Sanction RGPD Italian Data Protection Authority (Garante) — Intesa Sanpaolo S.p.A : 100 k€ (2022)
- Autorité de contrôle
- Italian Data Protection Authority (Garante)
- Pays
- Italie
- Entreprise / secteur
- Intesa Sanpaolo S.p.A
- Montant de l'amende
- 100 k€
- Date de la décision
- 26 mai 2022
- Fondement juridique
- Art. 5 (1) a), f), Art. 6
- Manquement
- Base légale insuffisante pour le traitement
Résumé des faits
The Italian DPA has imposed a fine of EUR 100,000 on Intesa Sanpaolo S.p.A.. The bank had unlawfully disclosed data of the data subject to unauthorized third parties (the father of the data subject ). The data subject's father, a former employee of the bank, had been authorized to access his daughter's bank data until she reached the age of majority. However, the father had demanded access to his daughter's data, who in the meantime had already reached the age of majority. An employee of the bank suspected that the father still had authorization and for this reason passed on the daughter's data.