BRAbank ASA – €39,700 Fine (Norway, 2021)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
Norway's Datatilsynet fined BRAbank ASA EUR 39,700 for a data breach. Customers could see each other's personal information on the bank's website due to poor risk assessment and technical measures. This highlights the importance of proper security checks before launching new online features.
What happened
BRAbank ASA allowed customers to view other customers' personal data on its website due to inadequate security measures.
Who was affected
Customers using BRAbank ASA's 'My Page' section who could see other customers' credit terms and addresses.
What the authority found
The Norwegian DPA found BRAbank ASA failed to conduct necessary risk assessments and implement proper security measures, violating GDPR requirements.
Why this matters
This case underscores the need for businesses to conduct thorough risk assessments and implement strong security measures before launching new online services. It serves as a reminder that failing to do so can lead to significant fines and damage to customer trust.
GDPR Articles Cited
The Norwegian DPA (Datatilsynet) has imposed a fine of EUR 39,700 on BRAbank ASA. The controller had reported a data breach to the DPA on September 6, 2019. On the controller's website, some customers were able to view other customers' data on the 'My Page' section. These included credit terms and address information of other customers. The section had been activated shortly before for 500 selected customers and was intended, among other things, to provide an overview of loans taken out with the controller. Based on investigations into the case, the DPA found that the controller had not complied with the GDPR's requirements for risk assessment and appropriate technical measures in connection with the launch of the customer portal. According to the DPA's assessment, the personal data security breach could have been prevented if the controller had conducted a risk assessment and review as required by law.
Related Enforcement Actions (0)
No other enforcement actions found for BRAbank ASA in NO
This is the only recorded action for this entity in this jurisdiction.
Details
Fine Date
28 May 2021
Authority
Datatilsynet (Norway)
Fine Amount
€39,700
Enforcement Tracker ID
ETid-723
About this data
Cite as: Cookie Fines. BRAbank ASA - Norway (2021). Retrieved from cookiefines.eu
Last updated: