mBank – €932,230 Fine (Poland, 2024)

mBank (the controller) entrusted a third-party to perform processing activities (a processor). The processor’s employee, erroneously, sent the controller’s clients documents to another bank. The documents contained the following personal data: name, surname, national identification number (PESEL), financial data (clients’ assets), account number, ID number. According to the controller, the other bank sent back all the documents. The documents’ integrity was not affected, yet it was probable that the other bank’s employees read the documents. As the documents confidentiality was violated, a data breach under Article 4(12) GDPR occurred. Nevertheless, the controller was of the opinion that the risk posed by the breach was minimised by the statutory bank secrecy. Because of that, the controller didn't see a reason to notify the data subjects in accordance with Article 34 GDPR. However, the controller notified the Polish DPA (UODO) about the data breach. During the following proceedings, the DPA requested the controller to notify the data subjects involved about the breach under Article 34 GDPR. The controller asked the DPA to reconsider their request. The controller emphasised the documents were shared with the other bank, the controller’s business partner, which should be treated as “a trusted party”. That was because the other bank, together with the controller, were part of banking sector in Poland. As such, both the controller and the other bank pursue highly regulated business activity, in particular in the field of data protection and cybersecurity. For this reason, the breach didn’t pose “a significant risk of negative consequences for the data subjects”. In addition the other bank’s employees made a statement confirming they didn’t possess the documents’ copies and were unable the identity of the data subjects. Moreover, the other bank’s employees were aware of duties associated with the bank secrecy, as well the liability for its breach under Article 171 para 5 of [https://isap.sejm.gov.pl/isap.nsf/download.xsp/WDU19971400939/U/D19970939Lj.pdf the Banking law] (Prawo bankowe). The DPA found the controller violated Article 34 GDPR. The controller correctly identified the incident as the data breach under Article 4(12) GDPR. However, the controller failed to assess the risk of the data breach. Due to the character of data disclosed, the breach posed a high risk to rights and freedoms of data subjects, inter alia, an identity theft or banking frauds. Although the data was shared erroneously with the other bank, the status of the bank didn’t automatically mean it was “a trusted party”. The bank secrecy and the statements of the other bank’s employees were not a sufficient safeguard against a future misuse of the data. The DPA stressed there was no formal relationship between the controller and the other bank, nor internal procedures implemented to handle incidents of that kind. The controller also didn’t prove the knowledge of the other bank’s data protection safeguards in place, especially implemented policies. Hence, the controller had no authority to enforce the statements in practice, and consequently no safeguards to minimise the risk posed by the data breach. Furthermore, the controller failed to reassess the risk of the data breach, as requested by the DPA. For the DPA the conduct of that kind meant the controller disregarded their duties, especially the duty to protect the data subjects. The DPA fined the controller PLN 4,053,173 (€928,498.06) and ordered to notify the data subjects involved about the data breach and its consequences, in line with Article 34 GDPR.