BRAbank ASA: Insufficient technical and organisational measures to ensure information security

The Norwegian DPA (Datatilsynet) has imposed a fine of EUR 39,700 on BRAbank ASA. The controller had reported a data breach to the DPA on September 6, 2019. On the controller's website, some customers were able to view other customers' data on the 'My Page' section. These included credit terms and address information of other customers. The section had been activated shortly before for 500 selected customers and was intended, among other things, to provide an overview of loans taken out with the controller. Based on investigations into the case, the DPA found that the controller had not complied with the GDPR's requirements for risk assessment and appropriate technical measures in connection with the launch of the customer portal. According to the DPA's assessment, the personal data security breach could have been prevented if the controller had conducted a risk assessment and review as required by law.

GDPR Articles: Art. 24 GDPR, Art. 32 (1), (2) GDPR
Industry: Finance, Insurance and Consulting