Euro Servizi per i Notai S.r.l. – €5,000 Fine (Italy, 2024)

The National Council of Notaries ("the Council") requested the DPA to investigate regarding the proper classification of the relationships between banks and notaries when, in the process of loan stipulation, certain lending banks utilize the services of a third-party company named "Euro Servizi per i Notai S.r.l." ("ESpN") for managing document exchange with notaries through a platform known as PIGNA. PIGNA is a service provided exclusively to banks by ESpN which is a computing service provider. It enabled banks and notaries, who handle tasks related to loan contracts and associated guarantees, to share required documents. This sharing occurred both before and after the contract was signed, except for a copy of the contract in enforceable form. Essentially, PIGNA facilitated the efficient exchange of necessary paperwork between these parties involved in the loan process. Several concerns arose from the situation described. Firstly, the Council recommended an investigation with regards to the roles and responsibilities in the processing of personal data within the PIGNA platform. This includes notaries, banks, and ESpN. The concern revolved around the processing of personal data of borrowers, related third parties (like property sellers), and data concerning the notaries themselves. Secondly, the relationship between PIGNA and individual notaries was unclear since notaries accessed the platform with authentication credentials provided by ESpN. Thirdly, there were issues with the level of information provided to notaries and the sequence of notifications sent by PIGNA. It was highlighted that notaries receive a range of notifications via both the portal and email. In some instances, these notifications arrive unexpectedly, directly from the lending bank selected by the borrower. For instance, they may receive notice granting them authority to issue a mortgage loan, which is not necessarily communicated by the borrower's chosen lending bank. Specifically, certain communications originating from platform accounts aim to offer notaries period report of borrower's personal data. These communications are accompanied by a table or Excel sheet detailing various deeds under scrutiny or completed, all linked to the same notary, concerning different banks. They include an internal reference code within the portal and identify the relevant party (the borrower). Upon this request, the DPA conducted an investigation. The DPA’s investigation regarding the roles assigned for the data management revealed the following. To begin with, the banks operate as data controllers within the framework of outsourcing contracts which are accompanied by special data protection agreements. Next, the banks designate ESpN as the processor under Article 28 GDPR. All processing activities carried out by ESpN regarding the portal are predetermined by banks and made available to notaries for mortgage procedures. Additionally, the notaries use the PIGNA portal in the interest and on behalf of the respective bank. After receiving an assignment from the bank, ESpN creates an account for the notary and provides the notary with initial authentication credentials. The ESpN sends the credentials to the notary’s official e-mail address found on the professional register of Notaries. In this phase, ESpN acts as a data controller for the creation and maintenance of the notary’s account, as well as linking it to the specific areas designated for use by each individual bank. For this reason, the ESpN provides the notaries with the privacy policy which is published on the PIGNA portal and where legitimate interest under Article 6(1)(f) GDPR is identified as legal basis. The DPA observed that ESpN, although not directly carrying out the identification of the notary availed itself of the identification carried out by a third party, i.e. the National Council of Notaries. This is because registration on PIGNA is carried out by using the e-mail address, assigned to the notary by the Council and published in the relevant register, which is collected by ESpN from the bank or directly from the Council. This reliance on third-party identification raised concerns because if ESpN lacks sufficient elements to guarantee the registrants' identity, it should conduct its own checks to ensure that only authorized individuals gain access to PIGNA. Therefore, by not independently verifying the identity of registrants, ESpN risks breaching the principle of integrity outlined in Article 5(1)(f) GDPR and Article 32 GDPR. Moreover, the DPA found that relying on Article 6(1)(f) GDPR as legal basis for processing notaries' data does not hold for the registration phase and generation of authentication credentials. The processing of personal data in this context should fall under Article 6(1)(b) GDPR, namely a contractual relationship between ESpN and notaries. If the legal basis was legitimate interest, notaries would have a right to object. However, the right to object does not apply, as it would hinder the verification process of notaries' identities, necessary for accessing the portal. A contract between ESpN and notaries does not exist. Consequently, ESpN's handling of personal data related to notary registration and authentication credentials breached the principles of lawfulness and fairness. Additionally, PIGNA sent a periodic report to notaries with with respect to all the banks including borrower's personal data. The DPA discovered that such processing was carried out by the ESpN in complete autonomy and outside the instructions received as per Article 28 GDPR from the banks which have never explicitly requested ESpN to send such reports. Further, ESpN privacy policy makes no mention of such periodic reporting. It should be noted that pursuant to Article 28(10) GDPR, where a controller determines the purposes and means of the processing, he must be 'regarded as a controller of the processing in question'. Since ESpN lacked consent and failed to inform data subject of such processing, the DPA found a breach of the principles set out in Articles 5(1)(a) GPDR, Article 6(1)(a) GDPR, Article 13 GDPR and Article 14 GDPR. For reasons stated above the DPA determined fine for ESpN in the amount of €5,000.