¶ ile paragrafa bağlantı verin veya alıntıyı künyesiyle kopyalayın. Üretilen bağlantı kimlikleri resmî paragraf numarası değildir.
29 May 2024
J.No. 2023-7329-0022
Doc.no. 535689
Caseworker
Your complaint against Nordea Danmark, Filial af Nordea Bank Abp,
The Danish Data
Finland Protection Agency
Carl Jacobsens Vej 35
1. Introduction 2500 Valby
Denmark
The Danish Data Protection Agency, Datatilsynet, (“Danish DPA”) refers to the complaint
T 3319 3200
against Nordea Danmark, Filial af Nordea Bank Abp, Finland (hereafter Nordea) you submitted [email protected]
on 8 February 2021. In your complaint you have stated that Nordea has disclosed information datatilsynet.dk
about you to unauthorized persons in connection with sending an annual statement to an ad- VAT No. 11883729
dress you no longer live at.
The Danish DPA can inform you that the Danish DPA has received two other complaints about
the same incident.
After having reviewed your complaint, the Danish DPA concluded that your complaint con-
cerned a cross-border processing of personal data (within the meaning of Article 4(23) of the
General Data Protection Regulation (GDPR)) 1, which meant that the case had to be processed
in cooperation with the supervisory authorities of other EU/EEA Member States in accordance
with Article 60 GDPR. The Danish DPA informed you of this on 5 March 2021.
In cases that concern a cross-border processing of personal data, the supervisory authority of
the main establishment or of the single establishment of the relevant company – which in this
case is located in Finland – shall be competent to act as lead supervisory authority. Thus, in
the present case, the Office of the Data Protection Ombudsman, (“Finnish DPA”), acted as
lead supervisory authority.
Following this, on 4 March 2021, the Danish DPA sent your complaint to the other supervisory
authorities, including the supervisory authority in Finland, which has carried out the further
processing of the case.
On 25 April 2024 the Finnish DPA sent its draft decision to the concerned supervisory author-
ities, including the Danish DPA, in which this decision originates. None of the supervisory au-
thorities had any remarks to the draft decision.
1 REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 27 April 2016 on the pro-
tection of natural persons with regard to the processing of personal data and on the free movement of such data, and repeal-
ing Directive 95/46/EC (General Data Protection Regulation
2. The Finnish supervisory authority’s decision and reasons hereof Page 2 of 3
The Finnish DPA has informed the Danish DPA that Nordea, on 18 January 2021, notified the
supervisory authority of the personal data breach.
The Finnish DPA has further stated that the supervisory authority has received similar notifi-
cations from Nordea in December 2019 and January 2022, and that the Finnish DPA has
initiated an own-initiative investigation concerning the data breach notification received from
Nordea including an investigation concerning Nordea’s data processing when sending letters
by post. It appears that the case is still ongoing.
Since the Finnish DPA is dealing with the case on their own motion which concerns the same
incident that you have complained about, the supervisory authority has decided to dismiss
your complaint. The Finnish DPA has found that there is no reason to continue a separate
investigation of the complaint, and that this would lead to a similar outcome as the ongoing
investigation.
The Finnish DPA has further stated that it appears from the notification, inter alia, that Nordea
has sent annual statements regarding account balances to customers using year old informa-
tion, including previous addresses. This meant that there was a risk that third parties would
gain unauthorized access to customers’ information if they had changed their address the pre-
vious year.
It further appears that Nordea’s investigations of the breach indicated that the breach hap-
pened due to an IT error combined with a process/human error. It appears that all data used
for the annual statements were collected in an internal system and checked to be correct be-
fore the information is transferred through another application for printing and forwarding pur-
poses. However, in the specific case, it turned out that a minor IT change affected this process,
so that year old information was retrieved and transferred instead of the most recent informa-
tion in the system.
Nordea has stated that the company generally carries out an additional manual review after
the information in question is transferred, of which a certain amount of the annual statements
is printed and reviewed. However, due to the Covid-19 situation, which meant that employees
worked from home, employees had limited or no access to printers. As a result, this additional
manual review was not carried out. Instead, the employees relied on the data being checked
to be correct in the system before being transferred.
In addition, the Finnish DPA has stated that Nordea, during their investigation of the incident,
sent corrected/correct annual statements to customers as well as notifications to all concerned
citizens (data subjects) on 29 January 2021 in accordance with Article 34 of the GDPR. Fur-
thermore, an IT change request to fix the error in the system was made and implemented on
1 February 2021.
Finally, the Finnish DPA has stated that Nordea has fulfilled the obligation to notify the relevant
supervisory authority by notifying the Finnish DPA on 18 January 2021, cf. Article 33(1) of the
GDPR.
3. Closing remarks
On the basis of the above, the Danish DPA considers the case closed and does not take any
further action in connection with your complaint.
The Danish DPA notes that the supervisory authority’s decisions cannot be challenged before Page 3 of 3
another administrative authority, cf. Section 30 of the Data Protection Act. However, the Danish
DPA’s decisions may be brought before the courts, cf. section 63 of the Constitution.
Kind regards