Log in or register
Share on LinkedInShare on LinkedIn

ARTICLE · 15 APRIL 2026

Insider Threat In Focus: A €31.8m Lesson In Breach Transparency And Risk

Lewis Silkin
Lewis Silkin
Contributor
Lewis Silkin

Lewis Silkin

Joint managing partners: Jo Farmer, Richard Miskella International offices: Dublin, Hong Kong...

View firm profile
Explore more from Lewis Silkin

An employee at Intesa Sanpaolo unlawfully accessed thousands of customer records over two years, leading to a €31.8 million fine from Italy's data protection authority. The ruling underscores that insider threats demand proactive, risk-based controls and that unauthorised access alone—even without data extraction—triggers serious breach notification obligations under GDPR.

ItalyPrivacy
Zahra Laher
Zahra Laher
Author LinkedIn connections

Overview

An employee at one of Italy's largest banks, Intesa Sanpaolo S.p.A. (the Bank), spent more than two years unlawfully accessing the financial records of thousands of customers, including politically exposed persons, without any legitimate work-related justification. When the breach eventually came to light, the bank notified the Italian DPA, the Garante per la protezione dei dati personali (the "Garante"), with an incomplete account of the incident and chose not to inform "all" affected individuals.

In a decision imposing a €31.8 million fine on the Bank, the Garante delivered a clear and uncompromising message: insider access risks require proactive, risk‑based controls, and a personal data breach cannot be minimised simply because personal data was viewed rather than extracted.

We operate a free-to-view policy, asking only that you register in order to read all of our content. Please login or register to view the rest of this article.

Register for freeORLog in

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.

View source

Related Articles

Legal Intelligence Newsletters: sign up for the latest legal and regulatory news on your chosen topics

Read more about

Related Comparative Guides

See more popular content from

Article

Pseudonymised, Not Anonymous: What The Italian Garante’s €7 Million IQVIA Fine Means For Health Data

The Italian data protection authority fined IQVIA Solutions Italy €7 million for treating patient records as anonymous when they were actually pseudonymised personal data subject to GDPR. This decision demonstrates regulators' strict interpretation of what constitutes personal data, even as the EU considers narrowing this definition through the Digital Omnibus reforms.
GlobalPrivacy
Arnold & Porter
Arnold & Porter
Article

Tracking Pixels In Emails: The Garante’s New Guidelines And Requirements For Businesses

The Italian Data Protection Authority has issued comprehensive guidelines on tracking pixels in email communications, establishing strict transparency and consent requirements for both public and private entities. Organizations now face a six-month compliance deadline to overhaul their email marketing practices, update privacy notices, and implement granular consent mechanisms for these invisible tracking tools.
ItalyPrivacy
A&O Shearman
A&O Shearman
Article

Tracking Pixel And Email: New Guidelines Issued By The Italian Data Protection Authority To Be Implemented By 29 October 2026

On 17 April 2026, the Italian Data Protection Authority ( Garante per la protezione dei dati personali ) (“ Italian DPA ”) adopted the “ Guidelines on the Use of Tracking Pixel in email Communications ” ( doc. web n. 10241943 ), which set out the applicable legal framework, transparency obligations and conditions for obtaining consent for all entities using tracking pixels.
ItalyPrivacy
Chiomenti
Chiomenti
Article

EU KIDS Act: Brussels Rewrites The Rules For Digital Services For Minors

The European Commission's proposed EU Kids Act introduces sweeping new requirements for digital service providers, establishing a harmonised age threshold of 15 for social media access and mandating safety-by-design principles across online platforms. This comprehensive regulatory framework fundamentally reshapes how providers must verify ages, design interfaces, and protect minors in the digital space, with sanctions reaching up to 6% of worldwide annual turnover for non-compliance.
European UnionPrivacy
ADVANT Nctm
ADVANT Nctm
Article

Revised Earned Settlement Policy To Be Unveiled Before The End Of 2026

The UK Home Secretary has confirmed that the revised earned settlement policy will be published before the end of 2026, following her appearance before the Home Affairs Committee. This announcement provides clarity on the timeline for implementing significant changes to the UK immigration system, including transitional arrangements and the extension of the default settlement period from five to ten years.
United KingdomImmigration
Lewis Silkin
Lewis Silkin
Article

Summary Of Autumn 2026 Immigration Rule Changes

The UK Home Office has introduced significant changes to its Immigration Rules, including new protections for Skilled Worker visa holders who are victims of modern slavery, measures to prevent abuse of fee waiver processes, and updates to support the UK's participation in Erasmus+ from January 2027. These changes also expand permitted activities for visitors coming to the UK for training or creative purposes.
United KingdomImmigration
Lewis Silkin
Lewis Silkin
Article

What The 2026 Policy Address Means For Employers In Hong Kong

Hong Kong's Chief Executive has unveiled sweeping employment law reforms in the 2026 Policy Address, introducing statutory protections for delivery workers, tightening imported labour controls, and accelerating MPF system changes. These measures reflect the Government's commitment to protecting local workers while addressing the challenges of an ageing workforce and evolving labour market dynamics.
Hong KongEmployment and HR
Lewis Silkin
Lewis Silkin
Article

Hong Kong Cracks Down On Unpaid Wages With Director Sentencing

A Hong Kong director was sentenced to 120 hours of community service and ordered to pay HK$93,000 in outstanding wages after her companies failed to pay employees on time. The case demonstrates that corporate officers can face serious criminal liability, including fines up to HK$350,000 and three years' imprisonment, when employment law breaches occur with their consent, connivance, or neglect.
Hong KongEmployment and HR
Lewis Silkin
Lewis Silkin
Article

Game Developer And Publisher Battle Over Step In Rights

A High Court ruling examines a contentious dispute between a video game developer and publisher over milestone-based funding and "step in" rights for the first-person shooter Six Days in Fallujah. With over $50 million in development costs at stake and allegations of conspiracy to acquire proprietary source code, the court declined to grant either party interim control of the game's development, leaving both sides without the "keys to the kingdom" pending a full trial.
United KingdomLitigation, Mediation & Arbitration
Lewis Silkin
Lewis Silkin
Article

You're Owed Money. Now What? – A Practical Guide To Debt Recovery In Hong Kong

Hong Kong's debt recovery landscape has become increasingly challenging, with corporate insolvencies rising 45% in 2025 and bankruptcy petitions climbing to over 10,000. This comprehensive guide explores the legal pathways available to creditors, from initial demand letters to enforcement mechanisms, and examines when civil litigation versus insolvency proceedings may be the most effective strategy for recovering outstanding debts.
Hong KongInsolvency/Bankruptcy/Re-Structuring
Lewis Silkin
Lewis Silkin