# S-Pankki Oyj: Insufficient technical and organisational measures to ensure information security

- Type: Enforcement
- Source: Deputy Data Protection Ombudsman
- Date: 2025-09-08
- Original: https://www.enforcementtracker.com/ETid-2873
- Canonical: https://overview.legal/posts/48988
- Topics: Security, Controllers, Processing Agreement, Insurance, Supervisory Authorities, Data Controller

## Summary

The Finish DPA has imposed a fine of EUR 1,800,000 on S-Pankki Oyj. Due to a software error, customers of the controller were able to log in to the bank accounts of other customers, resulting in financial losses.

## Full text

The Finish DPA has imposed a fine of EUR 1,800,000 on S-Pankki Oyj. Due to a software error, customers of the controller were able to log in to the bank accounts of other customers, resulting in financial losses.

GDPR Articles: Art. 5 (1) f) GDPR, Art. 25 (1) GDPR, Art. 32 (1), (2) GDPR
Industry: Finance, Insurance and Consulting

---
Generated by overview.legal · https://overview.legal/posts/48988 · 2026-08-22