DPA case 2023-0.789.858 (bank) – €9,500 Fine (Austria, 2023)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
An Austrian bank was fined EUR 9,500 for mishandling a customer's request to access their personal data. Instead of providing the requested information, the bank treated it as a request to delete data and only gave generic details. This case highlights the importance of properly handling access requests under data protection laws.
What happened
The bank treated a customer's access request as an erasure request and deleted the relevant data instead of providing access.
Who was affected
A customer who requested access to their personal data held by the bank.
What the authority found
The Austrian DPA ruled that the bank failed to comply with Article 15(1) of GDPR regarding access to personal data.
Why this matters
This ruling emphasizes that companies must accurately respond to access requests from users. Businesses should ensure they have clear processes for handling such requests to avoid penalties.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Secondary-source text retrieved.
Automated check recorded — 18 October 2026.
Processing notes: articles corrected.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
On 11 December 2023 the Austrian DSB fined an anonymised bank EUR 9,500 in case 2023-0.789.858 (DSB-D550.834). The bank treated a customer’s access request as an erasure request, deleted the relevant data and provided only generic information instead of the requested access. The operative infringement is Article 15(1) GDPR. A EUR 950 procedural contribution brings the payable total to EUR 10,450 but is not an additional fine. The separate complaint decision of 17 May 2023 had already established the access violation; the present monetary decision is dated 11 December. RIS states that the fine is legally final.
Related Enforcement Actions (0)
No other enforcement actions found for DPA case 2023-0.789.858 (bank) in AT
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. DPA case 2023-0.789.858 (bank) - Austria (2023). Retrieved from cookiefines.eu
Last updated: