A PYMNTS Company

Italy’s Data Protection Authority Criticizes Intesa’s Handling of Customer Data

By  |  November 5, 2024

Italy’s data protection authority has taken a firm stance against Intesa Sanpaolo, the country’s largest bank, accusing it of downplaying the severity of a recent data breach that potentially exposed sensitive information belonging to thousands of customers, including Italy’s Prime Minister Giorgia Meloni. According to Reuters, the authority voiced concerns on Tuesday that Intesa Sanpaolo’s initial response underestimated the risk and scale of the breach, which reportedly involved unauthorized access by a bank employee to around 3,500 client records.

    Get the Full Story

    Complete the form to unlock this article and enjoy unlimited free access to all PYMNTS content — no additional logins required.

    yesSubscribe to our daily newsletter, PYMNTS Today.

    By completing this form, you agree to receive marketing communications from PYMNTS and to the sharing of your information with our sponsor, if applicable, in accordance with our Privacy Policy and Terms and Conditions.

    The breach first came to light last month when the authority demanded clarification from Intesa regarding the incident. The bank had confirmed that an employee, who allegedly accessed clients’ personal data without authorization, was suspended pending a criminal investigation. According to the bank, it promptly notified authorities and initiated an internal probe. However, the data protection authority indicated that information about the scope of the breach only emerged through press reports, with full confirmation from Intesa coming much later, according to Reuters.

    “Contrary to the bank’s assessment… the breach of the personal data represents a high risk for the rights and freedoms of the individuals concerned,” the authority stated, per Reuters. The watchdog warned that the breach could have significant repercussions for affected customers, potentially impacting their financial status and damaging their reputations.

    In its directive, the authority instructed Intesa Sanpaolo to notify all affected customers within 20 days, ensuring transparency regarding any data that might have been exposed. Furthermore, the bank has been ordered to submit a detailed report on its security measures within 30 days, allowing the authority to assess whether its protections for sensitive customer data meet regulatory standards.

    In response, Intesa Sanpaolo asserted its commitment to safeguarding customer data. The bank released a statement saying it is actively cooperating with the regulator’s requests and is already enhancing its data protection protocols. “Ensuring the highest level of security for our customers’ data remains a top priority,” the statement read, according to Reuters.

    The breach, one of the most prominent in Italy involving sensitive personal and financial data, has intensified calls for improved cybersecurity practices within financial institutions.

    Source: Reuters