MILAN (Reuters) – Italy’s data protection authority said on Tuesday Intesa Sanpaolo had underestimated the seriousness of a data breach incident involving thousands of customers, widely reported to include Prime Minister Giorgia Meloni.
Last month the authority asked the bank to provide clarification over the case involving an Intesa employee who allegedly accessed the data of about 3,500 clients.
At the time, Intesa said the employee had been suspended pending the results of a criminal investigation, and that it had informed the data protection authority and was also probing the matter internally.
But the authority said in a statement on Tuesday that the bank had not adequately informed it about the extent of the breach, which became apparent later thanks to press reports and was only confirmed subsequently by Intesa.
“Contrary to the bank’s assessment… the breach of the personal data represents a high risk for the rights and the freedoms of the individuals concerned,” the authority said.
It said the potential consequences of the breach had included disclosure of information on the financial status of individuals and reputational damage.
The data protection watchdog instructed the bank to inform all customers whose data has been violated within 20 days.
It said it would assess the adequacy of the security measures the bank has put in place and ordered it to provide feedback within 30 days.
Intesa said in a statement it had already started working to respond to the authority’s requests.
It said ensuring the highest level of security for its customers’ data was a priority and it had already enhanced its systems and control procedures.
Intesa also said that the number of the affected customers was lower than was initially indicated by press reports, without giving a figure, and there was no evidence the data had been shared outside the bank.
(Reporting by Elvira Pollina, additional reporting by Valentina Za, editing by Alvise Armellini and Gavin Jones)