Italy Fines Poste Italiane and Postepay €12.5 Million Over App Monitoring
Summary
Italy’s data protection regulator fined Poste Italiane and Postepay €12.5 million over monitoring by the Postepay and BancoPosta apps, citing invasive processing, inadequate disclosure and safeguards, and excessive data retention.
Key points
- The regulator fined Poste Italiane €6.6 million and its digital-payments subsidiary Postepay €5.9 million.
- The investigation focused on the Postepay and BancoPosta apps, which monitored installed and running applications on users’ devices.
- The companies said the monitoring was intended to detect malicious software, protect transactions, and meet payment-services rules.
- The regulator said the monitoring was excessively invasive and unnecessary for fraud prevention.
- The regulator also cited inadequate information for users, insufficient security safeguards, and excessive data retention.
Article Details
- Event Type
- Regulatory fines for alleged personal data privacy violations
- Impact
- Italy’s data protection regulator fined Poste Italiane SpA €6.6 million and Postepay SpA €5.9 million, totaling €12.5 million, over the alleged unlawful processing of millions of users’ personal data. The regulator said the Postepay and BancoPosta apps monitored installed and running applications on users’ devices; it found the monitoring excessively invasive, insufficiently disclosed, and unnecessary for fraud prevention, and cited inadequate security safeguards and excessive data retention. The companies said the monitoring was intended to detect malicious software, protect transactions, and comply with payment-services rules.
Products
BancoPostaThe regulator said the Postepay and BancoPosta apps required users to authorize monitoring of installed and running applications in a way it deemed excessively invasive, insufficiently disclosed, and not necessary forPostepayItaly’s data protection regulator fined Poste Italiane SpA â¬6.6 million and Postepay SpA â¬5.9 million, totaling â¬12.5 million, for allegedly illegally processing millions of users’ personal data through invasive