Intesa Sanpaolo S.p.A. – Order (Italy, 2024)

The controller, Intesa Sanpaolo (the biggest Italian bank) noticed that an employee had accessed data concerning the financial situation of 9 data subjects, even though those data subjects were not clients of the branch were that employee was working. The employee stated that they accessed the data out of curiosity. After an internal audit, the controller terminated the employment relationship with this employee. On 17 July 2024, the controller notified the data breach to the DPA pursuant to Article 33 GDPR. However, the controller believed that the data breach was not likely to result in a high risk to the rights and freedoms of natural persons. Therefore, it did not notify the breach to the concerned data subjects according to Article 34(1) GDPR. The controller, however, sent an informal communication to the affected data subjects. In addition, on 10 October 2024, the DPA learned that, according to some newspapers, the same employee had performed other 6000 accesses to more than 3500 data subjects' bank account details, including the President of the Council of Ministers' sister and ex-partner; some Ministers, the Speaker of the Senate and the head of the national anti-mafia public prosecution office. Also with regard to this further accesses, the controller believed that the the data breach was not likely to result in a high risk to the rights and freedoms of natural persons. However, the controller stated that it might send a "client caring" letter to explain what happened. Even though the investigation about this case is still open, the DPA deemed necessary to immediately decide about the controller's compliance with Article 34 GDPR. Contrary to what the controller argued, the DPA held that the data breach at hand is likely to result in a high risk to the rights and freedoms of natural persons. The DPA took into account the following facts: * the type of personal data at hand; * the performance of the accesses at hand could be considered a crime under [https://www.normattiva.it/uri-res/N2Ls?urn:nir:stato:regio.decreto:1930-10-19;1398 Article 615-ter of the Italian Criminal Code] (Codice penale - c.p.); * the controller operates in the banking sector, a business area in which employees are required to have a really high confidentiality level. Moreover, the DPA found that none of the 3 exceptions to the notification obligation listed by Article 34(3) GDPR could apply and that the controller has not proved any of those conditions to be met. As for Article 34(3)(c) GDPR, the DPA pointed out that the controller certainly has contact details of the data subjects, since the latter are its clients. Therefore, it is not possible to argue that contacting them would involve a disproportionate effort. Furthermore, the DPA noted that the [https://www.edpb.europa.eu/our-work-tools/our-documents/guidelines/guidelines-92022-personal-data-breach-notification-under_en EDPB Guidelines 9/2022 on personal data breach notification under GDPR] state that data breaches that involve financial data are likely to cause a higher damage, since - if combined with other data - can lead also to identity theft (see para. 108). Finally, the DPA stated that, as for the "client caring" letter the controller is planning to send to all clients, this has different content and purpose than the notification set by Article 34 GDPR. On these grounds, pursuant to Article 34(4) GDPR in combination with Article 58(2)(e) GDPR, the DPA ordered the controller to notify the concerned data subjects about the data breach at hand without undue delay and, in every case, within 20 days. The DPA prescribed this notification to be made personally by bank employees working in the branch where the bank account had been opened and to document this meetings in writing according to Article 5(2) GDPR.