- Enforcing jurisdiction
- Norway · Geography does not establish applicable law.
- Confirmed applicable legislation
- Privacy topics
BRABANK ASA (former Easybank ASA) – €34,800 Fine (Norway, 2021)
Privacy enforcement record
This record is classified outside cookie consent. Subject classification does not confirm an applicable law. It is not included in cookie statistics or the Risk Calculator.
BRABANK ASA faced a fine after customers could see each other's loan details due to a problem with their new online portal. This breach of privacy affected around 91 customers and highlights the importance of proper risk assessments when handling personal data. Companies must ensure their systems are secure to protect customer information.
What happened
BRABANK ASA launched an online portal that mistakenly allowed some customers to view other customers' loan details.
Who was affected
About 91 customers who logged into the portal and potentially viewed incorrect or other customers' data were affected.
What the authority found
The Norwegian Data Protection Authority ruled that BRABANK ASA failed to conduct proper risk assessments and implement adequate security measures as required by GDPR.
Why this matters
This case emphasizes the need for companies to thoroughly assess risks before launching new online services. It serves as a reminder that inadequate security can lead to serious privacy breaches.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Linked-source text retrieved.
Review needed — 12 March 2026.
Processing notes: amount discrepancy.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
A bank launched a new online portal for a selection of customers (about 500) where they would be able to see their loans. However, as a result of "frequent navigation" and, consequently, a problem with verifying sessions per user, some customers were able to see other customers' data, including contact information, while others only saw incorrect loan details. After a customer notified the bank that her loan details were incorrect, the bank immediately shut the portal down. By then, 91 customers had logged on and had potentially viewed incorrect data/ data of other data subjects. When asked about the exact reason why the discrepancy occurred, the bank was not able to recreate the error. The bank claimed they tested the portal between May and August 2019. After this incident, they conducted thorough testing and added an extra verification measure in the system, before they testing once again and did another launch for a selection of customer. After 14 days without errors, they launched the portal to all customers and after six months operations, no new errors have been discovered. When asked by the DPA, the bank said that they had assessed the risks for the rights and freedoms of the customers as "low" because they could not change the information themselves and the personal data presented were not of a sensitive nature. However, they were not able to document that they had made this assessment. Did the bank comply with the requirements of Articles 24 and 32 GDPR when introducing the new online customer portal? First, the DPA held that the bank did not comply with the GDPR requirements for conducting risk assessments. Both Article 24 and Article 32 GDPR impose such an obligation. Considering the individual case a thorough assessment would have been necessary. This is due to the following facts: Although financial data do not constitute special categories of personal data within the meaning of Article 9 GDPR, they are nevertheless to be considered sensitive dat
Related Enforcement Actions (0)
No other enforcement actions found for BRABANK ASA (former Easybank ASA) in NO
This is the only recorded action for this entity in this jurisdiction.
Details
Fine Date
28 May 2021
Authority
Datatilsynet (Norway)
Fine Amount
€34,800
400,000 NOK
About this data
Cite as: Cookie Fines. BRABANK ASA (former Easybank ASA) - Norway (2021). Retrieved from cookiefines.eu
Last updated: