Studio Riabilitazione Creditizia S.r.l.s. – €70,000 Fine (Italy, 2024)

After the Bank of Italy notified the DPA of a personal data breach, the DPA decided to start an ex officio investigation. The notification concerned requests for information advanced by the legal representative of a credit repair company to the databases of national banks. Credit repair consists of finding and fixing mistakes on your credit report to boost one's credit score. The legal representative was appointed as processor, while the credit rehabilitation company was the controller. All these access requests concerned natural persons, the data subjects, who did not give any authorization for the search. The DPA advanced a request for information to the controller, which remained unanswered. Thus, the DPA started an investigation, which revealed the following. First, the controller deals primarily with the erasure of credit reports by banks. Data subjects reach out to the controller through their website. Subsequently, the controller calls the data subject about this service. Second, when the controller calls the data subject, the controller gives information on data processing by means of a prerecorded voice to give the data subjects an overview on the services offered. Then, if the data subjects accepted, their data is collected. However, not all data present in the database was collected from the data subjects. Third, the Privacy Policy is shared, first, with the data subjects via telephone, on the date of the the first phone contact and, for the second time, when they fill out a form on “mandate to act” in public and private central credit rating centers. Fourth, the controller’s database revealed that: * The controller's IT system contains data regarding 74,214 data subjects. This data includes: name, surname, place and data of birth, social security number and contact details. * In each customer file, there are also the reports provided, by the companies and banking institutions, in response to requests for access made by the controller through the proc