- Enforcing jurisdiction
- Greece · Geography does not establish applicable law.
- Confirmed applicable legislation
- Privacy topics
National Bank of Greece – €20,000 Fine (Greece, 2022)
Privacy enforcement record
This record is classified outside cookie consent. Subject classification does not confirm an applicable law. It is not included in cookie statistics or the Risk Calculator.
The National Bank of Greece replaced all customers' debit and credit cards with new ones that stored transaction history without their consent. This decision raised privacy concerns since customers were not informed about the data collection. The ruling emphasizes the importance of user consent in data processing.
What happened
The National Bank of Greece replaced customers' cards with new ones that stored transaction history without informing them.
Who was affected
Customers of the National Bank of Greece whose debit and credit cards were replaced.
What the authority found
The Hellenic Data Protection Authority ruled that the bank lacked a valid legal basis for processing personal data, violating GDPR requirements for user consent.
Why this matters
This case highlights that companies must obtain user consent before processing personal data. It serves as a reminder for businesses to ensure transparency and compliance with data protection regulations.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Linked-source text retrieved.
Automated check recorded — 13 March 2026.
Processing notes: articles corrected.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
The National Bank of Greece (the controller) replaced all debit/credit cards of its customers (data subjects) with new ones which could carry out contactless transactions. Data subjects could not refuse the replacement. The new cards embedded a chip stored information on the 10 last transactions. According to the controller, this information included only the date, the amount, and currency of the transaction. Third parties could gain unauthorised access to this data by situating a "reading" device (e.g. a smart phone with malicious software installed) close to the card. According to the manufacturer of the cards (Mastercard), this feature was not necessary for carrying out contactless payments and it was the controller's choice to add it. The range of the collected data was also determined by the controller. However, the controller did not inform the data subjects about these processing operations. After a data subject's complaint in 2015, the Greek DPA issued a warning in [https://www.dpa.gr/sites/default/files/2019-10/48_2018anonym.pdf Decision 48/2018]. The DPA held that since the collection performed by the chip was not necessary for carrying out contactless payments, the processing could only be based on the data subject's consent. After that, the DPA ordered the controller to inform the data subjects who were already possessing the cards in question and had not granted their consent about the storage of transaction history. The information could be delivered by any appropriate means (such as email, postal notice, message through the e-banking account). By doing so, the data subjects could have the opportunity to object to this processing (Article 21 GDPR). In case of an objection, the controller had to deactivate the collection of the transaction history or issue a new card without this feature. For the cards issued in the future, the feature in question had to be deactivated by default and could be activated only based on the data subject's consent. On 15 No
Related Enforcement Actions (2)
Other enforcement actions involving National Bank of Greece in GR
Fine
€20K
Details
Fine Date
14 July 2022
Authority
Hellenic Data Protection Authority
Fine Amount
€20,000
About this data
Cite as: Cookie Fines. National Bank of Greece - Greece (2022). Retrieved from cookiefines.eu
Last updated: