Finance
Italy fines intesa sanpaolo 18 million euros for illicit processing of customer data
Published by Global Banking & Finance Review®
Posted on March 12, 2026
2 min readLast updated: March 12, 2026
Quick Summary
Italy’s data protection authority fined Intesa Sanpaolo €17.6 million for improperly migrating around 2.4 million customers to its digital unit, Isybank, without sufficient communication or consent.
Intesa Sanpaolo Fined €18M for Illegally Processing Customer Data in Italy
Details of the Data Protection Authority's Fine Against Intesa Sanpaolo
Background of the Fine
MILAN, March 12 (Reuters) - Italy's data protection authority said on Thursday it had fined Italy's biggest bank Intesa Sanpaolo 17.6 million euros for illicit processing of data of around 2.4 million customers the bank unilaterally moved to its digital unit Isybank.
Intesa had no immediate comment.
Profiling and Data Processing Practices
Criteria Used for Profiling
The watchdog said the bank profiled clients according to factors such as being under 65 years old, the frequency of their digital-channel use, and their investment products and financial holdings.
Consequences for Customers
This profiling led to consequences for the customers which included the possible transfer of their accounts to a different data controller and unilateral changes to contractual terms.
Communication Issues with Customers
Inadequate Notification Methods
The authority found that communication with customers about the migration was inadequate, with information often sent during the summer and placed in the app's archive section without push alerts.
Factors Influencing the Fine
Scope and Cooperation
Number of Customers Affected
In setting the fine, the agency said it took into account the large number of customers affected, while also considering the bank's non-intentional conduct and its cooperation during the investigation.
(Reporting by Elvira Pollina, editing by Gavin Jones)
Key Takeaways
- •The Italian DPA ruled the bank unlawfully processed customer data by profiling users and transferring accounts based on age, digital activity and holdings without clear legal basis or adequate notice.
- •Communications were deemed insufficient—often buried in the app archive and sent during summer without push alerts—failing GDPR transparency obligations.
- •While the penalty was hefty, the authority considered Intesa’s cooperation and lack of intent; this follows other major GDPR fines in Italy, such as Enel Energia’s €79 million and OpenAI’s €15 million.
Frequently Asked Questions about Italy fines Intesa Sanpaolo 18 million euros for illicit processing of customer data
1Why was Intesa Sanpaolo fined by Italy's data protection authority?
Intesa Sanpaolo was fined for illicitly processing the data of about 2.4 million customers by unilaterally moving them to its digital unit Isybank.
2How much was the fine imposed on Intesa Sanpaolo?
Italy's data protection authority imposed a fine of 17.6 million euros on Intesa Sanpaolo.
3What wrongdoing did Intesa Sanpaolo commit regarding customer data?
The bank profiled customers based on age, digital usage, and financial activities, moved them to a different data controller, and made unilateral changes to their contracts, with inadequate communication.
4How many customers were affected by Intesa Sanpaolo's actions?
Approximately 2.4 million customers were affected by the data processing and migration to Isybank.
5How did the authority determine the amount of the fine against Intesa Sanpaolo?
The authority considered the large number of clients affected, the bank's non-intentional conduct, and cooperation during its investigation.