Íslandsbanki – Complaint Upheld (Iceland, 2020)

The complainant complained to the Icelandic DPA (Personuvernd) that an unauthorized person (his mother) was given access to his online banking account by his bank Íslandsbanki. The complainant’s mother was able to read his financial information and portfolio of securities without his consent. The complainant claimed that this was a violation of his right to confidentiality and privacy. Íslandsbanki argued that the complainants mother was given access to his personal data on online banking due to a human error by an employee. Íslandsbanki stated that the complainant’s consent nor a proxy had been obtained for the purpose of granting access to an unauthorized person. Íslandsbanki also stated that it did not report the security breach to the DPA because it was unlikely to pose a risk to the complainant’s rights and freedoms (Article 27(2) Act 90/2018). There was limited risk to the data subject as the unauthorized person granted access was a member of his family and the read access was limited to the complainant’s portfolio of securities. Was granting access to the complainant's online banking to an unauthorised person as a result of a human error a violation of the Act 90/2018 and the GDPR? The Icelandic DPA clarified that a legal basis for processing was required under Act 90/2018. This could either be on the basis of consent (Article 9(1) Act 90/2018) or necessity for the legitimate interests of the controller (Article 9(6) Act 90/2018). The DPA established that there was no such legal basis as access to the complainant’s online banking personal data was granted to his mother as a resuslt of a human error of an employee at Íslandsbanki. The Icelandic DPA established that there is a duty to respect principle that processing of personal data must be secured according to Article 8(1)(6) Act 90/2018 (Article 5(1)(f) GDPR). This was interpreted as requiring that personal data must be kept secret from unauthorised persons. The Iceland DPA then referred to Article 23 Act 90/2018 (Article 24 GDPR) to establish that appropriate technical and organisation measures should be taken by the data controller (Íslandsbanki). The DPA also mentioned that there was a duty to ensure that safety measures guaranteed privacy by design and by default according to Article 24 Act 90/2018 (Article 25 GDPR). Finally, the Icelandic DPA outlined that Article 24(2) and Article 27 Act 90/2018 (Article 25(2) and Article 32 GDPR) required controllers to have technical and organisational measures to protect personal data against unauthorised access. Íslandsbanki did not provide appropriate security of the complainant’s personal data by granting access to an unauthorised person. Therefore, Íslandsbanki’s processing of personal data was not in accordance with Articles 8(1)(6), 23, 24, and 27 Act 90/2018. The Icelandic DPA suggested that Íslandsbanki takes additional security measures and ensures that it verifies its procedures for granting access to online banking. Íslandsbanki must provide confirmation of having achieved this by next September to the Icelandic DPA.