Imposition of a fine on a bank in Greece for an incident of personal data breach

The Greek Data Protection Supervisory Authority imposed on a Bank, as Data Controller, an administrative fine of EUR 100,000 for violating the principles of accuracy, integrity, and confidentiality of data, and the principles of data protection by design and by default, in conjunction with Articles 32, 33, and 34 of the GDPR, as well as an administrative fine of EUR 20,000 for violating the complainants' right of access.

Complaints were submitted to the Supervisory Authority of Greece against the National Bank of Greece for the incorrect linking of a complainant's bank account with the mobile phone number of another complainant in the “i-bank Pay application”, which resulted in money transfers, via “IRIS online payments service”, which were made to the first complainant's account instead of the second's.

 In the context of the administrative audit conducted by the Authority, the Bank eventually identified that the issue was due to incorrect configuration during the 2020 upgrade of the mobile banking application, which had affected another 24 of its customers. Additionally, the Bank submitted a data breach notification to the Authority and took further corrective measures.

You  might also like: An overview of the regulatory framework on Gambling Services in the European Union / Article by Efi Thoma, Lawyer in Cyprus

(source:edpb.europa.eu/photo:freepik.com)


Comments

Post a Comment

Popular posts from this blog

Legal Professional Privilege in the Digital Age: Recent Case Law of the ECtHR and the Core Principles That Should Govern Searches

Image
By Giorgos Kazoleas, Lawyer The protection of legal professional privilege is a fundamental pillar of the right to respect for private life and correspondence (Article 8 of the ECHR), as well as of the right to a fair trial (Article 6 of the ECHR). In recent years, as the use of digital means in the practice of law has become firmly established, the European Court of Human Rights (ECtHR) has delivered important judgments focusing mainly on the digital age, searches of law offices and the surveillance of communications between lawyer and client. Set out below is a selection of ECtHR case law on such matters: Seizure and retention of vast amounts of lawyers' digital data In Kırdök and Others v. Turkey (3 December 2019), the national authorities seized all the hard drives and digital files of a law office in the course of an investigation, without distinguishing between the documents relating to the case and the confidential files of other clients. The Court found a violat...
Read more

Ombudsman inquiry on Commission President’s text messages is a wake-up call for EU

Image
The European Ombudsman inquiry into the Commission’s handling of a request for text messages between its President and the CEO of a pharmaceutical company is a wake-up call for all EU institutions about ensuring accountability in an era of instant messaging. One year after the initial request by a journalist, the Commission has still not clarified whether messages reported to concern major vaccine procurement deals exist and whether the public is entitled to see them. The Ombudsman had asked the Commission, in a finding of maladministration in January, to conduct a more thorough search for the text messages. The Commission’s recent response failed to say whether it had looked directly and correctly for the text messages and if not, why not. While the response recognised that work-related text messages can be EU documents, it reiterated that the Commission’s internal policy is, in effect, not to register text messages. The Ombudsman has closed  the inquiry  and upheld...
Read more

Corporate Personality and Damages for Loss Caused to a Third Party Company: Forthwell v Pontegadea (UKSC)

Image
With its recent decision in Forthwell Ltd v Pontegadea UK Ltd [2026] UKSC 33, handed down on September 17, 2026, the Supreme Court of the United Kingdom considered a particularly important issue of contract law: whether a contracting party can claim damages for loss suffered by a third party, and specifically by a company within the same group. The case concerned the historic Rogano restaurant in Glasgow. Forthwell, the tenant of the property, had granted the use of the premises to its wholly-owned subsidiary, Lynnet Leisure, which operated the restaurant. Following severe flood and fire damage, the restaurant was unable to reopen, and Lynnet suffered a significant loss of profits. Forthwell sought to recover these losses from the landlord. The Supreme Court dismissed the claim. It affirmed the general rule that a contracting party may recover damages for its own loss and not, in principle, for loss suffered by a third party. The Court declined to create a new, broader exception that ...
Read more

Greek Administrative Court rules state liable for Covid-19 vaccine side effects due to "excessive sacrifice"

Image
Greece: The Administrative Court of First Instance of Athens, in its decision no. 4202/2025, has ruled that the Greek State is liable for damages sustained by an individual due to side effects following a preventive "COVID-19" vaccination. This landmark decision was issued in a compensation lawsuit filed against the Hellenic Republic. The Case: Seeking Compensation for Vaccine-Related Harm The lawsuit was brought by a plaintiff seeking compensation for material damage and moral harm (non-pecuniary damage), alleging that they suffered severe side effects after their preventive COVID-19 vaccination with a specific vaccine. The initial claim was for €461,835.26, but this amount was subsequently restricted during the proceedings. The plaintiff based their claim on two legal grounds: Article 105 of the Introductory Law of the Civil Code (EισNAK): This article concerns the State's liability for compensation arising from illegal acts or omissions of its organs in the exe...
Read more

From Regulation to Strategy: Europe’s New Tech Agenda

Image
Written by Efi Thoma, Senior Global Legal Counsel  Europe’s approach to technology regulation is entering a more practical phase. After several years of ambitious rule-making, Brussels is increasingly focused on implementation, enforcement and simplification. For technology companies, the key question is no longer simply “What does the law require?” but “How do we make these requirements work in practice without unnecessarily slowing innovation?” The EU AI Act (Regulation (EU) 2024/1689) establishes a risk-based framework covering areas such as transparency, governance, human oversight and high-risk AI systems. As implementation progresses, the emphasis is increasingly on making the framework workable in practice, including through regulatory sandboxes and measures supporting implementation. For businesses, the practical approach is to embed AI governance into existing processes rather than create an entirely separate compliance structure. AI inventories, risk classification, procu...
Read more

Judges’ Freedom of Expression and the Limits of Disciplinary Power: The ECtHR Judgment in Savvas v. Greece

Image
The ECtHR ruled in favor of a Greek judge in a case involving disciplinary proceedings for improper conduct on and off duty ( Savvas v. Greece ). The judge had served extrajudicial notices ( ex-officio legal notices) on three senior colleagues via a court bailiff, requesting that they retract negative comments made against him during a promotion procedure. He was subsequently placed on a three-month suspension. Invoking Article 10 (freedom of expression) of the European Convention on Human Rights, A. Savvas argued that he exercised his legal right to express his opinion in the extrajudicial notices, to defend himself against unfounded accusations, to protect his interests in the context of the promotion process, and to safeguard the public interest by ensuring a fair judicial promotion procedure. The ECtHR found a violation of Article 10 of the ECHR and awarded compensation for pecuniary damage: €5,211.15, non-pecuniary damage: €6,000, and costs and expenses: €1,000. In its judgme...
Read more

The Title Deed Issue in Cyprus and the "Trapped Buyers" Phenomenon

Image
Article By Giorgos Kazoleas, Lawyer LL.M.  The issue of title deeds in Cyprus and the phenomenon of "trapped buyers" constitutes one of the greatest legal, financial, and social peculiarities of Cypriot real estate law. The Cypriot Peculiarity: Sale Without a Title Deed Under Cypriot law (pursuant to the Immovable Property (Tenure, Registration and Valuation) Law, Cap. 224), legal ownership of a property is transferred and acquired solely upon its registration with the Department of Lands and Surveys and the issuance of the relevant Certificate of Registration (Title Deed). However, a major peculiarity exists: it is entirely legal to sell a property that does not (yet) possess a separate title deed. This typically occurs in new developments (apartment buildings or residential complexes), where the title deed for the plot of land belongs to the developer, but the separate title deeds for each apartment or house can take years to be issued due to bureaucracy, pending ap...
Read more