DPA case 17/2020 (bank) – Reprimand (Belgium, 2020)

On 28 April 2020 the Belgian DPA’s Litigation Chamber issued decision 17/2020, DOS-2019-05450, reprimanding an anonymised bank for answering two clients’ September 2019 access requests about four months later. The bank had neither responded within one month nor justified an extension in time. Misrouting, staff illness and the use of a non-standard request channel did not excuse the delay. On these facts the bank had not substantiated reasonable identity doubts that justified requiring identity-card copies; the decision did not prohibit all identity checks by banks. The Chamber could assess the complaint under Article 15 GDPR despite the complainants initially citing an inapplicable national-law provision. It dismissed the separate complaint about missing information on why the banking relationship ended, leaving the broader commercial and anti-money-laundering dispute to the courts. No fine or additional sanction was imposed. The source contains a citation inconsistency: paragraphs 46–57 ground the deadline infringement in Article 12(3), while the operative order prints Article 12(1), together with Articles 15(1) and 15(3); Article 12 is therefore recorded without choosing between those paragraph citations. This original decision provides no independent proof of subsequent appeal or finality.