This article discusses the decision of the Commissioner for
Personal Data (Commissioner) issued on
17th June 2020, through which a fine in the amount of
€15.000 was imposed to a Bank for violation
of several obligations stemming from the General Data Protection
Regulation (hereinafter the GDPR).
These obligations refer to, among others, principles relating
to processing of personal data, right of access by the data
subject, security of processing and the notification of a personal
data breach of GDPR.
What was the factual background?
A complaint was filed against a
Bank (Bank) and the insurance company
from an individual due to the inability of the Bank to provide him
with a copy of his insurance contract upon his request. According
to Bank's allegations the provision of a copy of the document
was not feasible because the original contract has been archived in
a place, where its trace was difficult and time consuming. The Bank
did not notify the competent
