Greece

Piraeus Bank

10,000 €

GDPR enforcement action by Hellenic Data Protection Authority (HDPA) on 2022-04-04.

Rank · Sector

#194

of 322 in Finance, Insurance and Consulting

Rank · Greece

#47

of 93

Rank · All fines

#1,358

of 3,050

Case details

Authority: Hellenic Data Protection Authority (HDPA)
Date: 2022-04-04
Controller / Processor: Piraeus Bank
Sector: Finance, Insurance and Consulting
Quoted Articles: Art. 5 (1) f) GDPR, Art. 33 GDPR, Art. 34 GDPR
Type of violation: Non-compliance with general data processing principles

Summary

The Hellenic DPA has imposed a fine of EUR 10,000 on Piraeus Bank.
The bank had mistakenly sent a document containing data of the data subject to a third party. This error was based on a wrongly provided e-mail address by a co-owner of the account.

Although the bank became aware of this error, they did not stop sending the communications to the third party, but instead instructed the data subject to exercise their right to correct the inaccurate data.

As a result of its investigation, the DPA found that the bank had violated the principle of confidentiality for failing to stop sending the communications. The DPA also found that the bank had failed to report the data breach to the DPA and the data subject in a timely manner.

Open original source Links to the regulator's original publication or another source.