Deputy Data Protection Ombudsman · 8 September 2025
S-Pankki Oyj
Insufficient technical and organisational measures to ensure information security
Fine€1,800,000Fine issued
- Regulator
- Deputy Data Protection Ombudsman
- Decided
- 8 September 2025
- Country
- Finland
- Sector
- Finance, Insurance and Consulting
- Regulator’s reference
- Not recorded
- Fino case number
- 2025/FI/002
What happened
The DPA fined a bank €1,800,000 for failing to implement sufficient technical and organisational measures regarding a new login feature on their app, which led to unauthorised access to customers' accounts by third parties.
Summary from the GDPRhub page for this decision, written by its volunteers, not by Fino. CC BY-NC-SA 4.0.
Rules involved
- Art. 5Principles relating to processing of personal data5(1)(f)Read →
- Art. 25Data protection by design and by default25(1)Read →
- Accountability
- Data principles
- Data security
Sources
The facts on this page come from the sources above, as they recorded them. Nothing has been estimated or filled in. Not legal advice.
Spotted a mistake? Write to angelillolorenzo@gmail.com and quote 2025/FI/002.