GDPR breach: 300.000€ fine against bank after lack of transparency over automated rejection of credit card application

A Berlin based bank offered a credit card on their website. Using an online form, the bank requested various data about the applicant's income, occupation and personal details. Based on the information requested and additional data from external sources, the bank's algorithm rejected the customer's application without any particular justification. The algorithm is based on criteria and rules previously defined by the bank. Since the client had a good credit rating and a regular high income, he doubted the automated rejection and complained to the Berlin data protection commissioner. 

Even when asked by the complainant, the bank only provided blanket information about the scoring procedure, detached from the individual case. However, it refused to tell him why it assumed a poor creditworthiness in his case. The complainant was thus unable to understand which data basis and factors formed the basis of the automated rejection and on the basis of which criteria his credit card application had been rejected accordingly. Without this individual case justification, however, it was also not possible for him to meaningfully challenge the automated individual decision.

A bank is obliged to inform its customers about the main reasons for a rejection when making an automated decision on a credit card application. This includes concrete information on the data basis and the decision-making factors as well as the criteria for the rejection in the individual case. The Berlin DPA found that the bank had violated Article 22(3), Article 5(1)(a) and Article 15(1)(h) GDPR in the specific case. In imposing the fine, the Berlin DPA took into account in particular the high turnover of the bank and the intentional design of the application process and the information. Among other things, the fact that the company admitted the violation and had already implemented changes to the processes and announced further improvements was deemed to reduce the fine. (source: edpb.europa.eu/ photo freepik.com)

Comments

Post a Comment

Popular posts from this blog

The Delivery Delay Clause in Residential Construction Contracts: Consumer Protection in Cyprus and Europe

Image
By Giorgos Kazoleas, LL.M., Lawyer, Managing Partner at Legal Experts Cyprus The purchase or construction of a new residence is one of the most significant financial and personal decisions a consumer can make. Residential construction contracts or agreements for the sale of property under construction are a crucial and defining element of the entire process, as certain terms they may contain can be detrimental to the buyer. One of the most critical aspects is the contractual delivery time of the project and the provision for delay, through the so-called delivery delay clause. The Delivery Delay Clause: Its Role and Legal Nature The delivery delay clause (also known as a penalty clause in the event of default) is a term usually included in the contract that specifies a predetermined compensation amount that the contractor or seller must pay to the buyer for every day, week, or month of delay beyond the agreed delivery date. The purpose of the clause is twofold: -Compensatory: ...
Read more

Cyprus Family Law: Spouse's claim for contribution in post-marital acquisitions

Image
by Giorgos Kazoleas, Lawyer* The regulation of property issues between spouses after divorce or separation is one of the main problems and is most commonly related with the issue of the contribution of one spouse to the increase in the other’s property. According to Cypriot Family Law, in the event that the marriage is dissolved or annulled, or in the event of separation of the spouses, in case the property of one spouse has increased, the other spouse, if he/she contributed in any way to this increase, is entitled to bring an action before the Court and demand the return of the part of the increase that comes from his/her own contribution.[1] The contribution of one spouse to the increase in the property of the other is presumed to amount to one third of the increase, unless a greater or lesser contribution is proven.[2] “Contribution” means any form of contribution by the spouses to the acquisition or creation of property and includes the care of the family home and family memb...
Read more

Two prisoners punished for singing anthems and reading out poems in prison: Violation of the freedom of expression

Image
In Chamber's judgment in the case of Mehmet Çiftçi and Suat İncedere v. Turkey (applications nos. 21266/19 and 21774/19) the European Court of Human Rights held, unanimously, that there had been: a violation of Article 10 (freedom of expression) of the European Convention on Human Rights.  The case concerned the sanction of one month’s deprivation of means of communication imposed on the applicants by the prison management for singing anthems and reading out poems (in December 2016) in memory of the prisoners who had lost their lives during the “Return to life” operation conducted by the authorities in prisons in December 2000.  The Court found that the disciplinary sanction imposed on the applicants constituted interference with their right to freedom of expression. It held that, notwithstanding the mildness of the sanction imposed on the applicants, the Government had not demonstrated that the reasons cited by the national authorities as justification for the measure complai...
Read more

The civil courts did not violate the right of access to a court by refusing a document which had not been submitted in accordance with the Code of Civil Procedure

Image
In Chamber judgment in the case of Efstratiou and Others v. Greece (application no. 53221/14) the European Court of Human Rights held, unanimously, that there had been no violation of Article 6 (right to a fair trial / right of access to a court) of the European Convention on Human Rights. The applicants in this case considered that the refusal by the court of appeal and the Court of Cassation to take account of evidence which they considered as decisive for the outcome of the case had been excessively formalistic. Those courts had considered that the documents in question had not been presented to the court of appeal in accordance with the requirements of Article 240 of the Greek Code of Civil Procedure. The Court held, in particular, that the statement given by a witness for the applicants at the hearing before the court of appeal, had fairly accurately reflected the substance of the document (a sworn statement), which the court of appeal had dismissed on the grounds that it ha...
Read more

The struggle for truth against time and limitation period in the light of two paternity court cases

Image
By George Kazoleas, Lawyer Two recent cases, one by the European Court of Human Rights and the other by the Athens Court of First Instance with similar facts, show once again that justice can dispel the darkness caused by human deceit having as a result the distortion of real facts. Against time and limitation Time, was essentially the reason why the courts in Serbia denied the 50-year-old Peda Boljevic the right to know the truth about who his biological father was. Until 2011 he believed that A was his real father but when he died, Boljevic discovered in old court rulings around 1970 that A could not be his biological father. So, at the beginning of 2012, he filed a lawsuit with his mother, invoking the old decisions by also adding the argument that back then there was no DNA test, but today this could be done based on a court decree. The courts in Serbia, both the court of first instance and the court of appeals, rejected his application as lapsed, after so many years. In particular...
Read more

Consumer credit agreements: In the event of failure to comply with the obligation to provide information, a bank may be deprived of its right to interest

Image
The Court of Justice in its Judgment in Case C-472/23 (Lexitor) regarding the consumer credit agreements, ruled that, in the event of failure to comply with the obligation to provide information, a bank may be deprived of its right to interest.  This may be the case even where the individual seriousness of the infringement of that obligation and its consequences for the consumer are likely to vary from case to case. Lexitor is a Polish debt collection agency to which a consumer assigned rights arising from a credit agreement concluded with a bank. That company claims that the bank failed to fulfil its obligation to provide information to the consumer when the agreement was concluded. It brought an action before a Polish court seeking payment from the bank of a sum of money corresponding to the interest and charges paid by that consumer.  In supports of its claim, Lexitor submits, first, that the annual percentage rate of charge (APRC [1]) was overstated; in its view, one of th...
Read more

ECtHR Judgement against Greece: Disclosure of the identities and medical data of prostitutes diagnosed with HIV was a breach of their right to private life

Image
The case of O.G. and Others v. Greece (applications nos. 71555/12 and 48256/13) concerned the publication, by decision of the domestic authorities, of medical data concerning prostitutes who had been diagnosed as HIV-positive, and media coverage of them. It also concerned the circumstances in which they were required to undergo a blood test.  In Chamber 's judgment(23.1.2024) in this case the European Court of Human Rights held, unanimously, that there had been two violations:  -A violation of Article 8 (right to respect for private life) of the European Convention on Human Rights, with regard to two applicants, on account of the blood tests they had been required to undertake.  The Court considered that the blood samples imposed on two applicants had amounted to an interference with their private life and noted that this had not been in accordance with the law within the meaning of Article 8 of the Convention, given that the provisions of domestic law in issue ought to h...
Read more