Sanction RGPD Italian Data Protection Authority (Garante) — NTT Data Italia S.P.A : 800 k€ (2024)
- Autorité de contrôle
- Italian Data Protection Authority (Garante)
- Pays
- Italie
- Entreprise / secteur
- NTT Data Italia S.P.A
- Montant de l'amende
- 800 k€
- Date de la décision
- 8 février 2024
- Fondement juridique
- Art. 28 (2), Art. 33 (2)
- Manquement
- Manquement à la notification de violation de données
Résumé des faits
The Italian DPA has imposed a fine of EUR 800,000 on NTT Data Italia S.P.A. The fine is related to the fine imposed on UniCredit (ETid-2227). UniCredit had contracted NTT to carry out vulnerability analyses and penetration tests. During its investigation, the DPA found that NTT had not notified UniCredit of a data breach in a timely manner. In addition, NTT had contracted another company to carry out vulnerability assessments and penetration tests without prior authorization from the bank as the data controller.