Imposition of a fine on a bank in Greece for an incident of personal data breach

The Greek Data Protection Supervisory Authority imposed on a Bank, as Data Controller, an administrative fine of EUR 100,000 for violating the principles of accuracy, integrity, and confidentiality of data, and the principles of data protection by design and by default, in conjunction with Articles 32, 33, and 34 of the GDPR, as well as an administrative fine of EUR 20,000 for violating the complainants' right of access.

Complaints were submitted to the Supervisory Authority of Greece against the National Bank of Greece for the incorrect linking of a complainant's bank account with the mobile phone number of another complainant in the “i-bank Pay application”, which resulted in money transfers, via “IRIS online payments service”, which were made to the first complainant's account instead of the second's.

 In the context of the administrative audit conducted by the Authority, the Bank eventually identified that the issue was due to incorrect configuration during the 2020 upgrade of the mobile banking application, which had affected another 24 of its customers. Additionally, the Bank submitted a data breach notification to the Authority and took further corrective measures.

You  might also like: An overview of the regulatory framework on Gambling Services in the European Union / Article by Efi Thoma, Lawyer in Cyprus

(source:edpb.europa.eu/photo:freepik.com)


Comments

Post a Comment

Popular posts from this blog

The Concept of Legal Professional Privilege in DAC 6 Reporting: A Challenge to Attorney-Client Confidentiality in Cyprus

Image
By George Kazoleas, Lawyer in Cyprus The Administrative Cooperation in the Field of Taxation (Amending) Law of 2021 was enacted in Cyprus to harmonize with Council Directive (EU) 2018/822 of 25 May 2018, which amends Directive 2011/16/EU regarding the mandatory automatic exchange of information in the field of taxation in relation to reportable cross-border arrangements ("DAC 6"). The Law, echoing the Directive, imposes an obligation on every "intermediary" to submit information within thirty (30) days to the competent authority concerning reportable cross-border arrangements that have come into their knowledge, possession, or control. According to the aforementioned Law, an "intermediary" is defined as any person who designs, markets, organizes, makes available for implementation, or manages the implementation of a reportable cross-border arrangement, and/or any person who, taking into account all relevant facts and circumstances, and based on ava...
Read more

Ombudsman inquiry on Commission President’s text messages is a wake-up call for EU

Image
The European Ombudsman inquiry into the Commission’s handling of a request for text messages between its President and the CEO of a pharmaceutical company is a wake-up call for all EU institutions about ensuring accountability in an era of instant messaging. One year after the initial request by a journalist, the Commission has still not clarified whether messages reported to concern major vaccine procurement deals exist and whether the public is entitled to see them. The Ombudsman had asked the Commission, in a finding of maladministration in January, to conduct a more thorough search for the text messages. The Commission’s recent response failed to say whether it had looked directly and correctly for the text messages and if not, why not. While the response recognised that work-related text messages can be EU documents, it reiterated that the Commission’s internal policy is, in effect, not to register text messages. The Ombudsman has closed  the inquiry  and upheld...
Read more

European Commission refers Poland to the Court of Justice to protect judges from political control

Image
European Commission decided to refer Poland to the Court of Justice of the EU regarding the new disciplinary regime for Polish judges, requesting an expedited procedure. On 3 April 2019, the Commission launched this infringement procedure on the grounds that the new disciplinary regime undermines the judicial independence of Polish judges and does not ensure the necessary guarantees to protect judges from political control, as required by the Court of Justice of the EU. Specifically, the Polish law allows ordinary court judges to be subjected to disciplinary investigations, procedures and sanctions on the basis of the content of their judicial decisions, including the exercise of their right under Article 267 of the Treaty on the Functioning of the European Union (TFEU) to request preliminary rulings from the Court of Justice of the EU. Moreover, the new disciplinary regime does not guarantee the independence and impartiality of the Disciplinary Chamber of the Supreme Co...
Read more

Imposition of fines and order to comply following a leak of expats’ personal data file by Greek Data Protection Authority

Image
The Greek Supervisory Authority for Data Protection imposed on the Greek Ministry of the Interior,  an administrative fine totalling EUR 400,000 and on a Member of European Parliament an administrative fine totalling EUR 40,000 for infringements of GDPR. The Hellenic Data Protection Authority received a large number of complaints regarding unsolicited political communication via e-mail sent on 1/3/2024 and entitled "100 days before the European elections", by Member of European Parliament Anna-Michelle Asimakopoulou. Following this, the Authority investigated the case ex officio, exercising immediately its powers of investigation and auditing the bodies involved. Following a series of on-the-spot audits and the receipt of evidence and data in the context of the audit, it was found that a file containing personal data of all registered Greek expatriate voters for the June 2023 elections, for which the Hellenic Ministry of the Interior is the controller, and for which the leg...
Read more

Greek Administrative Court rules state liable for Covid-19 vaccine side effects due to "excessive sacrifice"

Image
Greece: The Administrative Court of First Instance of Athens, in its decision no. 4202/2025, has ruled that the Greek State is liable for damages sustained by an individual due to side effects following a preventive "COVID-19" vaccination. This landmark decision was issued in a compensation lawsuit filed against the Hellenic Republic. The Case: Seeking Compensation for Vaccine-Related Harm The lawsuit was brought by a plaintiff seeking compensation for material damage and moral harm (non-pecuniary damage), alleging that they suffered severe side effects after their preventive COVID-19 vaccination with a specific vaccine. The initial claim was for €461,835.26, but this amount was subsequently restricted during the proceedings. The plaintiff based their claim on two legal grounds: Article 105 of the Introductory Law of the Civil Code (EισNAK): This article concerns the State's liability for compensation arising from illegal acts or omissions of its organs in the exe...
Read more

EU rules on the presumption of innocence and the right to be present at trial: Commission calls on Bulgaria, Spain and Poland to correctly transpose the Directive

Image
The European Commission calls on Bulgaria, Spain and Poland to correctly transpose the EU rules on the presumption of innocence and the right to be present at trial. The European Commission decided to open an infringement procedure by sending a letter of formal notice to Spain (INFR(2024)2033) and Poland (INFR(2024)2034), as well as to send an additional letter of formal notice to Bulgaria (INFR(2023)2093) for failing to correctly transpose the Directive on the strengthening of the presumption of innocence and the right to be present at the trial in criminal proceedings ( Directive 2016/343/EU ). The Directive is one of  six Directives  adopted by the EU to create common minimum standards ensuring that the fair trial  rights of suspects and accused persons  in criminal proceedings are sufficiently protected across the EU. The Commission considers that certain national transposition measures notified by the three Member States fall sh...
Read more

Amendment of Articles of Association in Cyprus: Between Corporate Freedom and Abuse of Right – A Comparison with the Corresponding Regulation in Germany

Image
Giorgos Kazoleas, Lawyer in Cyprus The Articles of Association constitute the regulatory framework of a company, governing the internal relations between its members and management. Under Cyprus law, flexibility in adapting this document is vital, but it is not unchecked. The Amendment Process (Section 12 of the Companies Law, Cap. 113) Pursuant to Section 12 of the Companies Law (Cap. 113), a company may amend its articles of association by passing a Special Resolution, subject to compliance with the provisions of this Law and the conditions contained in the Company’s Memorandum of Association. The Company may amend specific articles or its articles of association in their entirety. For the amendment to be valid, a majority of at least 75% of the members present and voting at the General Meeting is required, and the prescribed notice must have been given (typically 21 days, unless otherwise provided for private companies). Subsequently, the company must submit the special reso...
Read more