EU Judgment in Case C-579/21 Pankki S on personal data

Thursday 22 June 2023

EU Judgment in Case C-579/21 Pankki S

(Approximation of Laws)

In the course of 2014, an employee and at the same time a customer of the bank Pankki S learned that his own data had been consulted by other members of the bank’s staff on several occasions between 1 November and 31 December 2013.

Having doubts about the lawfulness of those consultations, on 29 May 2018 the employee, who had in the meantime been dismissed from his job at Pankki S, asked Pankki S to disclose to him the identity of the persons who had consulted his data, the exact dates of the consultations and the purposes of the processing of that data.

In its reply, Pankki S refused to disclose the identities of the employees in question on the grounds that the information constituted those employees’ personal data.

Pankki S pointed out that a customer of the bank whose customer adviser was the applicant was a creditor of a person who also bore the applicant’s surname. The bank, therefore, wished to clarify whether the claimant and the debtor in question were one and the same person and whether there might have been any inappropriate conflict of interest relationship.

Pankki S added that the answer to this question required the data in question to be processed, specifying that each member of the bank’s staff who had processed this data had made a declaration to the internal audit department regarding the reasons for this data processing. In addition, the bank stated that these consultations made it possible to rule out any suspicion of a conflict of interest with regard to the applicant.

The applicant applied to the Finnish Data Protection Commissioner’s Office for an order requiring Pankki S to provide him with the requested information. Since that request was rejected, the applicant brought an action before the Administrative Court of Eastern Finland asking the Court of Justice to interpret the General Data Protection Regulation (GDPR) in that regard.

Background Documents C-579/21