Italy's data protection authority, the Garante per la protezione dei dati personali, has fined Deutsche Bank S.p.A. €33,000 over the privacy notice given to people who apply for BancoPosta personal loans, the loans the bank grants to customers who apply through Poste Italiane. The injunction order, no. 746 in the authority's register (doc. web 10310391), was adopted on October 7, 2026 and featured in the Garante's newsletter no. 554 of October 23, 2026. It also orders the bank to rewrite the notice within six months of notification.

The fine is small. The reasoning reaches further. Deutsche Bank and Poste Italiane had signed agreements under which each appointed the other as a data processor for some of the applicant data they exchanged. According to the Garante, neither label matched what the two companies actually did with the data: each pursued its own purposes, so each was an independent controller, and the bank's notice should have told applicants who received their data. On the same day, in a separate order (no. 747, doc. web 10310707) arising from the same complaint, the Garante fined Poste Italiane €48,000. Quotations from the decision in this article are PPC Land's translations from the Italian.

In Short

Deutsche Bank and Poste Italiane, which sell BancoPosta personal loans together, signed agreements calling each other a "processor" for some of the data they swapped about loan applicants, and the bank's privacy notice was written on that basis. Italy's privacy regulator said those labels did not match reality, because each company uses the data for its own business, which makes each one a separate controller that must be named to applicants as a recipient of their data. Deutsche Bank must pay €33,000 and fix its notice within six months, while a separate decision on the same complaint fined Poste Italiane €48,000.

A loan refusal and a notes field

The case started with one person. On January 5, 2024, an employee of Poste Italiane filed a complaint with the Garante after applying for a loan from Deutsche Bank through the portal the bank makes available to Poste for its employees. According to the complaint, the bank, "in refusing the loan, entered in the platform (accessible to all Poste Italiane S.p.A. staff in charge of handling loan applications, as well as to all staff accessing through the workstation of the manager of the Portacomaro Stazione Post Office - Municipality of Asti) the information" that the complainant had ongoing financial commitments, together with the amount of those commitments and her net income.

Two further points in the complaint shaped the case. The application form published on Poste's portal, according to the complainant, "does not provide space for entering the applicant's salary, since that figure is by agreement supplied directly by Poste Italiane S.p.A." And the bank's own privacy notice stated that it "will not communicate to Poste the credit information and personal data found in the SIC CRIF [credit information systems], but will transmit only the outcome of the check [...] to Poste which, as external Data Processor, will communicate it to the Applicant."

The complainant contested the processing with both companies and asked for her data to be deleted. Both replied. She did not consider either answer satisfactory.

The Garante's office decided that the case could not be examined against the bank alone. On January 29, 2024, it asked the complainant whether the complaint should also cover Poste, her employer, which she had not named. She confirmed on February 12, 2024. The investigation was later extended, on the authority's own initiative, to how applicants' data is handled in the promotion and placement of the BancoPosta loan product generally.

How a BancoPosta loan moves between two systems

The arrangement rests on a legal constraint. Under Presidential Decree no. 144 of March 14, 2001, which sets the rules for Poste Italiane's BancoPosta financial activity, Poste may not grant loans to the public. It may place banks' loans as an intermediary, under dedicated agreements. According to the bank, its relationship with Poste is governed by such an agreement covering the "BancoPosta" loan.

Each company runs its own IT system. "The two separate and distinct applications exchange information flows through an online web service," the bank told the Garante in a note of September 12, 2024. The bank described three phases.

In the preliminary phase, the customer asks Poste for a simulation of a loan with a set amount and number of instalments. The bank receives the request, draws up a financial plan and sends it back to Poste, which, if the customer accepts, collects signatures and documentation. In the intermediate phase, Poste sends the file data to the bank through web services and the bank assesses creditworthiness. In the final phase, three outcomes are possible: approval followed by disbursement, refusal, or a request to add information or a co-obligor, or to change the terms of the request.

The outcome travels back as a code called "stato pratica" (application status). Where needed, the bank's operator can add further information in a notes field of the application. Poste, according to the bank, "updates its own system with the 'stato pratica' code and any notes [...] visible only and exclusively to certain staff (in particular, sales staff only) of the relevant Poste units." The customer receives the bank's final decision, approval or refusal, but "does not receive and is not allowed any view of information on the Bank's creditworthiness analysis, which remains information exchanged and processed only between the two intermediaries."

Data also flows the other way. According to the Garante, when the applicant holds a Poste current account, Poste sends the bank aggregated indicators generated by that relationship, such as the average balance and the current account balance.

The bank's defence on pre-scoring

Deutsche Bank's written defence, filed on September 15, 2025, drew a line between two activities. Pre-scoring, which happens in the preliminary phase, is a preliminary check of the applicant's data, including a check in the credit information systems, carried out to find the most suitable loan formula. The creditworthiness assessment proper comes later. Each, according to the bank, is covered by its own privacy notice.

Pre-scoring data is collected through a data verification form for the loan request, which carries both Poste's and the bank's privacy notices. The pre-scoring result, the bank said, "consists solely and exclusively of the transmission of alphanumeric codes" signalling a customer that cannot be financed, a file passed for further review, the addition of a guarantor, or a change to the amount or duration.

The full creditworthiness assessment produces a report in which credit information system data is only one section, and that report "is never shared with Poste," according to the bank. The notes field is filled in only in the final phase, to give Poste "indications [...] on the reasons for any refusal of a loan or the need to scale down the request," so that Poste, which deals with the customer directly, can explain the refusal. In the complainant's case, the bank acknowledged, the notes field "included information collected directly from the SIC," because some of that data was considered relevant to explaining why the loan was refused.

The bank added that its assessments were accessible, under the "need to know" principle, "exclusively to a very small number of people (among them the data subject herself)." Since the notes field is used only at the end of the process, it argued, it could not breach the notice covering pre-scoring.

The Garante accepted part of this. It took note that "the outcome of the check" mentioned in the notice on the data verification form refers to pre-scoring, not to the final decision on the loan, and that the final assessment comes with a separate notice attached to the BancoPosta loan request form. The decision makes no separate finding on whether placing credit information system data in the notes field was itself unlawful. The violation the Garante found lies elsewhere.

Processors on paper, controllers in fact

The problem was the roles. In a further note dated March 18, 2025, the bank confirmed that, under the agreement, both companies act as independent controllers under Article 4(7) of the GDPR. Over time, however, given their mutual "interest in exchanging further data lawfully acquired from potential customers," and to improve "activities preparatory to the promotion and placement of the BancoPosta loan product," the two had agreed, "limited to some data," to supplement the arrangement.

Under that supplement, Poste appointed the bank as its processor for data of which only Poste is the controller, sent to the bank and concerning "only the evaluation parameters of the loan applicant." In mirror image, the bank appointed Poste as its processor for data of which only the bank is the controller, sent to Poste and concerning "some data collected in the preliminary checks carried out following the loan request."

The bank explained what each side gained. For the bank, a more effective assessment of "credit risk in the evaluation process." For Poste, "better commercial management of the customer [...] so as to be able also to direct them towards other solutions [more suited] to their financing needs as well as to inform them correctly and promptly of the reasons why the loan request did not succeed." The bank does not pass Poste "the data collected from the Credit Information Systems," it said, but provides some data "to allow Poste itself to manage the relationship with the customer and their financing needs, using, where appropriate, other financial intermediaries that adopt credit policies different from those adopted by DB."

That description became the basis for the Garante's conclusion. The bank, as lender, carries out the creditworthiness assessment required by Articles 120-undecies and 124-bis of Italy's Consolidated Banking Act (TUB), and the loan decision is "subject to the exclusive, discretionary and unquestionable judgment of the Bank," in the words of its own data verification form. Poste keeps a separate relationship with the customer that continues after a refusal, when it can offer financing through other banks.

According to the Garante, the exchange of data between the two "did not take place (as the two companies held) by one party in the interest of the other," but within what each needs to perform its own contract with the applicant, or pre-contractual steps requested by the applicant, under Article 6(1)(b) of the GDPR. Each remains independently responsible for the lawfulness, fairness, transparency and relevance of its own processing. The authority did not treat the two firms as joint controllers, which decide purposes and means together. It found two separate controllers.

The Garante supported the point with the European Data Protection Board's Guidelines 07/2020 on the concepts of controller and processor, adopted on July 7, 2021. The guidelines, as quoted in the decision, state that the role of controller "is based on a factual rather than a formal analysis" and that "the roles of controller and processor are functional concepts: they aim to allocate responsibilities according to the roles actually performed. This implies that the legal status of a party as 'controller' or 'processor' must, in principle, be determined by the activities actually carried out in a specific situation, rather than by its formal designation as 'controller' or 'processor' (for example in a contract)."

A processor, the decision recalls, "processes personal data on behalf of the controller," under Article 4(8) of the GDPR, and is "called upon to follow the instructions given by the controller [...] as regards the purpose of the processing and the essential elements of the means," according to the EDPB. The mutual appointment, "although the expression of precise choices made by them and documented by 'Agreements' signed by both," met neither test, because "the communication of information is not carried out by one party in the interest of the other, but by each for its own purposes."

What the notice left out

The wrong roles had a direct effect on what applicants were told. According to the Garante, the notice for the promotion and placement of the BancoPosta product "should have listed the recipients or categories of recipients of the personal data" of applicants, as Article 13(1)(e) of the GDPR requires, along with further information needed for fair and transparent processing. A notice describing Poste as an external processor that merely relays an outcome does not tell applicants that a separate controller receives their data for its own commercial purposes.

The Garante found that Deutsche Bank breached Article 5(1)(a), the principles of lawfulness, fairness and transparency, and Article 13. The notice opening the proceedings, sent to the bank on July 16, 2025, had also cited Article 28, the rules on processors, and a failure to identify the actual controller correctly. The final decision rests on Articles 5(1)(a) and 13 only.

The corrective order, under Article 58(2)(d), requires the bank to prepare a notice for applicants that lists the recipients or categories of recipients of their data and "takes into account the role held by Poste as an independent controller." The bank has six months from notification to comply and must send the Garante a documented response within the same period. Failing to respond can lead to a further fine under Article 83(5)(e).

How the Garante arrived at €33,000

The fine was set under Article 83(5)(a) and (b) of the GDPR, the upper tier of the regulation's penalty scale, which allows fines of up to €20 million or 4% of total worldwide annual turnover, whichever is higher. The Garante listed the factors it weighed under Article 83(2).

On gravity, the violations concerned general principles of processing, and the notice affected every customer "who requested a loan relating to products placed by BancoPosta." On intent, the Garante found negligence, "attributable to an erroneous interpretation of the subjective roles held in some phases of the BancoPosta loan request process." In the bank's favour, it counted the deletion of the complainant's data, carried out with Poste, and an internal communication reminding staff who assess BancoPosta creditworthiness "to avoid using, as far as possible, credit information and personal data in free-text fields." It also noted no previous decisions or similar complaints against the bank, and the bank's cooperation.

The bank must pay within 30 days of notification. It can settle the dispute by paying half the fine, €16,500 by PPC Land's calculation, within the deadline for an appeal. An appeal can be filed with the ordinary court within 30 days of notification, or 60 days if the appellant resides abroad. The Garante also ordered publication of the decision on its website and its entry in the authority's internal register of violations. The decision does not say whether the bank intends to pay or appeal.

The proceedings took two years and nine months from complaint to decision, by PPC Land's count. The bank asked for extensions in August 2024 and on August 1, 2025, both granted, and on March 27, 2026 dropped its request for a hearing. President Pasquale Stanzione, who was also rapporteur, vice president Ginevra Cerrina Feroni and Agostino Ghiglia took part in the decision, with secretary general Luigi Montuori.

The parallel decision against Poste Italiane

The Garante dealt with Poste Italiane in a separate injunction order, no. 747, adopted on the same day. It fined Poste €48,000 on the same complaint and reached the same conclusion on roles: both companies are independent controllers, and Poste's own notice breached Articles 5(1)(a) and 13 by failing to name the recipients of applicants' data.

Why the roles matter for marketing data

The BancoPosta arrangement has a familiar shape. A party that holds the customer relationship collects data and passes it to a product provider; the provider returns a result; and both sides use what they learn. Similar structures appear in co-branded financial products, affiliate programmes and lead generation, and the contracts behind them assign each party a role that determines what the people whose data is exchanged must be told.

The Garante's decision applies the EDPB's position that such labels do not decide the question. The facts did: Poste said it used the bank's data for "better commercial management of the customer" and to steer refused applicants towards other lenders, which are its own commercial purposes. On the Garante's reading, a party that uses data for its own ends is a controller, and the notices given to applicants have to reflect that.

Earlier processor cases covered by PPC Land dealt with the opposite problem. France's CNIL fined Optimove €1 million in December 2025 after the marketing platform kept a copy of Deezer user data outside its contract. Poland's data protection authority fined McDonald's Polska about €3.89 million in July 2025 over its oversight of a processor, which was fined too. Here, two companies called themselves processors when, on the Garante's reading, they were not.

The amount sits at the low end of the Garante's recent banking decisions. In March 2026, the authority fined Intesa Sanpaolo €17.6 million for profiling about 2.4 million customers and, in a separate decision, fined the same bank €31.8 million after one employee accessed the records of 3,573 customers. Outside banking, it fined IQVIA €7 million over a database of about one million patients that the company had called anonymous, and fined Lusha €2 million in July 2026 with an order to erase Italian contact data.

Fines from the Garante do not always survive. A Rome court annulled the authority's €15 million fine against OpenAI in March 2026, and an Alliance Risk analysis found that nearly 40% of the €7.1 billion in announced GDPR fines had been annulled or were under challenge. The order to rewrite the Deutsche Bank notice stands unless a court sets it aside.

Timeline

Summary

Who: Italy's data protection authority, the Garante per la protezione dei dati personali, and Deutsche Bank S.p.A., the lender behind BancoPosta personal loans placed by Poste Italiane. The case began with a complaint from a Poste Italiane employee whose loan request was refused. Poste Italiane was fined in a separate, parallel decision.

What: The Garante fined Deutsche Bank €33,000 for breaching Articles 5(1)(a) and 13 of the GDPR. The bank and Poste had appointed each other as data processors for some of the applicant data they exchanged; the Garante found that both act as independent controllers, so the bank's notice should have named Poste as a recipient of applicants' data. The bank must rewrite the notice within six months of notification.

When: The complaint was filed on January 5, 2024. The Garante adopted the decision, injunction order no. 746, on October 7, 2026, and featured it in its newsletter no. 554 of October 23, 2026.

Where: Italy. The complaint concerned a loan request handled through Poste Italiane's systems, with the refusal details visible at the Portacomaro Stazione post office in the province of Asti; Deutsche Bank S.p.A. has its registered office in Milan.

Why: Each company used the exchanged data for its own purposes: the bank to assess credit risk and decide on the loan, Poste to manage its customer relationship and steer refused applicants to other lenders. Under the EDPB's Guidelines 07/2020, roles depend on what parties actually do, not on contract labels, so the processor appointments did not hold and applicants were not told who received their data.