Italian Data Protection Authority fined a bank EUR 33,000
The case shows that a contractual label describing a participant as a processor cannot replace an assessment of the actual allocation of purposes, means and responsibility for processing. The full text of the decision in the Judykatura database sets out a cooperation model between a financing bank and an intermediary serving customers applying for loans. The Italian Data Protection Authority found that the parties acted as independent controllers and that the bank had breached its duties of fairness and transparency.
The rest of this analysis, all theses and the full text of the ruling are available with an AKTUALNOŚCI PLUS subscription.
Find out how EU supervisory authorities, administrative and civil courts and the CJEU reason their decisions — and keep your organisation aligned with current case law.