Norway

BRAbank ASA

39,700 €

GDPR enforcement action by Norwegian Supervisory Authority (Datatilsynet) on 2021-05-28.

Rank · Sector

#140

of 322 in Finance, Insurance and Consulting

Rank · Norway

#22

of 52

Rank · All fines

#843

of 3,042

Case details

Authority: Norwegian Supervisory Authority (Datatilsynet)
Date: 2021-05-28
Controller / Processor: BRAbank ASA
Sector: Finance, Insurance and Consulting
Quoted Articles: Art. 24 GDPR, Art. 32 (1), (2) GDPR
Type of violation: Insufficient technical and organisational measures to ensure information security

Summary

The Norwegian DPA (Datatilsynet) has imposed a fine of EUR 39,700 on BRAbank ASA. The controller had reported a data breach to the DPA on September 6, 2019. On the controller's website, some customers were able to view other customers' data on the "My Page" section. These included credit terms and address information of other customers. The section had been activated shortly before for 500 selected customers and was intended, among other things, to provide an overview of loans taken out with the controller.
Based on investigations into the case, the DPA found that the controller had not complied with the GDPR's requirements for risk assessment and appropriate technical measures in connection with the launch of the customer portal. According to the DPA's assessment, the personal data security breach could have been prevented if the controller had conducted a risk assessment and review as required by law.

Open original source Links to the regulator's original publication or another source.