DPA case CDP/COMP/332/2024 – Complaint Upheld (Malta, 2025)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
A Maltese data protection authority upheld a complaint against a bank for not properly handling a customer's request for access to their personal data. This matters because it shows that companies must respond to data access requests in a timely and transparent manner.
What happened
The bank failed to provide the customer with all requested personal data, including internal communications related to their case.
Who was affected
The customer who requested access to their personal data from the bank.
What the authority found
The authority ruled that the bank violated GDPR rules by not adequately responding to the customer's data access request.
Why this matters
This case highlights the importance of transparency and responsiveness in handling personal data requests. Companies must ensure they comply with data access rights to avoid potential complaints.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Secondary-source text retrieved.
Automated check recorded — 18 October 2026.
Processing notes: articles corrected.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
On the 22 July 2024, the data subject lodged a complaint with the Maltese DPA (Office of the Information and Data Protection Commissioner – IDPC) alleging that a bank, here the controller, had failed to handle their data access request under Article 15 GDPR. The data subject had requested full access, including internal emails exchanged among employees and any other documents or briefs written about him. The data subject had lodged the access request on the 3 June 2024 to which the controller responded on the 28 June 2024 with a supply of documents relating to the data subject. However, the requested internal email and documents in connection with a certain case which had been ruled on by the Arbiter for Financial Services, was not included. The data subject reiterated his request. The controller then cited Article 15(4) GDPR and professional and bank secrecy as the reason to refuse sharing internal communications. Article 15(4) GDPR stipulates that the information provided under Article 15 GDPR musn't "adversely affect the rights and freedoms of others". The data subject clarified that his request related specifically to his personal data, did not contain any third-party data and therefore the bank secrecy should not apply to it. To this, the controller responded that all the personal data relevant had already been provided and that no further data existed. In the complaint to the DPA, the data subject highlighted that this communication with the controller highlights a contradiction as initially the controller recognized there was more information to be provided but is prohibited by the bank secrecy law but then in the next step claimed that no additional data existed. Throughout the course of the investigation, the controller submitted that several bank employees and their data were involved in the investigation of the case concerning the data subject and that this prohibited it from supplying the data. Primarily, the DPA highlighted that the controller had
Outcome
Complaint Upheld
A data subject complaint that was upheld by the DPA.
Related Enforcement Actions (0)
No other enforcement actions found for DPA case CDP/COMP/332/2024 in MT
This is the only recorded action for this entity in this jurisdiction.
Details
Decision Date
14 January 2025
Authority
Information and Data Protection Commissioner
GDPRhub ID
gdprhub-8754About this data
Cite as: Cookie Fines. DPA case CDP/COMP/332/2024 - Malta (2025). Retrieved from cookiefines.eu
Last updated: