Removed: monitoring of “a series of data contained in the mobile devices, including the applications installed and running”, which had been an obligatory condition for using the BancoPosta and Postepay Android apps.
Outcome: fines of €6,624,000 for Poste Italiane and €5,877,000 for Postepay, with an order to stop the processing and bring retention into line; the Tribunale di Roma suspended the decision’s enforceability on 17 July 2026.
Italy’s authority tested the most respectable reason for collecting data you do not need. Releasing authorisation to monitor those apps was, for users of the BancoPosta and Postepay Android apps, an “obligatory condition for the use of the services”, justified as a way to find malicious software.
The Garante held that this was “an excessively invasive interference in the users’ private sphere” and did not appear “strictly necessary” for fraud prevention, fined Poste Italiane €6,624,000 and Postepay €5,877,000, and ordered both to stop the processing and bring their retention into line (Garante press release, 20 April 2026; quoted in translation).
The question the regulator asked is the one worth copying: not whether the purpose was legitimate, but whether this much data was needed to serve it. The file is not closed — the Tribunale di Roma suspended the decision’s enforceability on 17 July 2026, and the Garante’s page for provvedimento 237/2026 now says the text has been removed while the opposition is pending.
Sources: