Íslandsbanki – Complaint Upheld (Iceland, 2020)

The complainant complained to the Icelandic DPA (Personuvernd) that an unauthorized person (his mother) was given access to his online banking account by his bank Íslandsbanki. The complainant’s mother was able to read his financial information and portfolio of securities without his consent. The complainant claimed that this was a violation of his right to confidentiality and privacy. Íslandsbanki argued that the complainants mother was given access to his personal data on online banking due to a human error by an employee. Íslandsbanki stated that the complainant’s consent nor a proxy had been obtained for the purpose of granting access to an unauthorized person. Íslandsbanki also stated that it did not report the security breach to the DPA because it was unlikely to pose a risk to the complainant’s rights and freedoms (Article 27(2) Act 90/2018). There was limited risk to the data subject as the unauthorized person granted access was a member of his family and the read access was limited to the complainant’s portfolio of securities. Was granting access to the complainant's online banking to an unauthorised person as a result of a human error a violation of the Act 90/2018 and the GDPR? The Icelandic DPA clarified that a legal basis for processing was required under Act 90/2018. This could either be on the basis of consent (Article 9(1) Act 90/2018) or necessity for the legitimate interests of the controller (Article 9(6) Act 90/2018). The DPA established that there was no such legal basis as access to the complainant’s online banking personal data was granted to his mother as a resuslt of a human error of an employee at Íslandsbanki. The Icelandic DPA established that there is a duty to respect principle that processing of personal data must be secured according to Article 8(1)(6) Act 90/2018 (Article 5(1)(f) GDPR). This was interpreted as requiring that personal data must be kept secret from unauthorised persons. The Iceland DPA then referred to Article 23 A