The March 2026 Garante action turns Intesa Sanpaolo's insider incident into a governance signal for European banking. The regulator said an employee accessed banking information for 3,573 customers, making more than 6,600 consultations between February 21, 2022 and April 24, 2024 without justified reason. The access did not present as an external intrusion; it was a misuse of internal access inside a large bank.
That distinction is why the penalty matters. The Garante focused on the control model around lawful access, not only on whether data left the bank. Its press release said the improper accesses were not detected by internal control systems and exposed significant weaknesses in monitoring and prevention. The formal decision connected the case to integrity, confidentiality, accountability, security of processing, breach notification and communication to affected people under GDPR Articles 5, 24, 32, 33 and 34. See also: EU squeezes US satellite operators from spectrum.
The impact surface is wider than the EUR31.8 million number. The regulator described access to high-risk clients, including people with prominent public roles, for whom stronger protections should have existed. The decision also records the bank's later program to strengthen protections for selected sensitive customers, reinforce ex-ante authorization and ex-post controls, and introduce dynamic data masking. Those remediation points reveal the control surface: who can query which customer records, how unusual access is detected, when it escalates and when affected clients are told. See also: Clarifai deletes OkCupid data after FTC probe.
Intesa Sanpaolo is not a small target. The group describes itself as one of Europe's top banking groups and Italy's leader across retail, corporate and wealth-management businesses, serving about 14 million customers in Italy. For an institution of that scale, insider access monitoring is core operational resilience. The event should be tracked for whether the bank's post-incident controls reduce privileged curiosity, whether appeal proceedings change the sanction, and whether other European supervisors use the case as a benchmark for banking access governance. See also: SpaceX files for IPO with Mars investment opportunity.
