Imposition of a fine on a bank in Greece for an incident of personal data breach

The Greek Data Protection Supervisory Authority imposed on a Bank, as Data Controller, an administrative fine of EUR 100,000 for violating the principles of accuracy, integrity, and confidentiality of data, and the principles of data protection by design and by default, in conjunction with Articles 32, 33, and 34 of the GDPR, as well as an administrative fine of EUR 20,000 for violating the complainants' right of access.

Complaints were submitted to the Supervisory Authority of Greece against the National Bank of Greece for the incorrect linking of a complainant's bank account with the mobile phone number of another complainant in the “i-bank Pay application”, which resulted in money transfers, via “IRIS online payments service”, which were made to the first complainant's account instead of the second's.

 In the context of the administrative audit conducted by the Authority, the Bank eventually identified that the issue was due to incorrect configuration during the 2020 upgrade of the mobile banking application, which had affected another 24 of its customers. Additionally, the Bank submitted a data breach notification to the Authority and took further corrective measures.

You  might also like: An overview of the regulatory framework on Gambling Services in the European Union / Article by Efi Thoma, Lawyer in Cyprus

(source:edpb.europa.eu/photo:freepik.com)


Comments

Post a Comment

Popular posts from this blog

Annual Report on the execution of the European Court's judgments and decisions

Image
The Secretary General of the Council of Europe, Alain Berset, has called for further efforts to implement judgments from the European Court of Human Rights. Commenting on the  annual report for 2024  on the execution of the Court’s rulings, published today, the Secretary General said: “ This report shows what a concrete, positive impact judgments from the European Court of Human Rights have on the daily lives of the people of Europe. While a lot has been achieved, more needs to be done. The efficient execution of the Court's judgments is essential for the rule of law and democratic accountability in Europe .” The annual report from the Council of Europe’s Committee of Ministers shows that 992 cases were transferred from the European Court of Human Rights to Committee, which supervises their implementation by member states, in 2024. Of those 992 new cases, 194 were “leading” cases – often requiring action to be taken by states to prevent the same violations happ...
Read more

Ombudsman inquiry on Commission President’s text messages is a wake-up call for EU

Image
The European Ombudsman inquiry into the Commission’s handling of a request for text messages between its President and the CEO of a pharmaceutical company is a wake-up call for all EU institutions about ensuring accountability in an era of instant messaging. One year after the initial request by a journalist, the Commission has still not clarified whether messages reported to concern major vaccine procurement deals exist and whether the public is entitled to see them. The Ombudsman had asked the Commission, in a finding of maladministration in January, to conduct a more thorough search for the text messages. The Commission’s recent response failed to say whether it had looked directly and correctly for the text messages and if not, why not. While the response recognised that work-related text messages can be EU documents, it reiterated that the Commission’s internal policy is, in effect, not to register text messages. The Ombudsman has closed  the inquiry  and upheld...
Read more

Prison overcrowding remains a problem in Europe: Council of Europe’s annual penal statistics for 2023

Image
Prison overcrowding continues to be an acute and persistent problem in a significant number of European prison administrations, according to the Council of Europe’s Annual Penal Statistics on Prison Populations ( SPACE I ) for 2023. In countries with over 500,000 inhabitants, twelve prison administrations reported having more inmates than places available in January 2023. Overall, in Europe, the number of prisoners per 100 places available grew by 2% from 31 January 2022 to 31 January 2023 (from 91.7 to 93.5 inmates). Seven prison administrations reported a prison density of more than 105 inmates per 100 places available, indicating severe overcrowding: Cyprus (166 inmates per 100 places), Romania (120), France (119), Belgium (115), Hungary (112), Italy (109) and Slovenia (107). Five prison administrations reported very high prison density: Greece (103), Sweden (102), North Macedonia (101), Croatia (101) and Türkiye (100). Other administrations reported a prison density...
Read more

Fully-funded PhD position in AI, Law and Public Power

Image
Erasmus University Rotterdam School of Law, department Law & Markets, is looking for a fulltime PhD researcher in AI, Law and Public Power (4,5 years with 20% teaching tasks). PhD AI, Law and Public Power Are you curious about how artificial intelligence is changing state actor powers? Do you want to conduct critical and in-depth legal research at the intersection of technology, law and power? And would you like to combine that with academic teaching? Then this PhD position at Erasmus School of Law is for you. Within the Law & Markets team, you will spend 4.5 years researching the legal regulation of AI in the public sector. How do we protect fundamental rights when algorithms help decide on who receives public benefits, how to perform enforcement or how to enact environmental policy? What is the role of the state, and where is the limit of government power in a data-driven society? You will have plenty of space to choose your own research angle and work in a multidisci...
Read more

Cancellation of a flight: The refund of the airline ticket price must include the commission collected by an intermediary at the time of purchase (CJEU)

Image
Judgment of the Court in Case C-45/24 (15.1.2026)- Verein für Konsumenteninformation : Cancellation of a flight: the refund of the airline ticket price must include the commission collected by an intermediary at the time of purchase. It is not necessary for the airline to know the exact amount of that commission. Several travellers purchased airline tickets on the booking portal of the Opodo travel agency [1] for a KLM return flight from Vienna (Austria) to Lima (Peru). Since the flights were cancelled, KLM reimbursed the amount they had paid, minus approximately € 95 that Opodo had charged them as agency commission. The air passengers concerned assigned their potential rights to reimbursement to a consumer protection association. That association contends, before the Austrian courts, that the reimbursement of the cost of the airline tickets by the airline in question should include the agency commission charged to passengers, as in the present case, by a travel agency acting as that a...
Read more

The Concept of "Habitual Residence" as a Jurisdictional Basis in International Parental Responsibility Disputes: The Cypriot Approach

Image
Written By Giorgos Kazoleas, Lawyer at Legal Experts Cyprus In modern private international law, determining the Forum Conveniens (the appropriate court) for resolving parental responsibility disputes is a critical issue for ensuring the best interests of the child. Within the Cypriot legal order, the jurisdiction of Family Courts in cases involving international elements—such as those involving third-country nationals—is primarily established through the concept of "habitual residence." 1. The Legal Framework: The 1996 Hague Convention and National Law The establishment of jurisdiction for Cypriot Courts arises from the combined application of international and national rules: 1996 Hague Convention [1] : According to Article 5, the judicial or administrative authorities of the Contracting State of the child’s habitual residence have jurisdiction to take measures directed at the protection of the child’s person or property. The Family Courts Law (Law 23/1990) : Arti...
Read more

The struggle for truth against time and limitation period in the light of two paternity court cases

Image
By George Kazoleas, Lawyer Two recent cases, one by the European Court of Human Rights and the other by the Athens Court of First Instance with similar facts, show once again that justice can dispel the darkness caused by human deceit having as a result the distortion of real facts. Against time and limitation Time, was essentially the reason why the courts in Serbia denied the 50-year-old Peda Boljevic the right to know the truth about who his biological father was. Until 2011 he believed that A was his real father but when he died, Boljevic discovered in old court rulings around 1970 that A could not be his biological father. So, at the beginning of 2012, he filed a lawsuit with his mother, invoking the old decisions by also adding the argument that back then there was no DNA test, but today this could be done based on a court decree. The courts in Serbia, both the court of first instance and the court of appeals, rejected his application as lapsed, after so many years. In particular...
Read more