DPA case 2023-31-0321 – Reprimand (Denmark, 2026)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
A Danish bank was reprimanded for not providing a customer access to their account logs. This case shows that customers have rights to see how their data is accessed.
What happened
The bank did not allow a customer to access logs showing if their former spouse accessed their accounts.
Who was affected
A customer who suspected their former spouse was accessing their bank account without permission.
What the authority found
The data protection authority ruled that the bank must comply with the customer's request for access to their account logs.
Why this matters
This case reinforces that customers have the right to know how their personal data is handled, which is crucial for trust in financial institutions.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Secondary-source text retrieved.
Automated check recorded — 18 October 2026.
Processing notes: national law identified.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
A customer of a bank ('the data subject'), suspected that their former spouse, who was employed by the same bank ('the controller'), was accessing their accounts and decided to switch banks. In order to make this change, the data subject was charged a number of fees, and subsequently filed a complaint with the Financial Appeals Board. The director of the bank offered to reimburse the fees in return for the case at the Appeals Board to be closed. On 20 March 2023 the data subject agreed to the reimbursement and requested access to the employee's access log’s pertaining to the data subject's accounts between the period of 2015-2021. One day later the director made the reimbursement of the fees conditional upon the complainant giving up their access request. 20 June 2023 the controller informed the data subject that they requested the data subject's former spouse to explain and substantiate the access to the account. The former spouse stated that they where looking at the account as a customer and not an employee. The controller investigated, however the logs of the use of the system did not go that far back. Correspondingly, the controller requested its data center to recover the logs but was faced with costs of about DKK 300,000 without the guarantee of the recovery being successful. The controller emphasised that customers may not request employees’ access logs, and that the costs would not be proportionate to the clarification which the data subject would receive. This was communicated to them. The DPA, following the CJEU in C-579/21 Pankki S, maintained that the information appearing within the logs concerning employees access to a customer’s account are covered by the right of access in Article 15 GDPR. Nonetheless, considering the controller informed the data subject that the requested log information is no longer available, and that the requested logs do not fall under the retention obligation pursuant to Article 30 of the national Anti-Money Laundering Act,
Outcome
Reprimand
A formal reprimand: the DPA found a violation and issued a formal censure.
Related Enforcement Actions (0)
No other enforcement actions found for DPA case 2023-31-0321 in DK
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. DPA case 2023-31-0321 - Denmark (2026). Retrieved from cookiefines.eu
Last updated: