritize one aspect over the other does not satisfy the required standards. The controller is, in fact, required to provide the data subject with the “information necessary to ensure fair and transparent processing, taking into account the specific circumstances and context in which the personal data are processed” (Recital 60 of the GDPR), a principle also highlighted in the Guidelines on Transparency pursuant to Regulation 2016/679, which stipulate that the information must be concrete and “should not be formulated in abstract terms.” Moreover, the provisions of the Bank of Italy concerning “Transparency of Banking and Financial Transactions and Services” of July 29, 2009, as amended, as amended, which, in defining the information that banks must provide to data subjects, require that such information be provided “in a correct, clear, and comprehensive manner, as well as appropriate […] to the characteristics of the services and the clientele.” With regard to the respective roles played by the Bank and Poste Italiane in order to properly contextualize the matter, it is deemed appropriate to refer to the provisions contained in Presidential Decree No. 144 of March 14, 2001 (Regulation on the Simplification of Bancoposta Services), which established the governing rules for Poste Italiane S.p.A.’s financial activities with the public. The aforementioned Regulation prohibits Poste from granting loans to the public and permits it to engage in the promotion and placement of banking and financial products and services off-premises, acting as an intermediary on behalf of banks and financial companies—which serve as the lenders—whose relationships are governed by specific agreements and conventions (Art. 2, paragraphs 8 and 9-bis of the aforementioned Presidential Decree) From the context outlined above, it is clear that the duties and accountability that fall upon Poste and the Bank, while interrelated, are different and distinct, including with regard to the contractual relationship that each maintains with the data subject. This is confirmed by the evidence gathered during the preliminary investigation, an examination of which reveals that, during the loan application and verification phase, Poste collects and verifies the data of the data subjects and any co-obligors, including for the purpose of matching the financial product that best meets the applicant’s needs and financial capacity; it then transmits the data to the Bank, including—where the application comes from a checking account holder—the transmission, in aggregated form, of indicators generated by existing relationships with Poste (average balance, checking account balance, etc.); finally, upon completion of the preliminary review, it notifies the data subject of the outcome of the request. The Bank, as the lender, conducts the preliminary review to assess the data subject’s creditworthiness; based on the outcome of this review, it decides whether to grant or deny the loan, a decision that is “subject to the Bank’s sole, discretionary, and unquestionable judgment,” (see “Data Verification Form for Loan Application”); once its decision has been made, the Bank forwards the outcome of the application to Poste so that it may communicate it to the loan applicant. The Bank, in accordance with the sector’s regulatory framework (Articles 120-undecies, paragraph 1, and 124-bis, paragraph 1, of the Consolidated Banking Law, hereinafter TUB), therefore carries out the activities typical of a lender, in relation to which it determines the purposes and means of the processing, thereby acting as an independent controller pursuant to Article 4, No. 7 of the Regulation. At the same time, Poste retains independent data controller status within the context of its separate relationship with the data subject, acting as an intermediary and maintaining an independent relationship with the data subject, which continues even following a potential negative assessment by the Bank, following which Poste may propose other financing solutions (by approaching other banks) better suited to the customer’s needs and credit situation. It follows from the foregoing that, even during the exchange of data subjects’ information, the Companies act as independent controllers, since each operates on the basis of separate contractual relationships with the customer, within the limits of what is necessary for the performance of a contract to which the data subject is a party or for the implementation of precontractual measures taken at the data subject’s request (Art. 6(1)(b) of the Regulation). Based on the information obtained, it appears that Poste operates within the framework of a separate relationship with the data subject and processes the personal data pertaining to the data subject for its own purposes related to brokerage activities, while, for its part, the Bank independently determines the processing purposes and essential means related to the assessment of the data subject’s creditworthiness—for which it must receive from Poste the data concerning the loan applicant—and exclusively makes the decision regarding whether to grant or deny the loan. It follows, therefore, that the processing activities carried out by Poste and the Bank, including the disclosure of data relating to the loan applicant, are not performed by one party on behalf of the other, but fall within the limits of what is necessary for the performance of their respective contractual relationships or the precontractual measures requested by the data subject (Article 6(1)(b) of the Regulation), without prejudice to the independent accountability of each controller regarding the lawfulness, fairness, transparency, and relevance of the processing carried out. This approach is also confirmed by the “Guidelines 07/2020 on the concepts of controller and processor under the GDPR” adopted by the EDPB on July 7, 2021. In fact, these guidelines, while emphasizing that the role of “controller” is based on a factual rather than a formal analysis,” clarify that “The roles of controller and processor are functional concepts: they aim to allocate accountability according to the roles actually performed. This implies that the legal status of a person as a ‘controller’ or ‘processor’ must, in principle, be determined by the activities actually carried out in a specific situation, rather than by their formal designation as a ‘controller’ or ‘processor’ (for example, in a contract)” (see point 12 of the aforementioned Guidelines). In light of this conclusion, it must be held that the decision by Poste and the Bank to designate each other as processors (pursuant to Article 28 of the Regulation) during the phase of communicating the personal data of data subjects—although it reflects specific choices made by them and documented in “Agreements” signed by both—does not correspond to the statutory provision according to which the processor is the entity “that processes personal data on behalf of the controller” (Art 4(8) of the Regulation) and who “is required to follow the instructions given by the controller […] regarding the processing purpose and the essential elements constituting the means thereof” (see EDPB, Guideline No. 07/2020, cit., p. 28), nor is it supported by a factual assessment of the relationship, which instead shows that the disclosure of information is not carried out by one party in the interest of the other, but rather by each party for its own purposes, as necessary for the performance of their respective contractual relationships or the precontractual measures requested by the data subject; it follows, therefore, that the Parties act as independent controllers of processing. The subjective characterization proposed by Poste and the Bank does not, therefore, correspond to the factual reality of the processing, with immediate repercussions also on the compliance of the privacy notice provided to data subjects with data protection regulations, pursuant to Art 13 of the Regulation. In fact, in the present case, the privacy notice is not adequately formulated, given that, with regard to the processing of data subjects’ personal data carried out in connection with the promotion and placement of the “BancoPosta Product,” it should have specified the recipients or categories of recipients of the data subjects’ personal data (Article 13(1)(e) of the Regulation) and provide additional information to ensure, in accordance with the general principles set forth in Article 5 of the Regulation, fair and transparent processing with respect to the data subjects. In light of the foregoing Recitals, and for all the reasons set forth above, it appears that the data controller engaged in conduct contrary to Article 5(1)(a) and Article 13 of the Regulation with respect to the information provided to data subjects. 5. Conclusions: Declaration that the processing is unlawful. Corrective measures pursuant to Art. 58(2) of the Regulation. In light of the overall findings, the Authority considers that the statements, documentation, and accounts obtained during the preliminary investigation do not sufficiently address the objections notified by the Office in the notice initiating the proceedings and that they are, therefore, insufficient to warrant dismissal of the case, as none of the circumstances provided for in Art. 11 of the Data Protection Authority’s Regulation No. 1/2019 apply. The processing of personal data carried out by Poste is, in fact, unlawful under the terms set forth, with regard to the violation of the principles of fairness and transparency, as it was carried out in violation of Articles 5(1)(a) and 13 of the Regulation. The violation of the aforementioned provisions entails the imposition of the administrative sanction provided for in Art. 83(5)(a) and (b) of the Regulation. With regard to the exercise of the corrective powers referred to in Art. 58, para 2, of the Regulation, the Authority takes note of the statements made by Poste Italiane S.p.A. in its briefs regarding the fact that it has already taken certain measures to bring the data processing carried out in this context into compliance with the regulatory framework described above. 6. Adoption of the injunction ordering the imposition of the administrative fine and ancillary sanctions (Articles 58, para 2, subparagraph i), and 83 of the Regulation; Article 166, para 7, of the Code). The Data Protection Authority, pursuant to Art. 58, para 2, subparagraph (i) of the Regulation and Article 166 of the Code, has the power to impose an administrative fine provided for in Article 83, para 5, of the Regulation, through the adoption of an injunction order (Article 18. Law No. 689 of November 24, 1981), in connection with the processing of personal data carried out by Poste Italiane S.p.A., which has been found to be unlawful, as set forth above. With regard to the factors listed in Article 83(2) of the Regulation for the purposes of imposing the administrative fine and determining its amount—taking into account that the fine must “in any event [be] effective, proportionate, and dissuasive” (Article 83(1) of the Regulation), it is noted that, in the present case, the following circumstances were taken into account: - With regard to the severity of the violations, their nature was considered significant, as they concerned non-compliance with the general principles of data processing, and in particular the principles of fairness and transparency regarding the content of the information provided to data subjects —that is, all customers who applied for a loan related to products offered by BancoPosta—to have accurate and transparent information regarding the processing of their data (Art. 83(2)(a) of the Regulation); - with regard to the subjective element, consideration was given to the negligent nature of the violation, attributable to an erroneous interpretation of the respective roles played during certain stages of the BancoPosta loan application process (Art. 83(2)(b) of the Regulation); - the fact that Poste voluntarily adopted a set of measures designed to mitigate or eliminate the consequences of the violation (Articles 83(2)(c) and 83(para) of the Regulation), such as: the erasure of the data subject’s data, promptly informing the data subject; updating the privacy notice to include a more detailed and clear description of the processing activities carried out; establishing a working group with the Bank to review existing contractual agreements and “consequently remove the Bank’s status […] as a processor”; - the absence of previous decisions by the Authority against Poste regarding the same type of case, as well as the absence of complaints similar to the one that is the subject of this decision (Articles 83(2)(e) and 83(para) of the Regulation); - the fact that Poste Italiane S.p.A. cooperated effectively with the Authority during the proceedings (Articles 83(2)(f) and 83(para) of the Regulation). In light of the above factors and the assessments made, it is deemed appropriate, in this case, to impose on Poste Italiane S.p.A. an administrative fine in the amount of 48,000.00 euros (forty-eight thousand euros). Finally, it is considered that the conditions set forth in Article 17 of the Data Protection Authority’s Regulation No. 1/2019 are met. NOW THEREFORE, THE DATA PROTECTION AUTHORITY pursuant to Articles 57(1)(f) and 83 of the Regulation, finds that the processing carried out by Poste Italiane S.p.A., in the person of its pro tempore legal representative, with registered office in Rome, Viale Europa 190, Tax ID No. 01114601006, under the terms set forth in the reasoning, for the violation of Articles 5(1)(a) and 13 of the Regulation; ORDERS pursuant to Article 58, para 2, subparagraph i), of the Regulation, that Poste Italiane S.p.A. pay the sum of 48,000.00 euros (forty-eight thousand/00) as an administrative fine for the violations indicated in this order; DIRECTS Poste Italiane S.p.A. to pay the aforementioned sum of 48,000.00 euros (forty-eight thousand euros/00) in accordance with the procedures set forth in the attachment, within thirty days of the service of this order, failing which the necessary enforcement measures will be taken pursuant to Art. 27 of Law No. 689/1981. It is noted that the offender retains the right to settle the dispute by paying—again in accordance with the procedures set forth in the attachment—an amount equal to half of the imposed penalty, within the time limit set forth in Article 10, paragraph 3, of Legislative Decree No. 150 of September 1, 2011, provided for the filing of an appeal as indicated below; ORDERS — pursuant to Art. 17 of the Data Protection Authority’s Regulation No. 1/2019, that the violations and the measures adopted in accordance with Article 58(2) of the Regulation be recorded in the Authority’s internal register provided for in Article 57(1)(u) of the Regulation. - pursuant to Article 154-bis, paragraph 3, of the Code and Article 37 of the Data Protection Authority’s Regulation No. 1/20129, the publication of this decision on the Authority’s website; - Pursuant to Article 166, paragraph 7, of the Code and Article 16, paragraph 1, of the Data Protection Authority’s Regulation No. 1/20129, the publication of the injunction order on the Data Protection Authority’s website. Pursuant to Article 78 of the Regulations, as well as Article 152 of the Code and Article 10 of Legislative Decree No. 150/2011, an appeal against this order may be filed with the ordinary courts by submitting a petition to the ordinary court of the jurisdiction specified in the aforementioned Art 10, within thirty days from the date of notification of the order, or within sixty days if the appellant resides abroad. Rome, October 7, 2026 THE PRESIDENT Stanzione THE RAPPORTEUR Stanzione THE SECRETARY GENERAL Montuori SEE ALSO Newsletter No. 554 of October 23, 2026 [Web Doc. No. 10310707] Decision of October 7, 2026 Register of Decisions No. 747 of October 7, 2026 THE DATA PROTECTION AUTHORITY AT today’s meeting, attended by Prof. Pasquale Stanzione, Chair; Prof. Ginevra Cerrina Feroni, Vice Chair; Dr. Agostino Ghiglia; and Dr. Luigi Montuori, Secretary General; HAVING REGARD TO Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016 (hereinafter, the “Regulation”); HAVING REGARD TO the Code on Data Protection, containing provisions for the adaptation of national law to Regulation (EU) 2016/679 (Legislative Decree No. 196 of June 30, 2003, as amended by Legislative Decree No. 101 of August 10, 2018, hereinafter the “Code”); HAVING REGARD TO the complaint filed pursuant to Article 77 of the Regulation by Ms. XX, with her address on file at the office of XX, against Poste Italiane S.p.A.; HAVING EXAMINED the documentation in the case file; HAVING CONSIDERED the observations submitted by the Secretary General pursuant to Art. 15 of the Data Protection Authority’s Regulation No. 1/2000; RAPPORTEUR: Prof. Pasquale Stanzione; PREAMBLE 1. Complaint. In a complaint filed on January 5, 2024, the complainant, an employee of Poste Italiane (hereinafter also referred to as “Poste” or the “Company”), represented that, following a loan application submitted to Deutsche Bank (hereinafter also referred to as the “Bank”) —via the portal made available by the Bank to Poste for its employees—the Bank “when denying the loan, entered into the platform (accessible to all Poste Italiane S.p.A. staff responsible for managing loan applications, as well as to all staff accessing it via the workstation of the director of the Portacomaro Stazione Post Office—Municipality of Asti)—information stating that the applicant” had outstanding financial obligations, specifying the relevant amount and the net income received by the data subject. The complainant also specified that the form, published on the Poste portal and to be completed for the submission of the loan application, “does not include a field for entering the applicant’s salary amount, as this information is, by convention, provided directly by Poste Italiane S.p.A.” and that, in the disclosure provided, the Bank states that “it will not disclose to Poste the credit information and personal data found in the SIC CRIF [Credit Information Systems, hereinafter SIC], but will transmit only the outcome of the verification […] to Poste, which, in its capacity as an external processor, will communicate it to the Applicant.” Following the requests submitted to Deutsche Bank and Poste, in which the data subject contested the processing of her data and requested its erasure, the companies provided responses, which the data subject deemed unsatisfactory. Given that the Office, based on a preliminary review of the complaint and the related documentation, deemed it necessary—in order to fully investigate the matter—to initiate a preliminary inquiry, not only against Deutsche Bank but also against Poste (the entity against which the data subject had not chosen to file a complaint), by a letter dated January 29, 2024 (Ref. No. 11166), it invited the complainant to indicate her interest in proceeding with the complaint against Poste as well—her own employer—a circumstance which she confirmed in a letter dated February 12, 2024. 2. The Preliminary Investigation Conducted. The Office then launched a comprehensive preliminary investigation into Deutsche Bank and Poste, sending specific requests for information, pursuant to Art. 157 of the Code, in order to obtain information and documentation useful for clarifying the contractual relationships between the aforementioned companies and the roles they play, for privacy purposes, as well as the methods of data processing related to loan applications and the data exchanged between the Bank and Poste. Following the request for information sent on July 23, 2024 (Ref. No. 90736), Poste, in a letter dated August 7, 2024, requested an extension of the previously set deadline for submitting the requested clarifications. The Office granted the request, based on the reasons stated therein, and set the deadline for September 12, 2024 (letter No. 104376 dated September 4, 2024). In a letter dated September 12, 2024, Poste, in recounting the facts of the complaint, stated that it had proceeded “without delay […] in consultation with the Bank, […] to carry out the erasure of the reported data from the company’s filing systems,” notifying the data subject, to whom it had also been made clear “that all Poste Italiane employees who, in the course of their duties, had accessed the loan file were authorized persons for data processing and had been duly trained in this regard.” With regard to the additional aspects covered by the request for information, Poste Italiane stated the following concerning the requested details: - regarding the respective roles of Deutsche Bank S.p.A. and Poste Italiane S.p.A., the lending activities carried out in this context are governed by the “BancoPosta Loan Agreement,” signed between the Bank and Poste Italiane; - “the processing of personal data […] of data subjects applying for a BancoPosta Loan is carried out by the Bank and by Poste Italiane in their capacity as independent controllers. However: - with regard to Poste Italiane’s communication to the Bank of the assessment criteria for the loan applicant, the Bank acts as a processor on behalf of Poste Italiane in relation to the Data communicated by the latter; - with regard to the Bank’s transmission to Poste Italiane of the outcome of the preliminary review of the loan application, Poste Italiane acts as a processor on behalf of the Bank with respect to the Data communicated by the Bank”; - loan applications are processed through an independent IT system operated by Poste Italiane, which is linked to the Bank’s system for the purpose of integrating data flows; - Data is collected directly from the data subjects at the time of the loan application. “The following information provided by the Bank to Poste Italiane is an exception to this rule: - “pre-scoring” assessment of the loan application; - status of the loan application”; as well as “the information provided by Poste Italiane to the Bank, consisting of a score calculated by aggregating indicators derived from existing financial relationships with Poste Italiane itself and therefore based on information already present in Poste Italiane’s filing system”; - following the creditworthiness assessment of the data subjects—which “can only be performed by the Bank and falls fully and exclusively within the Bank’s prerogatives”—the Bank also communicates to Poste Italiane the “application statuses”: “- application uploaded, in progress (at the Bank or Poste Italiane), or ready for approval; - application approved; - application rejected.” As part of the parallel investigation conducted against the Bank, the Office obtained the documents and clarifications necessary for its assessments, including those related to the data processing carried out by Poste Italiane and Deutsche Bank on September 12, 2024, and March 18, 2025. 3. Initiation of the proceedings. Based on the evidence gathered during the preliminary investigation from Poste and the Bank, the Office served Poste, by letter ref. no. 99987 dated July 16, 2025, the notice initiating proceedings for the adoption of the measures referred to in Articles 58(2) and 83 of the Regulation, in accordance with the provisions of Article 166, paragraph 5, regarding the correct identification of the actual controller of data processing, as well as the principles of lawfulness and transparency with respect to the information provided to data subjects within the framework of the collaborative relationship with the Bank (Articles 5(1)(a), 13, and 28 of the GDPR). In a letter dated August 1, 2025, Poste requested an extension to file its defense briefs pursuant to Article 13, paragraph 3, of the Data Protection Authority’s Regulation No. 1/2019 (concerning internal procedures with external relevance, aimed at carrying out the tasks and exercising the powers entrusted to the Data Protection Authority), which the Office granted, setting the deadline for September 15, 2025 (letter No. 109001 dated August 5, 2025). In its defense briefs filed on September 15, 2025, Poste provided clarifications regarding the issues in dispute. In particular, with regard to the privacy notice: - given that “the processing does not present any particular or anomalous characteristics compared to the typical processing carried out not only by the Company,” but also by other entities operating “in the context of the management and brokerage of loan applications,” in order to avoid violating the requirements regarding concise and transparent information (Article 12, paragraph 1 of the GDPR and the “Guidelines on Transparency under Regulation 2016/679” adopted by the Art 29 Working Party for Data Protection) and “the risk of information overload,” Poste has decided to “prioritize a concise approach in providing the information referred to in Art 13 of the Regulation”; - with this in mind, it decided to “prioritize efficiency, in order to increase the likelihood that the Complainant would actually read and analyze the Privacy Notice with due attention” rather than “effectiveness (i.e., providing the Complainant with an extremely detailed privacy notice regarding the individual aspects of the processing), […]—taking into account the standardized nature of the processing and the simultaneous delivery to the Complainant of an already substantial body of documentation related to the loan application”; - in emphasizing that “the content and methods of providing data subjects with information on the processing of personal data must be defined on a case-by-case basis by the controller, based on the principles of accountability and data protection by design—as well as a risk-based approach—as defined in the Regulation” it stated that in the case at hand, “having identified a concrete risk of so-called ‘privacy fatigue’ (understood as a sense of discouragement and psychological fatigue on the part of the data subject regarding the complexity and volume of materials to review and the obligations to manage in relation to data protection)—it was deemed appropriate to draft the Privacy Notice in more general and concise terms, yet in a manner that is more immediately accessible;. - “without this in any way constituting an assumption of accountability in this regard,” it stated that in 2025 it had updated the privacy notice to include “a more granular description of the Company’s processing of customers’ personal data” and that it is in the process of finalizing “a draft of a specific privacy notice regarding the processing of personal data carried out in the context of credit intermediation activities.” With regard to the respective roles, Poste stated, concerning the designation of Deutsche Bank as the processor, that: - “the appointment of the Bank as a processor was the result of an assessment conducted by the Bank itself and by the Company during the initial phase of implementing the Regulation and under conditions of significant legal uncertainty”; - “even if an erroneous identification of the roles in the processing were to be confirmed, it must be regarded as the result of an error in legal analysis committed by the Bank and the Company in total good faith and in the absence of a clear, established, and unequivocal reference practice for application and/or decision-making on the matter”; - that it has initiated, “without this in any way constituting an assumption of accountability in this regard […] a working group with the Bank to revise the existing contractual agreements regarding data protection and, consequently, to remove the Bank’s designation as a processor.” Regarding the role played by Poste as a processor, which: - falls within the “activities entrusted to the credit intermediary (i.e., the Company) by the lender (i.e., the Bank), namely the task of clarifying and explaining to the customer concerned the reasons for the rejection of the loan application”; - this approach appears to be in line with consumer credit regulations (Art. 121, para. 1, subpar. h) of Legislative Decree No. 385 of September 1, 1993), according to which “in credit intermediation activities, the presentation or proposal of credit agreements or the performance of other preparatory activities in view of the conclusion of such agreements. In other words, the credit intermediation activities carried out by the Company in its capacity as Processor on behalf of the Bank included and continue to include an indispensable advisory component consisting of support for the interested customer: - in preparing a loan application; - in analyzing and understanding the reasons for any rejection of the application; - in identifying the possibility of submitting a new application by including elements that could increase the likelihood of approval (for example, adding new personal or collateral guarantees) or by selecting other credit solutions better suited to the characteristics of the data subject; - in processing the data provided by the Bank “did not exceed the scope defined in the appointment as Processor issued by the Bank itself, as the activities of consulting, analyzing the reasons for the rejection of loan applications, and identifying possible alternative solutions constitute the typical functional elements of credit intermediation.” 4. The outcome of the preliminary investigation and the proceedings for the adoption of corrective and sanctioning measures pursuant to Article 58, para 2, of the Regulation. As a preliminary matter, it should be noted that this preliminary investigation, although initiated in response to a complaint, was subsequently expanded ex officio to examine certain aspects relating, more generally, to the processing of data subjects’ personal data in the context of the promotion and placement of the “BancoPosta Product.” During the investigation, the Office noted, first of all, that Poste, in coordination with the Bank, had carried out the erasure of the data subject’s information and promptly informed her of this action. As for the general aspects of the data processing under review, these concerned: the respective roles played by Poste and the Bank, the data exchanged between them, and the privacy notice provided to data subjects pursuant to Art. 13 of the GDPR. That said, following the preliminary investigation and taking into account the statements made by Poste during the proceedings (for the accuracy of which the author is liable pursuant to and for the purposes of Art. 168 of the Code “False statements to the Data Protection Authority and suspension of the Authority’s duties or powers”), as well as the documentation included in the case file—including that provided by Deutsche Bank— and noting that the clarifications provided by Poste in its defense briefs submitted on September 15, 2025, have offered a clearer and more complete picture of the various stages of the credit disbursement process associated with the BancoPosta product and the processing of data subjects’ information in that context, the following is stated. With regard to the privacy notice, it is noted, first of all, that the principle of transparency established by Art. 5(1), subparagraph (a) of the GDPR is not purely formal in nature, nor is it a mere bureaucratic formality; rather, it enshrines the data subject’s right to clearly understand all aspects related to the processing of their data. The choice of the methods by which the controller provides the privacy notice to data subjects and the content thereof falls within the “discretionary assessment made by the Company based on the principle of accountability.” In its briefs, Poste stated that, in order to avoid “making the Privacy Notice itself too verbose,” […] it consciously decided not to proceed” with a more detailed and extensive description of the processing, prioritizing efficiency—that is, a notice that is easy and immediately understandable for data subjects—over effectiveness, which would consist of “an extremely detailed notice regarding the individual aspects of the processing.” It is essential to emphasize that the decision to draft a privacy notice in accordance with Art. 12(1) of the GDPR—and thus concise and transparent—certainly implies that it must be structured in a clear and succinct manner, avoiding an excess of information that would compromise its comprehensibility. At the same time, however, the privacy notice must be effective—that is, capable of making the data subject truly aware of the processing of their data, the related purposes, the possible risks, the safeguards provided, and the ways in which they can exercise control over the flow of information concerning them. The application of the principles of “conciseness” and completeness are not, in fact, alternative requirements; for the privacy notice to be considered adequate, both must be met; therefore, choosing to prioritize one aspect over the other does not satisfy the required standards. The controller is, in fact, required to provide the data subject with the “information necessary to ensure fair and transparent processing, taking into account the specific circumstances and context in which the personal data are processed” (Recital 60 of the GDPR), a principle also highlighted in the Guidelines on Transparency pursuant to Regulation 2016/679, which stipulate that the information must be concrete and “should not be formulated in abstract terms.” Moreover, the provisions of the Bank of Italy concerning “Transparency of Banking and Financial Transactions and Services” of July 29, 2009, as amended, as amended, which, in defining the information that banks must provide to data subjects, require that such information be provided “in a correct, clear, and comprehensive manner, as well as appropriate […] to the characteristics of the services and the clientele.” With regard to the respective roles played by the Bank and Poste Italiane in order to properly contextualize the matter, it is deemed appropriate to refer to the provisions contained in Presidential Decree No. 144 of March 14, 2001 (Regulation on the Simplification of Bancoposta Services), which established the governing rules for Poste Italiane S.p.A.’s financial activities with the public. The aforementioned Regulation prohibits Poste from granting loans to the public and permits it to engage in the promotion and placement of banking and financial products and services off-premises, acting as an intermediary on behalf of banks and financial companies, which serve as the lenders, and whose relationships are governed by specific agreements and conventions (Art. 2, paragraphs 8 and 9-bis of the aforementioned Presidential Decree) From the context outlined above, it is clear that the duties and accountability that fall upon Poste and the Bank, while interrelated, are different and distinct, including with regard to the contractual relationship that each maintains with the data subject. This is confirmed by the evidence gathered during the preliminary investigation, an examination of which reveals that, during the loan application and verification phase, Poste collects and verifies the data of the data subjects and any co-obligors, including for the purpose of matching the financial product that best meets the applicant’s needs and financial capacity; it then transmits the data to the Bank, including—where the application comes from a checking account holder—the transmission, in aggregated form, of indicators generated by existing relationships with Poste (average balance, checking account balance, etc.); finally, upon completion of the preliminary review, it notifies the data subject of the outcome of the request. The Bank, as the lender, conducts the preliminary review to assess the data subject’s creditworthiness; based on the outcome of this review, it decides whether to grant or deny the loan, a decision that is “subject to the Bank’s exclusive, discretionary, and final judgment,” (see “Data Verification Form for Loan Application”); once its decision has been made, the Bank forwards the outcome of the application to Poste so that it may communicate it to the loan applicant. The Bank, in accordance with the sector’s regulatory framework (Articles 120-undecies, paragraph 1, and 124-bis, paragraph 1, of the Consolidated Banking Act, hereinafter TUB), therefore carries out the activities typical of a lender, in relation to which it determines the purposes and means of the processing, thereby acting as an independent data controller pursuant to Article 4, No. 7 of the Regulation. At the same time, Poste retains independent data controller status within the context of its separate relationship with the data subject, acting as an intermediary and maintaining an independent relationship with the data subject, which continues even following a potential negative assessment by the Bank, following which Poste may propose other financing solutions (by approaching other banks) better suited to the customer’s needs and credit situation. It follows from the foregoing that, even during the exchange of data subjects’ information, the Companies act as independent controllers, since each operates on the basis of separate contractual relationships with the customer, within the limits of what is necessary for the performance of a contract to which the data subject is a party or for the implementation of precontractual measures taken at the data subject’s request (Art 6(1)(b) of the Regulation). Based on the information obtained, it appears that Poste operates within the framework of a separate relationship with the data subject and processes the personal data pertaining to the data subject for its own purposes related to brokerage activities, while, for its part, the Bank independently determines the processing purposes and essential means of the processing related to the assessment of the data subject’s creditworthiness—for which it must receive from Poste the data concerning the loan applicant—and exclusively decides on the decision to grant or deny the loan. It follows, therefore, that the processing activities carried out by Poste and the Bank, including the disclosure of data relating to the loan applicant, are not performed by one party on behalf of the other, but fall within the limits of what is necessary for the performance of their respective contractual relationships or the precontractual measures requested by the data subject (Article 6(1)(b) of the Regulation), without prejudice to the independent accountability of each controller regarding the lawfulness, fairness, transparency, and relevance of the processing carried out. This approach is also confirmed by the “Guidelines 07/2020 on the concepts of controller and processor under the GDPR” adopted by the EDPB on July 7, 2021. In fact, these guidelines, while emphasizing that the role of “controller” is based on a factual rather than a formal analysis,” clarify that “The roles of controller and processor are functional concepts: they aim to allocate accountability according to the roles actually performed. This implies that the legal status of a party as a ‘controller’ or ‘processor’ must, in principle, be determined by the activities actually carried out in a specific situation, rather than by its formal designation as a ‘controller’ or ‘processor’ (for example, in a contract)” (see point 12 of the aforementioned Guidelines). In light of this conclusion, it must be held that the decision by Poste and the Bank to designate each other as processors (pursuant to Article 28 of the Regulation) during the phase of communicating the personal data of data subjects—although it reflects specific choices made by them and documented in “Agreements” signed by both—does not correspond to the statutory provision according to which the processor is the entity “that processes personal data on behalf of the controller” (Article 4(8) of the Regulation) and who “is required to follow the instructions given by the controller […] regarding the processing purpose and the essential elements constituting the means thereof” (see EDPB, Guideline No. 07/2020, cit., p. 28), nor is it supported by a factual assessment of the relationship, which instead shows that the disclosure of information is not carried out by one party in the interest of the other, but rather by each party for its own purposes, as necessary for the performance of their respective contractual relationships or the precontractual measures requested by the data subject; it follows, therefore, that the Parties act as independent controllers of processing. The subjective characterization proposed by Poste and the Bank does not, therefore, correspond to the factual reality of the processing, with immediate repercussions also on the compliance of the privacy notice provided to data subjects with data protection regulations, pursuant to Art. 13 of the Regulation. In fact, in the present case, the privacy notice is not adequately formulated, given that, with regard to the processing of data subjects’ personal data carried out in connection with the promotion and placement of the “BancoPosta Product,” it should have specified the recipients or categories of recipients of the data subjects’ personal data (Article 13(1)(e) of the Regulation) and provide additional information to ensure, in accordance with the general principles set forth in Article 5 of the Regulation, fair and transparent processing with respect to the data subjects. In light of the foregoing recitals, and for all the reasons set forth above, it appears that the data controller engaged in conduct contrary to Article 5(1)(a) and Article 13 of the Regulation with respect to the information provided to data subjects. 5. Conclusions: Declaration that the processing is unlawful. Corrective measures pursuant to Art. 58(2) of the Regulation. In light of the overall findings, the Authority considers that the statements, documentation, and accounts obtained during the preliminary investigation do not sufficiently address the objections notified by the Office in the notice initiating the proceedings and that they are, therefore, insufficient to warrant dismissal of the case, especially since none of the cases provided for in Art. 11 of the Data Protection Authority’s Regulation No. 1/2019 apply. The processing of personal data carried out by Poste is, in fact, unlawful under the terms set forth, with regard to the violation of the principles of fairness and transparency, as it was carried out in violation of Articles 5(1)(a) and 13 of the Regulation. The violation of the aforementioned provisions entails the imposition of the administrative sanction provided for in Article 83(5)(a) and (b) of the Regulation. With regard to the exercise of the corrective powers referred to in Article 58, para 2, of the Regulation, the Authority takes note of the statements made by Poste Italiane S.p.A. in its briefs regarding the fact that it has already taken certain measures to bring the data processing carried out in this context into compliance with the regulatory framework described above. 6. Adoption of the injunction ordering the imposition of the administrative fine and ancillary sanctions (Articles 58, para 2, subparagraph (i), and 83 of the Regulation; Article 166, para 7, of the Code). The Data Protection Authority, pursuant to Art. 58, para 2, subparagraph (i) of the Regulation and Article 166 of the Code, has the power to impose an administrative fine provided for in Article 83, para 5, of the Regulation, through the adoption of an injunction order (Article 18. Law No. 689 of November 24, 1981), in connection with the processing of personal data carried out by Poste Italiane S.p.A., which has been found to be unlawful, as set forth above. With regard to the factors listed in Article 83(2) of the Regulation for the purposes of imposing the administrative fine and determining its amount—taking into account that the fine must “in any event [be] effective, proportionate, and dissuasive” (Article 83(1) of the Regulation), it is noted that, in the present case, the following circumstances were taken into account: - With regard to the severity of the violations, their nature was considered significant, as they concerned non-compliance with the general principles of data processing, and in particular the principles of fairness and transparency regarding the content of the information provided to data subjects —that is, all customers who applied for a loan related to products offered by BancoPosta—to have accurate and transparent information regarding the processing of their data (Art. 83(2)(a) of the Regulation); - with regard to the subjective element, consideration was given to the negligent nature of the violation, attributable to an erroneous interpretation of the respective roles played during certain stages of the BancoPosta loan application process (Art. 83(2)(b) of the Regulation); - the fact that Poste voluntarily adopted a set of measures designed to mitigate or eliminate the consequences of the violation (Articles 83(2)(c) of the Regulation), such as: the erasure of the data subject’s data, promptly informing the data subject; updating the privacy notice to include a more detailed and clear description of the processing activities carried out; establishing a working group with the Bank to review existing contractual agreements and “consequently remove the Bank’s status […] as a processor”; - the absence of previous decisions by the Authority against Poste regarding the same type of case, as well as the absence of complaints similar to the one that is the subject of this decision (Article 83(2)(e) of the Regulation); - the fact that Poste Italiane S.p.A. cooperated effectively with the Authority during the proceedings (Articles 83(2)(f) and 83(para) of the Regulation). In light of the above factors and the assessments made, it is deemed appropriate, in this case, to impose on Poste Italiane S.p.A. an administrative fine in the amount of 48,000.00 euros (forty-eight thousand euros). Finally, it is considered that the conditions set forth in Art. 17 of the Data Protection Authority’s Regulation No. 1/2019 are met. NOW THEREFORE, THE DATA PROTECTION AUTHORITY pursuant to Articles 57(1)(f) and 83 of the Regulation, finds that the processing carried out by Poste Italiane S.p.A., in the person of its pro tempore representative, with registered office in Rome, Viale Europa 190, Tax ID No. 01114601006, under the terms set forth in the reasoning, for the violation of Articles 5(1)(a) and 13 of the Regulation; ORDERS pursuant to Article 58, para 2, subparagraph i), of the Regulation, that Poste Italiane S.p.A. pay the sum of 48,000.00 euros (forty-eight thousand/00) as an administrative fine for the violations indicated in this order; DIRECTS Poste Italiane S.p.A. to pay the aforementioned sum of 48,000.00 euros (forty-eight thousand euros/00) in accordance with the procedures set forth in the attachment, within thirty days of the service of this order, failing which the necessary enforcement measures will be taken pursuant to Art. 27 of Law No. 689/1981. It is noted that the offender retains the right to settle the dispute by paying—again in accordance with the procedures set forth in the attachment—an amount equal to half of the imposed penalty, within the time limit set forth in Article 10, paragraph 3, of Legislative Decree No. 150 of September 1, 2011, provided for the filing of an appeal as indicated below; ORDERS — pursuant to Art. 17 of the Data Protection Authority’s Regulation No. 1/2019, that the violations and the measures adopted in accordance with Article 58, para 2, of the Regulation be recorded in the Authority’s internal register provided for in Article 57, para 1, letter u), of the Regulation. - pursuant to Article 154-bis, paragraph 3, of the Code and Article 37 of the Data Protection Authority’s Regulation No. 1/20129, the publication of this decision on the Authority’s website; - Pursuant to Article 166, paragraph 7, of the Code and Article 16, paragraph 1, of the Data Protection Authority’s Regulation No. 1/20129, the publication of the injunction order on the Data Protection Authority’s website. Pursuant to Article 78 of the Regulation, as well as Article 152 of the Code and Article 10 of Legislative Decree No. 150/2011, an appeal against this order may be filed with the ordinary courts by submitting a petition to the ordinary court of the jurisdiction specified in the aforementioned Art 10, within thirty days from the date of notification of the order, or within sixty days if the appellant resides abroad. Rome, October 7, 2026 THE CHAIRMAN Stanzione THE RAPPORTEUR Stanzione THE SECRETARY GENERAL Montuori