Peri News / Italy
BancoPosta loans: Poste and Deutsche Bank fined EUR 81,000
Italy’s data protection authority fined Poste Italiane and Deutsche Bank over shortcomings in notices explaining their respective roles and the data exchanged in handling BancoPosta loans.
A news item published on 10 November 2026 on the European Data Protection Board (EDPB) website reports that Italy’s data protection authority imposed administrative fines of EUR 48,000 on Poste Italiane and EUR 33,000 on Deutsche Bank for transparency failures in processing connected with BancoPosta loans. The infringements concerned Articles 5(1)(a) and 13 GDPR. The full decisions were not consulted, so this account of their contents is limited to the published summary.
According to the summary, the proceedings arose from a complaint about the handling of financial data connected with a loan application. The investigation identified two independent data controllers, despite the arrangement set out in the companies’ contracts. Poste Italiane collected applications and provided intermediary services, identifying financial products suited to applicants’ needs; Deutsche Bank independently assessed creditworthiness and decided whether to grant loans. The notices did not adequately reflect their respective roles and the data exchanged. Poste Italiane did not provide sufficiently clear information on processing during loan promotion and distribution, including data recipients and information flows involving the bank. Deutsche Bank failed to identify Poste Italiane correctly as a recipient operating as an independent controller.
The news item also reports that both companies erased the complainant’s data during the investigation. Poste Italiane updated its notice, while Deutsche Bank issued internal instructions to limit the personal and credit information included in communications about loan applications. The authority also ordered the bank to amend its notice concerning Poste Italiane’s role as an independent controller within six months and document compliance. The account does not specify when that period begins. According to the principle attributed to the authority in the summary, brevity does not justify leaving out information essential to understanding the processing.