Enforcement · Cypriot Data Protection Commissioner EN LLM context A cited markdown file you can paste into your AI assistant (ChatGPT, Claude, a RAG or project knowledge base) to ground it in this document. Contains: this document’s text, its sections with their topics, and the full text of every law provision it applies. Everything links back to its source on overview.legal — legal information, not advice.

Hellenic Bank: Insufficient technical and organisational measures to ensure information security

€25,000 Fine
Hellenic Bank
CYPRUS
Art. 5 GDPR Art. 32 GDPR Art. 33 GDPR
Data Breaches Security Controllers Insurance Processing Agreement Supervisory Authorities Law Enforcement Data Controller
Mar 3, 2021 Source

How it connects

Related across sources

News De Deense beschermingsautoriteit (SA) heeft verklaard dat het gebruik van Google Analytics onrechtmatig is zonder aanvullende maatregelen. Datatilsynet Guidance EDPB Annual Report 2021 EDPB Guidance Guidelines 07/2020 on the concepts of controller and processor in the GDPR EDPB Guidance Guidelines 4/2019 on Article 25 Data Protection by Design and by Default Version 2.0 Adopted on 20 October 2020 EDPB Literature GDPR Implementation Series ∙ Hungary: Introduction to the GDPR Application and a Brief History of Data Protection European Data Protection Law Review Literature GDPR Implementation Series ∙ Netherlands: The GDPR Implementation Act European Data Protection Law Review

Full text

The Cypriot DPA imposed a fine of EUR 25,000 on Hellenic Bank. The bank had closed one of its branches in the city of Nicosia in 2015. When moving out of the space, a safe containing old documents of still existing customers, installed in one of the walls, had been forgotten. As the building was vacant in the following years, the controller only learned about this incident when the property was rented out again for the first time in 2019. The new tenant had found the safe and informed the controller. Bank staff had then retrieved the documents and reported the data breach to the Cypriot DPA. The DPA ultimately concluded that the controller had violated Art. 5 (1) e), f) GDPR, Art. 32 (1) b), c) GDPR, and Art. 33 (1) GDPR.

Industry: Finance, Insurance and Consulting

Original document at the source www.dataprotection.gov.cy

Similar Content