GDPR breach: 300.000€ fine against bank after lack of transparency over automated rejection of credit card application

A Berlin based bank offered a credit card on their website. Using an online form, the bank requested various data about the applicant's income, occupation and personal details. Based on the information requested and additional data from external sources, the bank's algorithm rejected the customer's application without any particular justification. The algorithm is based on criteria and rules previously defined by the bank. Since the client had a good credit rating and a regular high income, he doubted the automated rejection and complained to the Berlin data protection commissioner. 

Even when asked by the complainant, the bank only provided blanket information about the scoring procedure, detached from the individual case. However, it refused to tell him why it assumed a poor creditworthiness in his case. The complainant was thus unable to understand which data basis and factors formed the basis of the automated rejection and on the basis of which criteria his credit card application had been rejected accordingly. Without this individual case justification, however, it was also not possible for him to meaningfully challenge the automated individual decision.

A bank is obliged to inform its customers about the main reasons for a rejection when making an automated decision on a credit card application. This includes concrete information on the data basis and the decision-making factors as well as the criteria for the rejection in the individual case. The Berlin DPA found that the bank had violated Article 22(3), Article 5(1)(a) and Article 15(1)(h) GDPR in the specific case. In imposing the fine, the Berlin DPA took into account in particular the high turnover of the bank and the intentional design of the application process and the information. Among other things, the fact that the company admitted the violation and had already implemented changes to the processes and announced further improvements was deemed to reduce the fine. (source: edpb.europa.eu/ photo freepik.com)

Comments

Post a Comment

Editorial

Editorial
George Kazoleas, Lawyer

Top Stories

Ombudsman inquiry on Commission President’s text messages is a wake-up call for EU

Image
The European Ombudsman inquiry into the Commission’s handling of a request for text messages between its President and the CEO of a pharmaceutical company is a wake-up call for all EU institutions about ensuring accountability in an era of instant messaging. One year after the initial request by a journalist, the Commission has still not clarified whether messages reported to concern major vaccine procurement deals exist and whether the public is entitled to see them. The Ombudsman had asked the Commission, in a finding of maladministration in January, to conduct a more thorough search for the text messages. The Commission’s recent response failed to say whether it had looked directly and correctly for the text messages and if not, why not. While the response recognised that work-related text messages can be EU documents, it reiterated that the Commission’s internal policy is, in effect, not to register text messages. The Ombudsman has closed  the inquiry  and upheld her find
Read more

Graduate Programme 2024 for EU Nationals in European Central Bank

Image
European Central Bank (ECB) is looking for 15 highly talented recent graduates with a postgraduate degree, eventually a PhD, for the ECB’s Graduate Programme offering full time monthly net salary €4,611 plus benefits. General Information  Type of contract: Two-year fixed-term contract starting on 1 September. It may be extended for one additional year upon successful completion of the programme. Who can apply?  EU nationals Salary  E/F (bracket 1 - step 1) full time monthly net salary: €4,611 plus benefits, for further information see  here . Working time:  Full time Place of work:  Frankfurt am Main, Germany Closing date:  21.02.2024 ECB is looking for 15 highly talented recent graduates with a postgraduate degree, eventually a PhD, for the ECB’s Graduate Programme.  You will have different ages, backgrounds and interests and will find intellectual challenges, varied opportunities and a people-centred working culture that gives you a voice and the chance to make an i
Read more

The Lawyer's right to refuse the defense of an accused person for ethical reasons

Image
by Giorgos Kazoleas, Lawyer LL.M. Lawyers have the right to refuse to undertake a case when it conflicts with their moral principles, their dignity and conscience. Both the Code of Lawyers in Greece and the Code of Lawyers 'Ethics in Cyprus provide the legal framework to support this choice.   The Greek Legislation The lawyer's right to refuse the defense of a specific defendant in a criminal trial clearly follows from the wording of article 37 of the Lawyers' Code (Law 4194/2013). According to paragraph 1 of this article, the lawyer has an obligation to undertake any case, unless it is manifestly unfounded, not amenable to defense, conflicts with the interests of other clients or goes against his/her principles. According to paragraph 2, the lawyer must undertake the defense of any accused, if requested by the judicial authorities, subject to paragraph 1. The reasons for refusing to undertake a case are expanded by article 6 of the Greek Code of Ethics of the Legal Pro
Read more

First judgment of the ECHR: Lawless v. Ireland

Image
60 years ago, on 14 November 1960, the Court delivered its first judgment, Lawless v. Ireland, with René Cassin as its President. The judgment concerned preliminary objections and procedural questions regarding the application, on which a judgment on the merits was delivered the following year. Since its inauguration the Court has delivered 23,291 judgments on just over 51,650 applications. The case was filed by Gerard Richard Lawless, who had been an IRA member, although he claimed to have left the IRA. He was arrested on 11 July 1957, as he was about to travel to Great Britain from Ireland, and subsequently detained under the special powers of indefinite detention without trial under the Offences against the State (Amendment) Act 1940. The case was filed by Lawless for violation, by the Irish Government, of Articles 5, 6 and 7 of the European Convention of Human Rights, providing rights to liberty and security, fair trial and the principle of 'no punishment without law'
Read more

Gigantic fine for unfair practices imposed on Booking.com by the Competition Authority of Hungary

Image
One of the highest fines for violation of unfair competition law has been imposed (28/4/2020) on online hotel booking platform ‘’Booking.com’’ by the Hungarian Competition Authority. The amount of the fine (approximately EUR 6 million / HUF 2.5 billion) imposed by the Authority illustrates the seriousness of the Dutch company's violations. The Hungarian Competition Authority (GVH) imposed a fine of HUF 2.5 billion on the operator of the online booking portal booking.com, and at the same time banned the Dutch company from continuing its aggressive sales methods. According to the decision of the competition authority, Booking.com B.V. engaged in unfair commercial practices against consumers by, among other things, misleadingly advertising some of its accommodations with a free cancellation option and exerting undue psychological pressure on consumers to make early bookings. As a result of the Competition Authority’s competition supervision proceeding  initiated in 2018, the autho
Read more

The name Pablo Escobar may not be registered as an EU trade mark

Image
According to the Judgment of the General Court in Case T-255/23 (Escobar v EUIPO) the name Pablo Escobar may not be registered as an EU trade mark. The public would associate that name with drug trafficking and narco-terrorism.  On 30 September 2021, Escobar Inc., established in Puerto Rico (United States), filed an application with the European Union Intellectual Property Office (EUIPO) for registration of the word sign Pablo Escobar as an EU trade mark for a wide range of goods and services.  The Colombian national named Pablo Escobar, who was born on 1 December 1949 and died on 2 December 1993, is presumed to be a drug lord and a narco-terrorist who founded and was the sole leader of the Medellín cartel (Colombia).  EUIPO rejected the application for registration on the ground that the mark was contrary to public policy and to accepted principles of morality. It relied on the perception of the Spanish public, as it is the most familiar with Pablo Escobar due to the links between Spa
Read more

Nepotism and favouritism in the legal profession

Image
by Giorgos Kazoleas, Lawyer Nepotism in the legal profession is not only a domestic but a global phenomenon with timeless characteristics. Lack of meritocracy and favouritism during the process of recruitment and professional development of lawyers have common sources of nepotism and clientelism. Even in countries with advanced legal systems, such as the USA, the phenomenon of placing relatives and friends in high positions in law firms is very common. In the southern countries of Europe, nepotism stems mainly from family-oriented concepts deeply rooted in the subconscious of the societies. In smaller populated countries the phenomenon of employers' relatives and friends being preferred for jobs in law firms is more than common. In countries like India, the phenomenon of nepotism in the legal profession has particularly concerned the legal community, as there is a stronghold of a few privileged and powerful families which prevails  in the legal profession. Among lawyers and jud
Read more