Italy’s data protection regulator on Monday announced it has fined Italy’s national postal service provider and a sister company €12.5 million ($14.7 million) for data privacy violations.

The regulator fined Poste Italiane SpA, the postal service provider, €6.6 million ($7.8 million) and Postepay SpA, a digital payments subsidiary, €5.9 million ($7 million) for allegedly illegally processing millions of users’ personal data.

Poste Italiane is a state-controlled but publicly-traded entity with several subsidiaries, including Postepay.

The regulator said the investigation focused on the Postepay app and a sister app run by the financial services division of Poste Italiane, BancoPosta.

The apps required users to “authorize the monitoring of a series of data contained on mobile devices, including installed and running applications” in an effort to identify malicious software, according to a press release from the regulator.

The companies said the monitoring was needed to protect transactions and comply with payment services rules, but the regulator alleges that the methods used were “excessively invasive” and were not needed for fraud prevention.

The regulator alleges that the entities also violated privacy laws by failing to provide users with enough information about how their data was processed, not implementing sufficient security safeguards and for retaining data for too long.