- Enforcing jurisdiction
- Greece · Geography does not establish applicable law.
- Confirmed applicable legislation
- Privacy topics
Τράπεζα Πειραιώς Α.Ε. – €210,000 Fine (Greece, 2023)
Privacy enforcement record
This record is classified outside cookie consent. Subject classification does not confirm an applicable law. It is not included in cookie statistics or the Risk Calculator.
Piraeus Bank faced scrutiny from the Hellenic Data Protection Authority after a customer complained about a mistaken letter regarding a loan. The bank admitted to sending the letter in error but could not confirm if the customer's data was shared with a subsidiary. This case emphasizes the need for accurate data handling and communication with customers.
What happened
Piraeus Bank mistakenly informed a customer about a loan claim and failed to provide adequate information about their personal data.
Who was affected
A customer of Piraeus Bank who received incorrect information about a loan claim.
What the authority found
The authority could not determine if the customer's data was shared but noted the bank's failure to provide sufficient information in response to the customer's request.
Why this matters
This situation highlights the importance of clear communication and accurate data management. Businesses should ensure they handle customer information correctly to avoid misunderstandings and complaints.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Linked-source text retrieved.
Automated check recorded — 6 March 2026.
No issues were reported by that automated check.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
Piraeus Bank S.A., the controller, sent the data subject a letter informing them that it had entrusted the management of loans and credit related claims to a credit management company (AFS), its wholly owned subsidiary. The letter also informed that the data subject was subject to a claim and that their personal data had been shared with AFS, which was managing the claim. The data subject submitted an access request to the controller under Article 15 GDPR, asking for more detailed information such as the date, the means and the purpose of the transmission of their personal data, as well as the loan contract number and any other personal data. The controller responded that the letter was sent to the data subject by mistake and asked them to disregard it as their personal data had not been shared and remained on its servers. Dissatisfied with the response, the data subject filed a complaint with the Hellenic DPA, claiming that the controller did not provide them with sufficient information. Moreover, they argued that they did not have any loan or credit related claim with the controller and, therefore, there was no legal basis for sharing their data with AFS. The DPA opened an investigation regarding the controller. In the procedure, the controller stated that it had an agreement with AFS for the management of its 'portfolio' (receivables from loan granting and/or customers' debts that had became overdue, terminated or settled). The controller admitted that, due to a technical problem with its systems, letters were mistakenly sent to customers that had zero balance and should not be included in the portfolio. After the investigation, the Hellenic DPA could not determine if the data subject's data had been transferred to AFS, but reserved itself the right to further investigate the matter. On the other hand, the DPA found that personal data from the data subject, as well as from a large number of customers who were involved in loans with zero rest were mistakenl
Related Enforcement Actions (0)
No other enforcement actions found for Τράπεζα Πειραιώς Α.Ε. in GR
This is the only recorded action for this entity in this jurisdiction.
Details
Fine Date
12 June 2023
Authority
Hellenic Data Protection Authority
Fine Amount
€210,000
About this data
Cite as: Cookie Fines. Τράπεζα Πειραιώς Α.Ε. - Greece (2023). Retrieved from cookiefines.eu
Last updated: