Hellenic Bank PLC – Violation Found (Cyprus, 2020)

In April 2019, Client A asked Hellenic Bank to update his information. During the updating process, a typing mistake occurred with his passport number. At the time of the mistake, the wrong passport number didn't match with that of any client. In May 2019, Client B needed to verify his information, too, but his new passport had the number that the bank employee had mistakenly typed as Client A's passport number. The result of the abovementioned timeline was that client B had partial access through the web banking platform to client A's personal and financial data. When B noticed that, he informed the Bank, and the access issue was resolved. But due to the passport number mistakenly matching, the Bank's system automatically merged the postal addresses of both clients. After two months, client B received a debit card with client A's name on it. The Bank follows the four eyes principle. The principle calls for an employee, before the execution of an act, to ask for the verification from a colleague, who should re-examine the act for possible mistakes. Furthermore, a system error appeared to the employee who updated B's details, and the employee re-verified B's documents and evidence including such as a passport copy. He or she ignored the error-message and proceeded with the process. The fellow employee wasn't informed about the error message in regard to the potential conflict in the clients' data, and it requires time to examine the reasons that triggered the system error. Among other details, the fact that Client A was a Bank user under a business account was highlighted too. The Bank alleges that A's information, including her name and address, was part of a wider body of a legal entity's data, which are not subject to the under General Data Protection Regulation 2016/679. According to Article 33 of GDPR, in the case of a personal data breach, the Data Controller shall without undue delay and, where feasible, not later than 72 hours after having become aware