Cerved Group S.p.A.

What happened

The Italian DPA has imposed a fine of EUR 400,000 on Cerved Group S.p.A. Cerved Group is a commercial information provider. It supplied one of the credit scores (Score Retail Utilities) combined into the CGS-X score used by two energy retailers, calculating it from personal data including the data subject's age, place of birth and address of residence. The controller did not comply adequately with the requests of data subjects, disclosing only whether a record existed in its database and stating that no negative information concerning them was held, without the Score Retail Utilities, the sub-scores behind it or the logic used to calculate it. During the investigation it was found that the company was in possession of the requested data. Revised response templates introduced in October 2024 and September 2025 remained incomplete. The controller argued the score was only a partial indicator left to the retailers' own decision-making, which the authority rejected, holding that it decisively guided their decisions.

Summary from the CMS Enforcement Tracker, not by Fino. CC BY-NC-SA 4.0.

Rules involved

• Art. 5Principles relating to processing of personal data5(1)(a)Read →
• Art. 12Transparent information, communication and modalities for the exercise of the rights of the data subjectRead →
• Art. 15Right of access by the data subjectRead →

• Data principles
• Data subject rights
• Transparency