Italy Fines Poste Italiane and Postepay Over Intrusive App Data Collection
Summary
Italy’s data protection authority fined Poste Italiane €6.6M and Postepay €5.8M over disproportionate app data collection, ordering the practices stopped and retention corrected. The article also covers a €31.8M Intesa Sanpaolo fine over repeated insider access.
Key points
- The Italian Data Protection Authority fined Poste Italiane €6.6 million and Postepay €5.8 million over their handling of users’ personal data.
- BancoPosta and Postepay apps collected information including lists of installed and active apps; the companies said this supported malware detection and fraud prevention.
- The regulator found the monitoring disproportionate and ordered the companies to stop the practices if ongoing, align data retention, and report compliance.
- The investigation cited inadequate transparency, an insufficient Data Protection Impact Assessment, weak security measures, and unclear data-controller responsibilities.
- Separately, the authority fined Intesa Sanpaolo €31.8 million after an employee accessed more than 3,500 customers’ records over 6,600 times without a legitimate business reason.
- The article says the bank’s monitoring failed to detect repeated unauthorized access for months.
Article Details
- Event Type
- Italian Data Protection Authority enforcement action and fines for unlawful personal data processing
- Impact
- Poste Italiane was fined €6.6 million and Postepay €5.8 million over intrusive monitoring through the BancoPosta and Postepay apps, affecting millions of users. The Authority found the monitoring disproportionate and cited transparency, impact-assessment, security, retention, and data-controller responsibility failures. It ordered the companies to stop the disputed processing if ongoing, align data retention with regulatory requirements, and report compliance.
Products
BancoPostaBancoPosta and Postepay apps collected intrusive device data, including installed and active app lists, claiming it was for malware detection and fraud prevention.PostepayThe Italian Data Protection Authority fined Poste Italiane â¬6.6 million and Postepay â¬5.8 million—over â¬12.5 million in total—after finding unlawful processing of millions of users’ personal data via intrusive app