Share on LinkedInShare on LinkedIn

ARTICLE · 01 MAY 2026

Two-Minute Recap - Data Protection Law Matters - Around The Globe - 2026 March

Gen Temizer Erdogan Girgin Attorney Partnership
Gen Temizer Erdogan Girgin Attorney Partnership
Contributor
Explore more from Gen Temizer Erdogan Girgin Attorney Partnership

Italy's data protection authority imposed one of its largest banking-sector fines after a single Intesa Sanpaolo employee made over 6,600 unauthorised queries of 3,573 customer accounts -including high-profile public figures - between February 2022 and April 2024 without triggering a single internal alert.

GlobalPrivacy

Italian DPA Fines Intesa Sanpaolo €31.8M for Two-Year Insider Breach

Italy's data protection authority imposed one of its largest banking-sector fines after a single Intesa Sanpaolo employee made over 6,600 unauthorised queries of 3,573 customer accounts -including high-profile public figures -between February 2022 and April 2024 without triggering a single internal alert. The Garante found violations of Articles 32 (inadequate technical and monitoring controls), 33 (delayed and incomplete breach notification), and 34 (failure to communicate the breach to affected individuals until ordered to do so). The fine signals that regulators are scrutinising inward-facing controls as closely as perimeter defences. Financial institutions holding large customer datasets should urgently audit behavioural analytics and insider-threat detection capabilities.

We operate a free-to-view policy, asking only that you register in order to read all of our content. Please login or register to view the rest of this article.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.

See more popular content from