1(5)
COMPLAINANT
See Annex
SYNSOBJEKT
TF Bank AB
Reference number:
IMY-2023-16160
Date:
[2024-12-19]
Final decision under the General Data
Protection Regulation – TF Bank AB
Decision of the Swedish Authority for Privacy
Protection
The Swedish Authority for Privacy Protection (IMY) notes that TF Bank AB, 556158-
1041, in its handling of the complainant’s request for access made on 2 September
2019, has processed personal data in breach of Article 12(3) of the GDPR1 by failing to
comply without undue delay with the complainant’s right of access under Article 15 of
the GDPR and by failing to inform the complainant without undue delay of the
measures they have taken in response to the complainant’s request for erasure under
Article 17 of the GDPR.
The Swedish Authority for Privacy Protection issues a reprimand to TF Bank AB
pursuant to Article 58(2)(b) GDPR for infringement of Article 12(3) GDPR.
Presentation of the supervisory case
Postal address: Due to the cross-border nature of the case, IMY has made use of the
cooperation and consistency mechanisms found in Chapter VII of the GDPR. The
Box 8114
104 20 Stockholm concerned supervisory authorities have been the
Website: the data protection authorities of Finland and Germany.
www.imy.se
E-mail:
[email protected] 1 Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural
Telephone: persons with regard to the processing of personal data and on the free movement of such data, and repealing
08-657 61 00 Directive 95/46/EC (General Data Protection Regulation).
The Privacy Protection Authority Reference number: IMY-2023-16160 2(5)
Date: [Date]
The complaint
IMY has initiated supervision of TF Bank AB in order to investigate a complaint about
the right of access and the right to erasure.
The applicant states, in essence, as follows. The complainant responded to a marketing
campaign and applied for a credit card from TF Bank AB. The bank did not accept the
application without a signed original application form, and the complainant chose to
withdraw the application. At the same time, on 2 September 2019, the complainant
requested access to the personal data processed by the Bank concerning him pursuant
to Article 15 of the GDPR. The complainant also requested that his data be deleted in
accordance with Article 17 of the GDPR after the request for access had been granted.
TF Bank did not deal with the complainant’s requests.
TF Bank AB
TF Bank AB states, in essence, as follows. The Bank received and registered the
applicant’s request for access and erasure on 2 September 2019. Following the
commencement of supervision by IMY, the Bank contacted the complainant on 8
December 2023 with information on its internal procedures as well as information on the
personal data the Bank holds about the complainant. The complainant’s request for
erasure was not properly dealt with upon receipt in 2019. Even if the request had been
handled, deletion would not have been authorised with reference to the bank’s internal
procedures at the time of the request and with reference to requirements under anti-
money laundering legislation. When a person, at the time of the request, applied for and
was approved for any of the bank's products but for some reason chose not to complete
the application, the personal data was saved for five years after the bank received
information that the application wuold not be completed. The purpose of the procedure
was to prevent fraud, to meet the need to save customer data in order to improve credit
approval processes and to meet the requirements of anti-money laundering legislation.
TF Bank AB has also stated that financial information linked to registrants who have not
completed their application to become a customer is hidden from the staff of the bank
after 90 days from the date that the registrant choose not to complete their application.
All other personal data will be irrevocably anonymised after five years. For the
complainant, this would take place in September 2024. The bank has now decided to
anonymise all customer data linked to the complainant immediately and informed the
complainant about it on 8 December 2023. Since 2019, the Bank has implemented
improved processes and revised procedures.
Statement by the complainant
At the request of IMY, the German data protection authority gave the complainant the
opportunity to comment on the statements made by TF Bank AB. The applicant states,
in essence, as follows. It took TF Bank AB four years to respond to the complainant’s
request. This is an unacceptable delay. Furthermore, the applicant’s personal data have
not been deleted until more than four years have elapsed. The applicant has suffered
significant damage, first, as a result of the unlawful use of his personal data and,
second, as a result of the fact that those data were not erased and continued to be
processed for four years. If the complainant receives an apology and compensation
equivalent to EUR 2 500, he may consider withdrawing his request. Otherwise, the
complainant would like a comprehensive supervision to be carried out in order to clarify
the matter down to the smallest detail and establish the reasons for the delay.
The Privacy Protection Authority Reference number: IMY-2023-16160 3(5)
Date: [Date]
Reasons for the decision
Applicable provisions
Pursuant to Article 15(1) of the GDPR, the data subject has the right to obtain from the
controller confirmation as to whether or not personal data concerning him or her are
being processed and, where that is the case, access to the data and the supplementary
information listed in that Article.
Pursuant to Article 17(1) of the GDPR, the data subject shall have the right to obtain
from the controller the erasure of personal data concerning him or her without undue
delay and the controller shall have the obligation to erase personal data without undue
delay where one of the conditions listed in that Article applies, for example where the
data are no longer necessary for the purposes for which they were collected or where
consent for processing is withdrawn.
Pursuant to Article 17(3)(b) of the GDPR, the obligation to erase personal data under
Article 17(1) does not apply where the processing is necessary for compliance with a
legal obligation requiring processing under Union or Member State law to which the
controller is subject.
Under Article 12(3) of the GDPR, the controller is to provide the data subject, upon
request, without undue delay and in any event no later than one month after receiving
the request, with information on the measures taken pursuant to Articles 15 to 22 of the
GDPR. This period may be extended in certain circumstances. In such cases, the
controller shall inform the data subject of the extension and the reasons for the
extension within one month of receipt of the request.
Under Article 82(1) of the GDPR, any person who has suffered material or non-material
damage as a result of an infringement of the GDPR is entitled to receive compensation
from the controller for the damage suffered.
Under Article 79(2) of the GDPR, proceedings against a controller are to be brought
before the courts of the Member State in which the controller has an establishment.
Alternatively, such proceedings may be brought before the court of the Member State in
which the data subject has his or her habitual residence.
Banks are subject to the rules in the Swedish Money Laundering and Terrorist
Financing (Prevention) Act (SFS 2017:630), the Swedish anti money laundering, AML,
act. Chapter 3, Section 1 of the Swedish AML Act states that an operator may not
establish or maintain a business relationship if the operator does not have sufficient
knowledge of customers to be able to manage the risk of money laundering or terrorist
financing that may be associated with the customer relationship and to monitor and
assess the customer’s activities and transactions. Chapter 3, Section 4 of the Swedish
AML Act states that the operator must take customer due diligence measures when
establishing a business relationship. Chapter 5, Section 2 of the Swedish AML Act
states that an operator must keep documents and information relating to measures
taken for customer due diligence in accordance with Chapter 3 for five years.
The Privacy Protection Authority’s assessment
On the basis of the complaints in the case, IMY has examined the company's conduct
in the individual case. The review covered the complainant’s requests for access under
Article 15 GDPR, the complainant’s requests for erasure under Article 17 GDPR and
The Privacy Protection Authority Reference number: IMY-2023-16160 4(5)
Date: [Date]
whether the requests were dealt with within the time limit provided for in Article 12(3)
GDPR.
With regard to the complainant’s request for an apology and compensation of EUR 2
500, IMY notes that it is not within the competence of the authority to decide on
compensation to data subjects. The complainant can claim damages by contacting the
data controller or by bringing an action for damages in court.
TF Bank AB has informed IMY that it has now granted access to the appellant’s data.
TF Bank AB also informed IMY that it has now irrevocably anonymised the appellant’s
data. IMY finds no reason to question that this has happened. IMY notes that TF Bank
AB has thus now complied with the complainant’s right of access and the complainant’s
right to erasure. IMY then has to take a position on whether the complainant's request
for access or erasure has been handled in a timely manner, and whether TF bank AB
has provided information on the measures taken, in response to the request for
erasure, in a timely manner.
Has the company dealt with the complainant’s request for access in a timely
manner pursuant to Article 12(3) of the GDPR?
Pursuant to Article 12(3) of the GDPR, a controller shall handle a request for access
pursuant to Article 15 of the GDPR without undue delay and at the latest within one
month of receipt of the request. The complainant states that he requested access to his
data on 2 September 2019 and that the bank complied with the complainant’s request
for access on 8 December 2023, following the commencement of supervision by IMY.
The request for access was therefore handled four years and three months after the
complainant made the request.
IMY therefore finds that TF Bank AB has processed the complainant’s personal data in
breach of Article 12(3) of the GDPR by failing to comply with the applicant’s request for
access under Article 15 of the GDPR without undue delay, or at least within one month.
Has the company dealt with the complainant’s request for erasure in a timely
manner?
TF Bank AB states that, even if they had dealt with the complainant’s request for
erasure when they received it, they would not have been able to erase the data in the
light of internal procedures. The purpose of the procedures was to prevent fraud, to
meet the need to save customer data in order to improve credit approval processes and
to meet the requirements of anti-money laundering legislation.
Chapter 5, Section 2 of the Swedish AML Act states that an operator must keep
documents and information relating to customer due diligence measures taken pursuant
to Chapter 3 of the same Act for five years. As a bank, TF Bank AB is subject to the
rules of the Swedish AML Act. TF Bank AB can therefore, on the basis of the Swedish
AML Act, process the complainant’s personal data for five years after customer due
diligence measures have been taken. TF Bank AB complied with the complainant’s
request for erasure after four years and three months. IMY therefore finds that TF Bank
AB did not process the complainant’s personal data in breach of Article 17 by not
deleting the data when the complainant requested it.
Has the company provided the complainant with information in response to the
request for erasure in a timely manner pursuant to Article 12(3) of the GDPR?
Pursuant to Article 12(3) of the GDPR, a controller must provide the data subject with
information on the action taken in response to a request for erasure pursuant to Article
The Privacy Protection Authority Reference number: IMY-2023-16160 5(5)
Date: [Date]
17 of the GDPR without undue delay and at the latest within one month of receipt of the
request.
The complainant states that he requested the erasure of his data on 2 September 2019
and that the bank complied with the complainant’s request for erasure on 8 December
2023, following the commencement of supervision by IMY. At the same time,
information has been provided in response to the request. Information on the actions
taken on the request has thus been provided four years and three months after the
complainant made the request.
IMY therefore finds that TF Bank AB has processed the complainant’s personal data in
breach of Article 12(3) of the GDPR by failing to inform the complainant without undue
delay, or at the latest within one month, of the actions taken in response to the
complainants’s request for erasure under Article 17 of the GDPR.
Choice of corrective measure
It follows from Article 58(2) and Article 83(2) of the GDPR that IMY has the power to
impose administrative fines under Article 83. Depending on the circumstances of the
case, administrative fines shall be imposed in addition to or instead of the other
measures referred to in Article 58(2), such as injunctions or prohibitions. Furthermore, it
is clear from Article 83(2) which factors must be taken into account when deciding on
an administrative fine and when determining the amount of the fine. In the case of a
minor infringement, as set out in recital 148, instead of imposing a fine, IMY may issue
a reprimand pursuant to Article 58(2)(b). Account shall be taken of aggravating and
mitigating circumstances of the case, such as the nature, gravity and duration of the
infringement and relevant previous infringements.
IMY has found that TF Bank processed the complainant’s personal data in breach of
Article 12(3) of the GDPR. IMY notes the following relevant facts. The infringements
found have occurred relatively far back in time. Furthermore, the company has put in
place improved processes and revised procedures since the complainant made his
request. The Company has not previously received any corrective action for violation of
data protection regulations. The complainant’s right of access has now been granted
and information on the measures taken in response to the request for erasure has been
provided. The request for deletion has also been complied with. In those circumstances,
IMY finds that the infringements are minor. In view of the fact that the company
exceeded the time limit laid down in Article 12(3) of the GDPR by four years and two
months, IMY nevertheless considers that, in the context of an overall assessment, there
are grounds for giving TF Bank AB a reprimand under Article 58(2)(b) of the GDPR for
the infringements found.
28 June 2024 IMY gave TF Bank AB the opportunity comment on a draft decision in
accordance with the decision above. TF Bank AB has not commented on the draft
decision.
Annex
Complainant’s personal data
The Privacy Protection Authority Reference number: IMY-2023-16160 6(5)
Date: [Date]
How to appeal
If you wish to appeal the decision, you should write to the Swedish Authority for Privacy
Protection (IMY). Indicate in the letter which decision you wish to appeal and the
change you are requesting. The appeal must have been received by IMY no later than
three weeks from the day you received the decision. If the appeal has been received in
time, IMY will then forward it to the Administrative Court in Stockholm for review.
You can e-mail the appeal to IMY if it does not contain any privacy-sensitive personal
data or information that may be covered by confidentiality. IMY’s contact information is
shown in the first page of the decision.