- Enforcing jurisdiction
- Malta · Geography does not establish applicable law.
- Confirmed applicable legislation
- Privacy topics
DPA case IDPC (Malta) - EDPBI:MT:OSS:D:2019:70 – €8,000 Fine (Malta, 2019)
Privacy enforcement record
This record is classified outside cookie consent. Subject classification does not confirm an applicable law. It is not included in cookie statistics or the Risk Calculator.
A bank in Malta was fined for not responding to a customer's request for access to their personal data. This is important because it shows that companies must have proper systems in place to handle such requests, or they could face penalties.
What happened
A customer requested access to their personal data but did not receive a response from the bank.
Who was affected
The customer who requested access to their personal data from the bank.
What the authority found
The authority found that the bank failed to respond adequately to the access request, violating GDPR rules.
Why this matters
This case highlights the necessity for companies to establish clear procedures for handling data access requests. It serves as a warning that neglecting these responsibilities can lead to significant fines.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Linked-source text retrieved.
Automated check recorded — 18 October 2026.
No issues were reported by that automated check.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
The complainant requested access to their personal data, but did not obtain a response from the controller (a bank). Upon investigation by the Maltese DPA (IDPC) the controller initially claimed that a response had been provided to the complainant. However, upon further investigation, the controller admitted that the response had not been sent. According to the controller the response had not been sent due to a mistake made by an individual employee, who had applied restrictive settings to their mailbox. Moreover, it found that said employee left the company without a proper transfer of the case to another employee. The IDPC considered that the controller did not have adequate procedures in place to deal with access requests which resulted in the complainant actually being deprived of her right to access her data within the time-frame stipulated in the GDPR.
Related Enforcement Actions (0)
No other enforcement actions found for DPA case IDPC (Malta) - EDPBI:MT:OSS:D:2019:70 in MT
This is the only recorded action for this entity in this jurisdiction.
Details
Fine Date
28 October 2019
Authority
Information and Data Protection Commissioner
Fine Amount
€8,000
GDPRhub ID
gdprhub-4599About this data
Cite as: Cookie Fines. DPA case IDPC (Malta) - EDPBI:MT:OSS:D:2019:70 - Malta (2019). Retrieved from cookiefines.eu
Last updated: