DPA case Cembra Money Bank AG – Violation Found (Switzerland, 2025)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
Cembra Money Bank was found to have delayed responses to customer requests for information about their personal data. The data protection authority emphasized that companies must respond promptly and clearly to such requests, which is crucial for maintaining trust with customers.
What happened
The bank failed to comply with requests for information from customers in a timely manner.
Who was affected
Two customers of Cembra Money Bank were affected by the bank's handling of their requests.
What the authority found
The authority found that the bank violated data protection laws by providing generic and late responses to customer inquiries.
Why this matters
This ruling underscores the importance of timely and clear communication with customers regarding their personal data. Companies should improve their processes for handling such requests.
Source checks
Secondary-source text retrieved.
Automated check recorded — 18 October 2026.
Processing notes: articles corrected, national law identified.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
= The DPA received two complaints against Cembra Money Bank AG (the controller). Both data subjects complained that the controller failed to comply with their requests for information. In particular, one of the two complainants requested information after being denied an application for a credit card. He specifically asked for the following information: * An explanation of the controller’s decision to deny the application: * A copy of the personal data, upon which the controller based its decision; * Information about the sources of his personal data. = On these grounds, the DPA opened a broader investigation and found that the controller provided late response to at least 9 requests between December 2023 and August 2024. Additionally, all those responses (as well as the responses to other four requests) consisted of a standardized text, along with a link to the privacy statement on the controller’s website. The responses in question stated that "we process all categories of data relating to an identified or identifiable natural person. This includes personal data (surname, first name, date of birth, address, contact details (telephone, email, etc.), particularly sensitive data (e.g. sexual orientation, which may result from marital status), all types of financial data (salary statements, tax assessments, etc.), credit information (...) and data that may result from profiling, e.g. when visiting our websites to improve customer satisfaction or for marketing purposes." The DPA held that the controller violated Article 25 of the Federal Data Protection Act (FDPA) by providing generic and belated responses to data subjects’ requests. This finding related to both the two complaints and the controller's broader handling of data subjects' requests, which the controller investigated ex officio. The DPA issued a warning and ordered the controller to properly handle requests in the future. With regards to the complaint relating to the credit card application, the DPA clar
Outcome
Violation Found
The DPA found a violation but did not impose a fine.
Related Enforcement Actions (0)
No other enforcement actions found for DPA case Cembra Money Bank AG in CH
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. DPA case Cembra Money Bank AG - Switzerland (2025). Retrieved from cookiefines.eu
Last updated: