Data Subject versus Poste Vita S.p.A. – €80,000 Fine (Italy, 2025)

Poste Vita (the controller) is the insurance branch of the Italian post company. A policyholder (the data subject) filed a complaint against the company following the theft of her identity. Between 2021 and 2023 a third party impersonated the data subject and filed access requests with the controller. In order to fool the controller, the impersonator create an email with the data subject's name, provided the controller with correct and detailed information about the data subject's account and transaction history, and included the data subject's handwritten signature in their emails. The controller considered the requests to be genuine and disclosed data. The impersonator later produced the data in court proceedings against the data subject. As a result, the data subject learned about the identity theft and reached out to the controller. The controller then suspended communications with the third party and opened an internal investigation. The controller notified the DPA about the breach months later, at the end of the internal investigation. The DPA held that the controller unlawfully disclosed personal data and failed to notify the DPA of the breach within due time. On these grounds, the DPA issues a €80,000 fine. In determining the fine, the DPA considered that the controller had since improved its verification procedures for data subject requests. == The DPA found that the controller unlawfully disclosed personal data to a third party without adequate verification measures, breaching the principles of lawfulness, fairness, integrity and confidentiality under Articles 5(1)(a) and (f) GDPR. The DPA acknowledged that the controller acted in good faith but still held it responsible for disclosing personal data without appropriate safeguards. == The controller claimed that it notified the breach to the DPA in due time. In the controller's view, the 72-hour deadline of Article 33 GDPR began when the controller was certain of the breach- i.e. at the end of the investigation. The DPA, on the other hand, held that the deadline began when the data subject reported the breach, on grounds that the controller already had "reasonable evidence" of the breach. Therefore, the DPA held that the controller violated Article 33 GDPR.