Lüksemburg Veri Koruma Otoritesi (CNPD) — edpb/oss/2025/3629

CNPD
COMMISSION
NATIONALE
POUR LA
PROTECTION
DES DONNEES

Deliberation No 87_RECL68_2025 of 26 September 2025 of the National Data Protection Commission, in a plenary session, on complaint file No 11.197 lodged against the company [REDACTED] via IMI Article 61 procedure 566927

Having regard to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (hereinafter: the 'GDPR');

Having regard to the Act of 1 August 2018 on the organisation of the National Data Protection Commission and the general data protection framework (hereinafter: the 'Law of 1 August 2018');

Having regard to the Rules of Procedure of the National Data Protection Commission adopted by Decision No 07AD/2024 of 23 February 2024 (hereinafter: the 'ROP');

Having regard to the Procedure for complaints before the National Data Protection Commission adopted on 16 October 2020 (hereinafter the 'Complaint Procedure before the CNPD');

Having regard to the following:

# I. Facts and procedure

1. In the framework of the European cooperation, as provided for in Chapter VII of Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation or GDPR), the Supervisory Authority of Brandenburg submitted to the National Data Protection Commission (hereinafter: "the CNPD") a complaint (national reference of the concerned authority: 136/23/1038) via IMI in accordance with Article 61 procedure - 566927.
2. The complaint was lodged against the controller [REDACTED] (hereafter [REDACTED] or "the Controller"), who has its main establishment in Luxembourg. Under Article 56 GDPR, the CNPD is therefore competent to act as the lead supervisory authority.
3. The original IMI claim stated the following:

"The complainant submitted that he had to change his details at [REDACTED] after changing his bank account. After registering the new bank account, the complainant was asked to agree to [REDACTED] repeated viewing of the account balance and transactions over the next 90 days, if necessary. The complainant had chosen to connect the bank account in a different way. However, after entering his IBAN, he was redirected to the page where he had to agree that [REDACTED] could

CNPD
COMMISSION
NATIONALE
POUR LA
PROTECTION
DES DONNEES

repeatedly view funds and transactions in the bank account over the next 90 days as needed."

4. In essence, the complainant asks the CNPD to advise him or her whether [REDACTED] data processing complies with the principle of lawfulness, fairness and transparency and the principle of data minimization.
5. The complaint is therefore based on Articles 5(1)(a) and 6(1), as well as Article 5(1)(c) GDPR.
6. On the basis of this complaint and in accordance with Article 57(1)(f) GDPR, the CNPD requested [REDACTED] to take a position on the facts reported by the complainant and in particular, to be informed on the exact legal basis/bases [REDACTED] relies on.
7. The CNPD received the requested information within the deadlines set.

## II. In law

### 1. Applicable legal provisions

8. Article 77 GDPR provides that "without prejudice to any other administrative or judicial remedy, every data subject shall have the right to lodge a complaint with a supervisory authority, (...) if the data subject considers that the processing of personal data relating to him or her infringes this Regulation."
9. Article 5(1)(a) GDPR stipulates that personal data shall be "processed lawfully, fairly and in a transparent manner in relation to the data subject ('lawfulness, fairness and transparency')". Article 6(1) GDPR specifies the conditions for the lawfulness of processing.
10. Article 5(1)(c) GDPR stipulates that personal data shall be "adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed (data minimisation)."
11. Article 56(1) GDPR provides that "(...) the supervisory authority of the main establishment or of the single establishment of the controller or processor shall be competent to act as lead supervisory authority for the cross-border processing carried out by that controller or processor in accordance with the procedure provided in Article 60";

CNPD
COMMISSION
NATIONALE
POUR LA
PROTECTION
DES DONNEES

12. According to Article 60(1) GDPR, "The lead supervisory authority shall cooperate with the other supervisory authorities concerned in accordance with this Article in an endeavour to reach consensus. The lead supervisory authority and the supervisory authorities concerned shall exchange all relevant information with each other";

13. According to Article 60(3) GDPR, "The lead supervisory authority shall, without delay, communicate the relevant information on the matter to the other supervisory authorities concerned. It shall without delay submit a draft decision to the other supervisory authorities concerned for their opinion and take due account of their views";

# 2. In the present case

14. [REDACTED] is authorised as a Bank in Luxembourg pursuant to the Luxembourg Act of 5 April 1993 on the financial sector, as amended. It is subject to the regulatory framework applicable to banks and supervised by the competent national supervisory authority Commission de Surveillance du Secteur Financier (CSSF). [REDACTED] is also subject to the obligation of professional secrecy set out in Article 41 of the aforementioned Act and shall keep secret all information entrusted to it in the context of its professional activity. The disclosure of such information is punishable, under Article 458 of the Luxembourg Penal Code.

15. Following the intervention of the Luxembourg supervisory authority, the Controller confirmed that:

- In June 2023, the complainant updated his [REDACTED] account with new bank account details, and during this process he was presented with the option of enabling [REDACTED] to use the 'Open Banking' service to confirm his ownership of the bank account and enable [REDACTED] to manage the risk of there being insufficient funds in that account to support direct debit payments drawn from it. Open Banking, introduced through the second Payment Services Directive 'PSD2', increases security of financial network services through secure data sharing, while also aiming to enhance the customer experience.

- In this flow, users are presented with two ways of verifying their bank accounts:

CNPD
COMMISSION
NATIONALE
POUR LA
PROTECTION
DES DONNEES

- They may add their bank details and confirm ownership 'instantly' by using 'Open Banking', or
- They may choose to complete an alternative manual verification process where [REDACTED] makes a small deposit to their bank account, and in the transaction line for the deposit, provide a code which the individual is asked to enter into the [REDACTED] system, thereby proving their ownership of the bank account.

- If they choose the Open Banking option, the permission they provide expires after 90 days, or they can adjust this permission at any time within their [REDACTED] account settings.
- The lawful basis for this processing activity is Article 6(1)(b) of the GDPR; meaning that the processing is necessary for the performance of the contract with the customer to confirm the balance on the relevant account to support a proposed payment which may enable the payment to be made smoother.
- Applying the aforementioned processes to the circumstances of this complaint, the complainant was provided with both options, and he chose to manually complete this process without using Open Banking. The complainant emailed [REDACTED] on the 07 and 08 June 2023 and [REDACTED] informed him of this position in its reply dated the 9 June 2023.

### 3. Outcome of the case

16. The CNPD, in a plenary session, therefore considers that, at the end of the investigation of the present complaint, the Controller has taken appropriate measures to comply with the principle of data minimisation of the processing, as well as with the lawful basis of the processing, in accordance with Articles 5 and 6 GDPR.

17. Thus, in the light of the foregoing, and the residual nature of the gravity of the alleged facts and the degree of impact on fundamental rights and freedoms, it does not appear necessary to continue to deal with that complaint. Moreover, the CNPD is of the view that the issue has been resolved in a satisfactory manner.

CNPD
COMMISSION
NATIONALE
POUR LA
PROTECTION
DES DONNEES

18. The CNPD then consulted the supervisory authority of Brandenburg (Germany), pursuant to Article 60(1), whether it agreed to close the case. The Supervisory Authority of Brandenburg has responded that the complainant did not react anymore, so that the CNPD has therefore concluded that no further action was necessary and that the cross-border complaint could be closed.

In light of the above developments, the National Data Protection Commission, in a plenary session, after having deliberated, decides:

- To close the complaint file 11.197 upon completion of its investigation, in accordance with the Complaints Procedure before the CNPD. As per Article 60(7) GDPR, the lead supervisory authority shall adopt and notify the decision to the main establishment or single establishment of the Controller.

Belvaux, dated 26 September 2025

The National Data Protection Commission

Chair

Commissioner

### Indication of remedies

This Administrative Decision may be the subject of an appeal for amendment within three months of its notification. Such an action must be brought by the interested party before the administrative court and must be brought by a lawyer at the Court of one of the Bar Associations.

EDPBI:LU:OSS:D:2025:3629 — LU SA final decision (Article 5 (Principles relating to processing of personal data), Article 6 (Lawfulness of processing))

Karar metni