The time has come: the Personal Data Authority is imposing a fine!

Theodoor Gilissen Bankiers (TGB) (recently InsingerGilissen Bankiers) has had to pay a penalty of €48,000 to the Personal Data Authority (AP). The bank did not cooperate with a customer's request for access to his personal data. In doing so, TGB acted in violation of the General Data Protection Regulation (AVG).

The customer in question requested an overview of the personal data the bank had on him, what the origin of this data was and with whom it was shared. When TGB did not give the customer access to his personal data, the customer's lawyer filed an enforcement request with the Personal Data Authority. Indeed, refusing - without a basis - a data subject's request for access is, as mentioned, in violation of the AVG.

After investigation, the AP gave the bank two months to still give the customer access to the requested personal data, imposing an order under penalty. Each week that TGB did not fully comply with the access request, the bank had to pay €12,000, with a maximum of €60,000. Ultimately, TGB provided the requested information to the customer four weeks "too late. The bank therefore had to pay €48,000 in penalties to the AP.

Privacy rights for all

Under the AVG, people have several options - in addition to the right to access - to stand up for themselves if their personal data is being processed. These include the right to object to certain data processing, the right to transfer personal data and the right to be forgotten. As an organization, you must ensure that requests from data subjects who wish to exercise their privacy rights can be properly responded to. Can your organization meet this obligation? If not, we would like to think along with you. Feel free to call or email us: Valerie Lipman and Annemarie van Woudenberg.

You can read the Authority's news release here.