In 2017, a data subject requested information from a bank about their data. Specifically, he asked for the names and addresses of service providers commissioned with the processing of his data, as well as information on current account transfers.
The bank responded that it would provide regular account statements, there is a statement printer and insight into online banking is possible. For this reason, the bank sees here an unjustifiable and unjustified expense. The complainant disputes the disproportionate effort and requests that an expert from the IT and banking sector be consulted. The data subject also countered, no e-banking access and this would in any case only access to his own account data, but not on his data stored in the accounts of third parties.
The BVwG referred to Article 15 (4) of the GDPR, according to which a person responsible has to hand over to the person concerned, upon request, a copy of the personal data that is the subject of the processing. The bank was ordered by the court to duly process the application within a period of two weeks.
This issue shows that even with existing data, it is difficult to efficiently handle affected requests when multiple departments are involved and the data is stored in different systems.