Italy's privacy regulator fines Intesa Sanpaolo €17.6m for profiling 2.4m customers to move them to Isybank

What happened?

Intesa Sanpaolo created Isybank, a branchless digital bank, and transferred to it the accounts of customers in a segment it called "predominantly digital": about 275,000 customers in a first business unit on 16 October 2023 and about 2.1 million more planned for 18 March 2024, roughly 2.4 million in all. The Garante opened its investigation after five complaints, three reports from customers and a report from the consumer association Unione Nazionale Consumatori covering hundreds of consumers.[1][2]

In its press release the Garante said: "Per individuare tra i propri clienti quelli da trasferire nella neo-istituita Isybank, Intesa Sanpaolo ha effettuato, senza un'idonea base giuridica, una profilazione della clientela" ("To identify which of its customers to transfer to the newly established Isybank, Intesa Sanpaolo carried out a profiling of its customers without an adequate legal basis"; our translation). The criteria included age not above 65, habitual use of digital channels in the previous year, no investment products and financial holdings below a threshold, which the bank told the Garante was €100,000. Per the order, these extractions were carried out with automated systems because of the number of customers involved.[1][2][3]

The Garante found the transfer significantly affected customers: it moved their accounts to a different data controller and unilaterally changed contract terms and how the current account worked, including a new IBAN, no physical branches and access only through the app. It rejected the bank's legitimate-interest assessment as lacking a concrete balancing test, and found that the privacy notice did not adequately explain the profiling, its logic or its consequences.[1][4]

Notices about the transfer were judged inadequate: according to the Garante they were sent mostly during the summer to the archive section of the Intesa Sanpaolo app, without the prominence, such as push notifications or text messages, that an extraordinary operation required, so customers could not reasonably foresee the processing.[1][3]

When did it happen?

1. Oct 16, 2023

   About 275,000 'predominantly digital' customers' accounts are transferred from Intesa Sanpaolo to Isybank in a first business unit.[2]

2. Nov 16, 2023

   The Garante sends Intesa Sanpaolo its first request for information about the Isybank operation.[2]

3. Mar 18, 2024

   Planned transfer of about 2.1 million further customers to Isybank.[2]

4. Mar 12, 2026

   The Garante fines Intesa Sanpaolo €17,628,000 for unlawful profiling and inadequate information (order no. 163).[1][3]

5. Oct 2026

   The Garante's website shows the order as temporarily removed while a court challenge (giudizio di opposizione) against it is pending.[2]

What was the impact?

• Financial: €17,628,000 fine[1][3]
• Customers: About 2.4 million customers were profiled and selected for transfer to Isybank, with a new IBAN, no branches and app-only access.[1][3]

Severity 3 of 5: A regulatory finding with a €17.6m fine (in the $1m-25m band) over the profiling of about 2.4 million customers; no financial loss to customers has been quantified, and the order is under court challenge.

How did Intesa Sanpaolo S.p.A. and Isybank S.p.A. respond?

Intesa had no immediate comment, Reuters reported on the day of the fine. In the proceedings the bank argued that the selection was not profiling but an extraction of customer records on objective criteria "defined within a structured and supervised process" (our translation), that it did not rely on automated decision-making under GDPR Article 22, and that legitimate interest was the appropriate legal basis for a business transfer under Article 58 of Italy's banking law. A court challenge against the order is pending.[2][3]

What was the outcome, and did regulators act?

Fined €17,628,000. In setting the amount the Garante weighed the seriousness of the violations and the large number of customers affected against the negligent (not intentional) nature of the breaches and the bank's cooperation. As of 2026-10-21 the order is the subject of a pending court challenge and has been temporarily removed from the Garante's website under Article 5 of Legislative Decree 150/2011.[1][2][3]

1. Comunicato stampa: Garante privacy sanziona Intesa Sanpaolo per 17,6 milioni di euro. 2,4 milioni di clienti profilati nell'ambito di una operazione societaria official
   Garante per la protezione dei dati personali · Mar 12, 2026
   “Per individuare tra i propri clienti quelli da trasferire nella neo-istituita Isybank, Intesa Sanpaolo ha effettuato, senza un'idonea base giuridica, una profilazione della clientela.”
2. Provvedimento del 12 marzo 2026, n. 163 [doc. web 10230412] official
   Garante per la protezione dei dati personali · Mar 12, 2026
   “Il giudizio di opposizione avverso il presente provvedimento è pendente.”
3. Italy fines Intesa Sanpaolo 18 mln euros for illicit processing of customer data news
   Reuters · Mar 12, 2026
   “The watchdog said the bank profiled clients according to factors such as being under 65 years old, the frequency of their digital-channel use, and their investment products and financial holdings.”
4. Italian DPA Fines Bank over the Transfer of Customer Data in the Context of a Corporate Transaction news
   Covington & Burling (Inside Privacy) · Mar 20, 2026
   “In the Garante's view, the first activity constitutes profiling within the meaning of the GDPR and forms a separate processing operation from the subsequent disclosure of data in the context of the transaction.”