Privacy, the Authority fines Poste Italiane and Postepay: over 12.5 million for unlawful processing
The Personal Data Protection Authority has imposed total fines exceeding 12.5 million euros on Poste Italiane and its subsidiary Postepay , following an investigation launched in April 2024 after numerous user reports.
In detail, the fine amounts to 6.624 million euros for Poste Italiane and 5.877 million for Postepay. The Authority noted unlawful processing of personal data of millions of users , primarily related to the operational methods of the BancoPosta and Postepay applications.
At the heart of the accusation is the requirement imposed on users to authorize the monitoring of their mobile devices in order to use the services . This activity included the collection of information about installed and running applications, with the stated goal of detecting potential cyber threats and preventing fraud.
According to the Authority, however, this approach involved an excessive intrusion into users' private sphere . While acknowledging the need for security measures in payment services, the Authority determined that the level of monitoring adopted was not strictly necessary or proportionate to the stated objectives.
The investigation also revealed further violations of data protection regulations . Among these:
- Incomplete or unclear user information
- Lack of an adequate data protection impact assessment (DPIA)
- Inadequate security measures
- Shortcomings in data retention policies
- Irregularities in the designation of data processors
These elements contributed to outlining an overall picture of non-compliance with GDPR requirements.
In addition to the financial penalties, the Authority ordered both companies to stop the contested processing , if they have not already done so, and to comply with the requirements regarding the management and retention of personal data, with an obligation to notify the Authority.
Poste Italiane has already announced its intention to appeal the ruling . The legal front remains open.