Intesa Sanpaolo Fined €17.6 Million by Italian Privacy Authority Over Isybank Transfers

Milan, Italy – On March 13, 2026, the Italian Data Protection Authority (Garante per la protezione dei dati personali) imposed a record fine of €17.628 million on Intesa Sanpaolo for unlawfully processing the data of approximately 2.4 million customers transferred to its digital subsidiary, Isybank.

The Investigation and Findings

The fine stems from an investigation initiated following numerous complaints from account holders. The Garante found that Intesa Sanpaolo engaged in customer profiling without a proper legal basis to identify individuals for transfer to Isybank, a fully digital bank within the Intesa Sanpaolo Group. Virgilio and Teleborsa reported on the ruling.

Customer Profiling Criteria

The profiling process targeted customers deemed “predominantly digital,” based on criteria including:

• Age not exceeding 65 years
• Habitual use of digital channels in the last year
• Absence of investment products
• Financial holdings below €100,000
• No existing legal issues such as seizures or bankruptcies

According to the Garante, this profiling significantly impacted customers, leading to a unilateral transfer of their accounts and a modification of contractual terms and operating procedures. HelpConsumatori detailed these concerns.

Insufficient Communication

The Authority also criticized Intesa Sanpaolo for inadequate communication regarding the transfers. Notifications were often sent during the summer months and buried within the archive section of the Intesa Sanpaolo app, failing to adequately inform customers about the significant changes to their accounts. The Garante stated that customers could not reasonably anticipate such a transfer based on the information provided.

The Authority’s Response

In determining the amount of the fine, the Garante considered the severity of the violations, the large number of customers affected, the negligent nature of the transgressions, and the bank’s cooperation during the investigation. Intesa Sanpaolo is now required to implement corrective measures to protect the rights of affected users.

Isybank Privacy Information

Isybank provides information regarding its data management practices on its privacy page. Isybank Privacy Policy