LEA BANK ASA
Holbergs gate 21
0166 OSLO
Deres referanse Vår referanse Dato
24/01427-11 19.08.2024
Sui Generis Decision - LEA Bank ASA
On 1 April 2024, the Spanish Agency for Data Protection (“Agencia Española de Protección de
Datos”, “ES SA”) shared with the Norwegian Data Protection Authority (“Datatilsynet”, “us”,
“our”) a complaint lodged by (“complainant”) againt
LEA Bank ASA (“LEA Bank”, “bank”, “controller”).
The complainant argued that on 21 November 2023 he contacted LEA Bank to essentially
obtain the deletion of the personal data he submitted to the bank in connection with a request
for a loan that LEA Bank rejected. However, according to the complainant, he received no
response from LEA Bank.
Further to our inquiry, LEA Bank acknowledged that they have received a request for a loan
from the complainant on 21 November 2023, but they do not seem to have received the request
concerning the complainant’s personal data.
In any event, LEA Bank informed us that their internal routines and policies provide for the
automatic deletion of the personal data submitted in connection with requests for a loan that
LEA Bank has rejected. LEA Bank has confirmed that the complainant’s personal data have
been deleted as part of this standard process.
Taking into account that the automatic erasure of the complainant’s personal data has
essentially mooted the issues raised in the complaint, that supervisory authorities «should seek
an amicable settlement with the controller» (Rec. 131 GDPR), and that on 11 July 2024 the ES
SA has informed the complainant of the above without receiving any objections regarding the
closure of the case, we consider that the subject matter of the complaint has been investigated
to the extent appropriate in accordance with Article 57(1)(f) GDPR, and that the matter may be
deemed to be resolved to the complainant’s satisfaction. We have therefore decided to close the
present case in accordance with Article 60(7) GDPR and the requirements of Internal EDPB
Document 06/2021 on the practical implementation of amicable settlements (adopted on 18
November 2021).
Pursuant to Article 60(3) GDPR, a draft of the present decision was shared with the supervisory
authorities concerned, which did not raise any objections.
Postadresse: Kontoradresse: Telefon: Org.nr: Hjemmeside: 1
Postboks 458 Sentrum Trelastgata 3 22 39 69 00 974 761 467 www.datatilsynet.no
0105 OSLO 0191 OSLO
Kind regards
Tobias Judin
Head of International
Luca Tosoni
Specialist Director
Dokumentet er elektronisk godkjent og har derfor ingen håndskrevne signaturer
Kopi til: Supervisory Authorities Concerned
2