Italian Data Protection Authority fines AgID and Poste Italiane

The Italian Data Protection Authority (Garante Privacy) has issued several fines against public and private entities for violations of the GDPR and national privacy laws.

Agenzia per l'Italia Digitale (AgID) was fined 15,000 euros following the unlawful publication of personal data belonging to candidates in a public competition for the Smarter Italy program. The agency failed to remove a list containing names and scores of fifteen candidates from its transparency portal, despite a removal request made in 2021. The violation persisted for approximately five years until the data was finally removed in January 2026.

Additionally, the Authority sanctioned Poste Italiane and Deutsche Bank regarding BancoPosta loan applications. Poste Italiane received a 48,000 euro fine for failing to adequately inform applicants about how their data was processed and shared. Deutsche Bank was fined 33,000 euros for failing to correctly identify Poste Italiane as an independent data controller in its privacy notices. The investigation was triggered by a complaint from an employee who discovered her personal financial information, including net income, was accessible to certain corporate operators on an internal platform.