Sanction RGPD Italian Data Protection Authority (Garante) — Ubi Banca spa : 100 k€ (2021)
- Autorité de contrôle
- Italian Data Protection Authority (Garante)
- Pays
- Italie
- Entreprise / secteur
- Ubi Banca spa
- Montant de l'amende
- 100 k€
- Date de la décision
- 16 décembre 2021
- Fondement juridique
- Art. 5 (1) a), c)
- Manquement
- Non-respect des principes de traitement
Résumé des faits
The Italian DPA has imposed a fine of EUR 100,000 on Ubi Banca spa (now Intesa Sanpaolo spa). A data subject had filed a complaint with the DPA for receiving a letter from the controller, with the envelope stating 'anomalous credit Chieti'. However, the letter did not contain payment reminders but only information about the transparency of banking and financial services. For this reason, the DPA found that the controller had violated the principles of lawfulness and transparency as well as the principle of data minimization. After all, the term on the envelope could enable third parties to obtain information about the recipient's financial situation, regardless of the contents in the envelope.