Italy's data protection authority, the Garante per la protezione dei dati personali, has fined Poste Italiane S.p.A. €48,000 over the privacy notice given to people who apply for BancoPosta loans at Italian post offices. The injunction order, no. 747 of the authority's register, was adopted on October 7, 2026 and featured in the Garante's newsletter no. 554 of October 23, 2026. It finds that Poste and Deutsche Bank, the lender behind the loans, had wrongly appointed each other as data processors in their written agreement, and that the notice handed to applicants therefore failed to say who received their data. Poste had defended the brevity of that notice by citing "privacy fatigue". The Garante rejected the argument.

In Short

Italy's privacy regulator fined Poste Italiane €48,000 because the notice it gave loan applicants did not explain that their data went to Deutsche Bank, which makes the lending decision. The two companies had written contracts calling each other "processors", but the regulator said both use the data for their own purposes and are therefore separate controllers, whatever the contract says. If two companies exchange customer data and each pursues its own goals with it, the people concerned have to be told who gets their data, and a short notice is not a defence when it leaves that out.

A complaint from inside the post office

The case began with one person. On January 5, 2024, an employee of Poste Italiane filed a complaint with the Garante against Deutsche Bank under Article 77 of the GDPR. She had applied for a loan from the bank through a portal the bank provides to Poste for its own staff. The loan was refused.

What happened next is described in the decision. According to the complainant, the bank, "in denying the loan, entered into the platform (accessible to all Poste Italiane S.p.A. staff responsible for handling loan applications, as well as to all staff accessing through the workstation of the director of the Portacomaro Stazione post office - Municipality of Asti)" the information that she had financial commitments in progress, together with the amount and her net income. All quotations from the decision in this article are PPC Land translations from the Italian original.

The complainant made two further points. The application form published on Poste's portal "does not include space for entering the applicant's salary, since by agreement this figure is provided directly by Poste Italiane S.p.A." And the bank's own privacy notice stated that it "will not communicate to Poste the credit information and personal data found in the SIC CRIF, but will transmit exclusively the outcome of the check [...] to Poste which, as external processor, will communicate it to the Applicant." CRIF runs one of Italy's credit information systems, known as SIC.

She asked both companies to delete her data and contested the processing. The answers did not satisfy her. On January 29, 2024 (protocol no. 11166), the Garante's office wrote to ask whether she wanted to extend the complaint to Poste, her employer, because a preliminary review suggested the investigation needed to cover both companies. She confirmed on February 12, 2024.

How the investigation unfolded

The office sent formal information requests under Article 157 of Italy's Privacy Code to both companies. The request to Poste, dated July 23, 2024 (protocol no. 90736), produced a request for more time on August 7, 2024. The office granted it and set September 12, 2024 as the deadline, by note no. 104376 of September 4, 2024.

Poste answered on September 12, 2024. It said it had proceeded "without delay [...] in agreement with the Bank, [...] to delete the data subject to the report from the company archives" and had told the complainant so. It added that all Poste staff who had accessed the loan file in the course of their duties "were qualified as persons authorised to process data and duly instructed in that sense."

Poste also set out how the loan product works. Credit activity between the two companies is governed by a "Convenzione per il Prestito BancoPosta", an agreement signed by the bank and Poste. In Poste's description, the processing of applicants' data "is carried out by the Bank and by Poste Italiane as independent controllers." Then came the qualification that would decide the case:

  • when Poste sends the bank "the evaluation parameters of the loan applicant, the Bank operates as processor on behalf of Poste Italiane in relation to the Data communicated by the latter";
  • when the bank sends Poste "the outcome of the preliminary check of the loan application, Poste Italiane operates as processor on behalf of the Bank with reference to the Data communicated by the latter."

Each company, in other words, was a controller for its own part of the process and a processor for the other at the moment data crossed between them. Applications run through an independent Poste IT system connected to the bank's systems to integrate information flows.

Most data is collected from applicants directly. There are exceptions. The bank sends Poste a "pre-scoring" evaluation and the status of the application. Poste, in turn, sends the bank "a score elaborated by aggregating indicators deriving from financial relationships already in place with Poste Italiane itself and therefore starting from information already present in the latter's archives." The assessment of creditworthiness "can be carried out only by the Bank and falls fully and solely within the latter's prerogatives," according to Poste. The bank then reports the file status back to Poste in three categories: loaded, in progress (at the bank or at Poste) or approvable; disbursed; rejected.

The Garante ran a parallel investigation into Deutsche Bank and gathered documents and explanations from the bank on September 12, 2024 and March 18, 2025, which it used to assess Poste's processing as well.

The charges and Poste's defence

On July 16, 2025, by note no. 99987, the office notified Poste that proceedings had started. The notice covered the correct identification of the controller and the principles of lawfulness and transparency in the information given to applicants within the collaboration with the bank, citing Articles 5(1)(a), 13 and 28 of the GDPR. Poste asked for more time on August 1, 2025 and received an extension to September 15, 2025 (note no. 109001 of August 5, 2025). Its written defence arrived on that date.

That defence is the most unusual part of the file. Can a privacy notice be too complete to be read? Poste argued, in effect, that it can. It said that "the processing does not present particular or anomalous features compared with the typical processing carried out not only by the Company" but also by others active in managing and brokering loan applications. To comply with the GDPR's requirement for concise and transparent information in Article 12(1), and with the transparency guidelines adopted by the Article 29 Working Party, and to avoid "the risk of information overload", Poste said it chose to "favour a concise approach" when providing the information required by Article 13.

The reasoning went further. Poste said it decided to favour "efficiency, so as to increase the probability that the Complainant would actually read and analyse the Notice with due attention" over "effectiveness (that is, providing the Complainant herself with an extremely detailed Notice on the individual aspects of the Processing)", given that the processing was standardised and that the applicant was simultaneously handed "an already substantial body of documents" connected with the loan request.

Then the phrase that gives the case its character. Poste said that, "having identified a concrete risk of so-called 'privacy fatigue' phenomena (understood as a sense of discouragement and psychological tiredness of the data subject with respect to the complexity and number of materials to view and tasks to manage in relation to the protection of their personal data)", it "considered it appropriate to draft the Notice in more general and concise terms, but more immediately usable." It relied on the accountability principle and on data protection by design, arguing that the content of a notice must be defined case by case by the controller.

"Without this in any way constituting an admission of liability," Poste said it had updated its notice in 2025 with "a more granular description of the processing of customers' personal data" and that a specific notice on credit intermediation was being drafted.

On the roles, Poste's line was that the appointment of the bank as processor "was the result of an assessment carried out by the Bank itself and the Company in an early phase of application of the Regulation and in a condition of significant legal uncertainty." If the roles turned out to be wrong, Poste argued, the mistake "should be qualified as the result of an error of legal analysis committed by the Bank and the Company in total good faith and in the absence of a clear, consolidated and unequivocal reference practice and/or decision-making on the subject." It had opened "a working table with the Bank to review the existing contractual agreements on personal data protection and consequently overcome the qualification of the Bank itself as processor."

Poste also defended its own processor role. Explaining to a customer why a loan was refused is, in Poste's account, one of the tasks the lender entrusts to the credit intermediary. It pointed to Article 121(1)(h) of Italy's Consolidated Banking Act (legislative decree no. 385 of September 1, 1993) and described an "indispensable advisory component" of intermediation: helping the customer prepare a request, understand why it was rejected, and identify a new request with additional personal or real guarantees, or other credit products better suited to the customer.

What the Garante decided on roles

The decision notes first that the investigation, though triggered by a complaint, was extended by the office on its own initiative to look more generally at the processing of data in the promotion and placement of the BancoPosta product. It also records that Poste deleted the complainant's data and told her promptly. The broader questions were three: the roles of Poste and the bank, the data exchanged between them, and the notice given to applicants under Article 13.

The Garante's starting point is the legal framework for BancoPosta. Presidential decree no. 144 of March 14, 2001, which regulates Poste's financial activity with the public, bars Poste from granting loans to the public. It allows Poste to promote and place banking and financial products off-premises as an intermediary for banks and finance companies, under specific agreements (Article 2, paragraphs 8 and 9-bis).

From there, the authority separated the two businesses. During application and verification, Poste collects and checks data on applicants and any co-obligors, partly to place the financial product that best fits the applicant's needs and means. It sends the data to the bank and, where the applicant holds a Poste current account, also transmits aggregated indicators drawn from existing relationships with Poste, such as average balance and current account balance. At the end, Poste tells the applicant the outcome.

The bank, as lender, assesses creditworthiness and takes the decision, which the verification form describes as "subject to the exclusive, discretionary and unquestionable judgment of the Bank". Under Articles 120-undecies(1) and 124-bis(1) of the Consolidated Banking Act, that makes the bank the entity that determines the purposes and means of the processing, and so an independent controller under Article 4(7) of the GDPR.

Poste, in turn, keeps its own controllership within a separate relationship with the customer. That relationship continues even after a refusal by the bank, when Poste can propose other financing, including from other banks, better suited to the customer's needs and credit situation. Both companies therefore process the data as independent controllers, each on the basis of its own contract with the customer, within the limits of what is necessary to perform a contract or take pre-contractual steps at the customer's request under Article 6(1)(b).

The authority anchored this in the European Data Protection Board's Guidelines 07/2020 on the concepts of controller and processor, adopted on July 7, 2021. It quoted paragraph 12, in the Italian version: "The roles of controller and processor are functional concepts: they aim to allocate responsibilities according to the roles actually performed. This implies that the legal status of an actor as a 'controller' or 'processor' must, in principle, be determined by the activities actually carried out in a specific situation, rather than by its formal designation as 'controller' or 'processor' (for example in a contract)."

The conclusion is direct. The choice of Poste and the bank to appoint each other as processors under Article 28, "although an expression of precise choices made by them and documented by 'Conventions' signed by both", corresponds neither to the legal definition of a processor as the entity "that processes personal data on behalf of the controller", nor to the facts. Each company communicates data not in the other's interest "but by each for its own purposes". The Garante did not describe the two as joint controllers under Article 26 either. It found two separate controllers, each responsible on its own for the lawfulness, fairness, transparency and relevance of its processing.

"The subjective qualification proposed by Poste and the Bank does not, therefore, correspond to the factual reality of the processing, with immediate repercussions also on the compliance [...] of the notice provided to data subjects," the decision states.

Concision is not an alternative to completeness

On the notice itself, the Garante did not dispute that a controller has discretion over the form and content of the information it provides. It did dispute the trade-off Poste said it had made.

The transparency principle in Article 5(1)(a), the decision says, "is not purely formal, nor does it constitute a mere bureaucratic fulfilment, but enshrines the right of the data subject to clearly understand all aspects relating to the processing of their data." A notice that complies with Article 12(1) has to be clear and concise and avoid an excess of information. At the same time it must be effective, "that is, capable of making the data subject truly aware of the processing of their data, its purposes, the possible risks, the protections recognised and the ways in which they can exercise control over the information flows concerning them."

Then the sentence that answers the privacy fatigue argument: "The application of the principle of 'concision' and completeness are not, in fact, alternative requirements; for the notice to be considered adequate, both must be respected; therefore, the choice to favour one aspect over the other does not satisfy the requirements."

The authority cited Recital 60 of the GDPR and the transparency guidelines, under which information must be concrete and "should not be formulated in abstract terms". It also pointed to the Bank of Italy's provisions on the transparency of banking and financial services of July 29, 2009, as amended, which require banks to inform customers "in a correct, clear and exhaustive manner as well as adequate [...] to the characteristics of the services and the clientele."

Because the roles were wrong, the notice was wrong too. For the BancoPosta product, the decision says, Poste's notice should have identified the recipients or categories of recipients of applicants' data, as Article 13(1)(e) requires, along with the further information needed to ensure fair and transparent processing. The Garante found that Poste had breached Articles 5(1)(a) and 13. Article 28, cited when the proceedings opened, does not appear in the final finding.

How the €48,000 was set

The breaches fall under Article 83(5)(a) and (b) of the GDPR, the tier that carries a maximum of €20 million or 4% of worldwide annual turnover. On corrective measures under Article 58(2), the authority took note of Poste's statement that it had already adopted measures to bring the processing into line. Unlike the bank, Poste received no order to change its notice by a deadline.

The decision lists the factors weighed under Article 83(2):

  • Gravity: the breaches concern general principles, fairness and transparency, and affected "all customers who requested financing relating to products placed by BancoPosta". The decision gives no figure for how many people that is.
  • Intent: the breach was negligent, the result of a wrong interpretation of the roles in certain phases of the BancoPosta loan process.
  • Mitigation: Poste deleted the complainant's data and told her promptly, updated its notice with a more detailed and clearer description of the processing, and opened the working table with the bank.
  • History: no previous decisions by the authority against Poste for the same type of case, and no complaints similar to this one.
  • Cooperation: Poste cooperated during the proceedings.

The fine is €48,000. Poste must pay within 30 days of notification of the decision, or it can settle by paying half, €24,000 by PPC Land's calculation, within the deadline for an appeal under Article 10(3) of legislative decree no. 150 of September 1, 2011. An appeal can be lodged with the ordinary court within 30 days of notification, or 60 days for an appellant living abroad. The Garante ordered the breaches noted in its internal register under Article 17 of its Regulation no. 1/2019 and the decision published on its website. The decision was signed in Rome by president Pasquale Stanzione, who was also the rapporteur, and secretary general Luigi Montuori. Vice president Ginevra Cerrina Feroni and board member Agostino Ghiglia took part in the meeting.

The parallel decision against Deutsche Bank

The same complaint produced a second injunction order on the same day. In decision no. 746 of October 7, 2026, the Garante fined Deutsche Bank S.p.A. €33,000, also for breaching Articles 5(1)(a) and 13, because its notice did not correctly reflect Poste's role as a recipient of data and an independent controller. The bank was ordered to bring its notice into line within six months. Together, the two fines come to €81,000, by PPC Land's calculation. The Garante's newsletter of October 23, 2026 presented both decisions in a single item on BancoPosta loans.

The Poste decision itself makes no finding on the visibility of the complainant's income and financial commitments to colleagues on the loan platform, the issue that triggered the complaint. Its findings concern the roles and the notice.

A second Poste case this year

This is not Poste's only encounter with the Garante in 2026. On April 20, 2026, Sky TG24 and Teleborsa reported that the authority had fined Poste Italiane €6,624,000 and its subsidiary Postepay €5,877,000, more than €12.5 million in total, over the BancoPosta and Postepay apps. According to those reports, the apps made it a condition of use that customers authorise monitoring of data on their mobile devices, including installed and running apps, to detect malware, and the Garante considered the monitoring not strictly necessary for fraud prevention. Sky TG24 reported that Poste would ask the Tribunal of Rome to annul that decision.

The October decision does not mention the April case. Its statement that there were no previous decisions against Poste refers to the same type of case, not to any decision at all.

Why the label in a contract matters beyond banking

The amount is small. The reasoning is not limited to loans.

Data processing agreements that call one party a processor are standard in advertising and marketing, where retailers, publishers, agencies, measurement firms and data partners exchange customer data every day. The Garante's approach is the functional test the EDPB set out in 2021: if each party uses the data for its own purposes, each is a controller, and the paperwork cannot change that. A processor label that does not match the facts has consequences beyond the contract, because it shapes what the privacy notice tells people about who receives their data.

The Italian authority applied similar logic in a much larger case only weeks earlier. In September 2026, it fined IQVIA €7 million over a database built from the records of about one million patients, holding that IQVIA was the controller from collection despite the company's framing of the data flow. The question of how controller relationships are disclosed is also before the Court of Justice of the European Union: a German court asked the CJEU whether platforms must publish the essence of their joint controller arrangements on their websites, a reference lodged in April 2026 that remains pending.

Processor arrangements have carried heavy penalties elsewhere. In July 2025, Poland's data protection authority fined McDonald's Polska about €3.89 million over failures to oversee a processor running an employee scheduling system, and fined the processor itself. In advertising technology, Norway's Datatilsynet decided on October 2, 2026 to fine Xandr NOK 92 million over Grindr data.

Credit data is a recurring theme. A Berlin court in May 2026 upheld a regulator's warning against a solar installer that ran Schufa checks before site visits without a valid basis under Article 6(1)(b) or (f), and found a stale privacy notice in breach of Article 25(1). In Austria, the data protection authority ruled in September 2025 that a fully automated credit score breached the GDPR's ban on solely automated decisions.

Italy's banking sector has seen far larger fines this year. The Garante fined Intesa Sanpaolo €17.6 million for profiling about 2.4 million customers to select them for transfer to its digital subsidiary Isybank, rejecting the bank's legitimate interest basis, and separately fined Intesa Sanpaolo €31.8 million after one employee accessed the records of 3,573 customers. Fines do not always survive: a Rome court annulled the Garante's €15 million fine against OpenAI in March 2026 on jurisdictional grounds, and Alliance Risk data reported by PPC Land put about 40% of the €7.1 billion in announced GDPR fines as annulled or under challenge.

The privacy fatigue argument deserves a final note. Poste did not claim the missing information was unimportant. It claimed that giving more of it would make people less likely to read anything at all. That is a familiar position across consent banners, layered notices and app permission screens. The Garante's answer is that the trade-off is not available to the controller. Brevity is required, and so is completeness, and choosing one does not excuse the other.

Timeline

Summary

Who: Italy's data protection authority, the Garante per la protezione dei dati personali, and Poste Italiane S.p.A., the Italian postal operator, which places BancoPosta loans funded by Deutsche Bank S.p.A. The case began with a complaint by a Poste employee whose loan application was refused.

What: The Garante fined Poste Italiane €48,000 for breaching Articles 5(1)(a) and 13 of the GDPR. It found that Poste and Deutsche Bank had wrongly appointed each other as processors in their BancoPosta agreement when both act as independent controllers, and that Poste's notice to loan applicants consequently failed to identify the recipients of their data. It rejected Poste's argument that a shorter notice was justified to avoid "privacy fatigue", holding that concision and completeness are not alternatives. Deutsche Bank was fined €33,000 in a parallel decision.

When: The decision, no. 747, was adopted on October 7, 2026 and featured in the Garante's newsletter no. 554 of October 23, 2026. The complaint dates from January 5, 2024; proceedings against Poste were opened on July 16, 2025.

Where: Italy. The complaint concerned a post office in Portacomaro Stazione, in the province of Asti, but the findings cover the BancoPosta loan process for all applicants.

Why: The decision applies the EDPB's functional test for controllers and processors to a distribution partnership in which each company uses shared customer data for its own purposes. The same contractual labels are common in advertising and marketing data partnerships, and the ruling shows the Garante testing those labels against the facts, then holding the privacy notice to the result.