Intesa Sanpaolo S.p.A. – €31,800,000 Fine (Italy, 2026)

Intesa Sanpaolo S.p.A. (the controller) is a bank. In 2024, the controller reported a data breach to the DPA in accordance with Article 33 GDPR. According to the controller, the data breach occurred between 2022 and 2024, as a result of an employee accessing the banking data of nine data subjects without authorisation. The controller also stated that it would inform the affected data subjects, despite claiming that it had not identified any high risks to their rights and freedoms. The DPA began an ex-officio investigation after the press reported a much higher number of data subjects affected than the controller had claimed (over 3,500). The controller argued that the fact that a data breach occurred did not mean its security measures were insufficient. In addition, it argued that there was no need to inform all affected data subjects, as the data breach did not pose a high risk for their rights and freedoms. During its investigations, the DPA concluded that the data breach likely posed a high risk for the affected data subjects, and ordered the controller to notify all affected data subjects. In response, the controller informed the DPA of the different measures taken to inform data subjects and to ensure security of processing. Specifically, it informed the DPA that it had decided not to contact approximately 1,300 data subjects, as it considered that the employee had accessed their data for purely service related reasons. The DPA considered that its order had not been complied with. The DPA found a violation of Articles 5(1)(f), 24 and 32 GDPR. During its investigations, the DPA found that the employee involved had full access to the financial data of all data subjects, and that the controller’s alert system did not detect any anomalies in the two year period the employee accessed data subjects’ data for non-service related reasons. Therefore, the controller had failed to implement appropriate security measures and had not complied with the principle of data security or accountability. This was especially relevant considering the fact that the controller processed financial data of “high risk customers“ (public or political figures). The DPA also found a violation of Article 33 GDPR. The DPA considered that the controller had not followed the notification obligations following a data breach, as it had provided incomplete information that was supplemented much later (following press reports and the DPA’s investigation). In addition, the DPA stated that the controller had incorrectly applied ENISA Guidelines. Finally, the DPA found a violation of Article 34 GDPR. The DPA noted that the controller had only notified data subjects after being ordered to do so by the DPA. In addition, the controller had failed to inform all affected data subjects. Nonetheless, the DPA acknowledged that the controller had taken measures to strengthen safeguards. The DPA found a violation of Articles 5(1)(f) and (2), 24, 32, 33, and 34 GDPR, and fined the controller €31,800,000. The DPA took into consideration the high number of data subjects affected (including public figures), as well as the delay from the controller’s part in notifying the data breach after being aware of it.