In a case concerning the communication of financial information between Deutsche Bank and Poste Italiane in the context of loan applications, the Italian authority analyzed the complexity of the roles of controller and processor, as well as the lack of transparency of the information provided to data subjects.

Facts and context

The Italian data protection authority (Garante per la protezione dei dati personali - GPDP) published a decision concerning Deutsche Bank S.p.A. for breaches related to data communication in the context of financing requests.

The case originated from a complaint by an employee of Poste Italiane S.p.A. following the refusal of a loan and the unauthorized communication of her financial data (net income, ongoing financial commitments) to her employer via a shared platform.

Grounds for the decision

Based on the collected elements, the authority notified the bank of the opening of proceedings for several potential violations:

• Obligation of lawfulness, fairness and transparency and information to data subjects (Article 5(1)(a) of the GDPR and Article 13 of the GDPR): The authority noted that the information provided to loan applicants was misleading. The initial information notice, relating to the pre-assessment phase, stated that only the final decision would be transmitted to Poste Italiane. However, it turned out that detailed data from credit information systems were communicated to Poste Italiane in a "notes" field, notably to justify the refusal. The bank's defense, based on the existence of two distinct processing phases (pre-assessment and creditworthiness evaluation) with two information notices, was not sufficient to dismiss the overall lack of clarity of the process for the data subject.
• Obligation to define roles and responsibilities between controller and processor (Article 28 of the GDPR): The authority challenged the legal qualification of the roles adopted by the bank and Poste Italiane. Although acting in principle as independent controllers, the two companies had mutually designated each other as processors for specific and reciprocal data flows. This complex and ambiguous contractual construction made it difficult to clearly identify respective responsibilities and contributed to data communication going beyond what was announced to the data subject.

Authority's decision

Consequently, although the authority acknowledged the deletion of the complainant's data, it concluded its investigation by finding breaches of the principles of transparency and the correct definition of roles between the parties and imposed a fine of 33,000 euros against them.

Lessons learned

This decision reminds that:

• The qualification of actors (controllers, processors) must reflect the reality of processing and be clearly formalized, especially in complex partnerships where data flows are reciprocal, to avoid any ambiguity about responsibilities.
• The information provided to data subjects must be complete and transparent about the entire process, including the exact nature of the data communicated to third parties, without omitting important details under the pretext of organizing processing in several phases.
• The use of free text fields ("notes") to communicate confidential personal data to a partner constitutes a risky practice that may lead to violations of the principle of confidentiality and data minimization.