According to the Italian Data Protection Authority (the Garante), a bank that distributes insurance policies is a data processor under the GDPR rather than a data controller.
06
Here you can read some articles on Italian and international privacy, cybersecurity and data protection issues drafted by either Giulio Coraggio or the other authors of GamingTechLaw.