EDÖB/PFPDT/IFPDT (Switzerland) - Cembra Money Bank AG

From GDPRhub
FDIPC - Cembra Money Bank AG
Authority: EDÖB/PFPDT/IFPDT (Switzerland)
Jurisdiction: Switzerland
Relevant Law:
Art. 25 FADP
Type: Investigation
Outcome: Violation Found
Started: 16.04.2024
Decided: 29.01.2025
Published:
Fine: n/a
Parties: n/a
National Case Number/Name: Cembra Money Bank AG
European Case Law Identifier: n/a
Appeal: Not appealed
Original Language(s): German
Original Source: FDPIC (in DE)
Initial Contributor: cci

The DPA issued a warning against a bank for providing belated and incomplete responses to data subjects' access requests.

English Summary

Facts

The complaints

The DPA received two complaints against Cembra Money Bank AG (the controller). Both data subjects complained that the controller failed to comply with their requests for information.

In particular, one of the two complainants requested information after being denied an application for a credit card. He specifically asked for the following information:

  • An explanation of the controller’s decision to deny the application:
  • A copy of the personal data, upon which the controller based its decision;
  • Information about the sources of his personal data.

The ex officio investigation

On these grounds, the DPA opened a broader investigation and found that the controller provided late response to at least 9 requests between December 2023 and August 2024. Additionally, all those responses (as well as the responses to other four requests) consisted of a standardized text, along with a link to the privacy statement on the controller’s website.

The responses in question stated that "we process all categories of data relating to an identified or identifiable natural person. This includes personal data (surname, first name, date of birth, address, contact details (telephone, email, etc.), particularly sensitive data (e.g. sexual orientation, which may result from marital status), all types of financial data (salary statements, tax assessments, etc.), credit information (...) and data that may result from profiling, e.g. when visiting our websites to improve customer satisfaction or for marketing purposes."

Holding

The DPA held that the controller violated Article 25 of the Federal Data Protection Act (FDPA) by providing generic and belated responses to data subjects’ requests. This finding related to both the two complaints and the controller's broader handling of data subjects' requests, which the controller investigated ex officio.

The DPA issued a warning and ordered the controller to properly handle requests in the future.

With regards to the complaint relating to the credit card application, the DPA clarified that the controller should have provided a more detailed and complete response, in order to enable the data subject to assess the accuracy of the personal data upon which the controller’s decision was based.

Comment

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the German original. Please refer to the German original for more details. 

Swiss Confederation Federal Data Protection and
Confederation of Swiss Federal Data Protection Officer
0 Confederation of Swiss Federal Data Protection Officer (FDPIC)
Confederation of Swiss Federal Data Protection Officer (FDP)
Data Protection
The Commissioner

POST CH AG
CH-3003 Bern FDPIC FDPIC-A-D3DA3401/2

Registered Mail (R)
Walder Wyss AG
Attorney David Vasella
Attorney Hannes Meyle
Seefeldstrasse 123
PO Box
8034 Zurich

Your Reference
Our Reference: FDPIC-A-D3DA3401/2
Officer: WIN
Bern, January 29, 2025

Order

of January 29, 2025

in the matter of

Investigation pursuant to Article 49 of the Federal Data Protection Act

against

Cembra Money Bank AG, Bändeliweg 20, 8048 Zurich,
represented by Walder Wyss AG, Attorneys David Vasella and Hannes Meyle, Seefeldstrasse 123, P.O. Box,
8034 Zurich

concerning

Legal deadlines for processing requests for information and the disclosure of processed personal data as such

Feldeggweg 1
3003 Bern
Tel. +41584637484. Fax +41584659996
www.edoeb.admin.ch

W EDÖB-A-D3DA3401/2A. Facts

1. Report 1

1. By report dated April 5, 2024, the FDPIC was informed that Cembra had not responded to a request for information sent by registered letter on March 4, 2024.

2.
By letter dated April 16, 2024, the FDPIC informed Cembra of its obligation to respond to requests for information within the statutory deadline. He requested that Cembra, on the one hand, provide information to the data subject and, on the other hand, review its practice for granting the right of information for data protection compliance and, if necessary, adapt it.

3. By letter dated May 2, 2024, Cembra confirmed to the FDPIC that the information had not been answered within the deadline in this specific case, but had since been provided. Regarding the request to review its practice for granting the right to information for data protection compliance and, if necessary, to adapt it, Cembra responded as follows:

It is true that the data subject's request for information, [...], was not answered in a timely manner. Due to a temporary staffing shortage, we have fallen behind in responding. However, the request was not received until March 5, 2024, meaning the delay is just under three weeks; no reminder was sent by the data subject. In the meantime, the vacancy has been filled and the requested information has been provided. In our opinion, the matter can therefore be considered closed.

Since the delay was due to the staffing shortage, we believe there is no need to adapt our practice for granting the right to information. We consider it to be compliant with data protection regulations. This is demonstrated not least by the fact that the vast majority of our customers are apparently satisfied with the information provided, in the absence of any feedback to the contrary."

11. Report 2

4. By report dated July 3, 2023, the FDPIC was informed by a data subject (hereinafter: Reporter 2) of the following facts:
5. On December 27, 2023, Cembra informed Reporter 2 that its application for the issuance of a TCS Member Mastercard was rejected due to legal provisions and internal guidelines. Questions regarding the reasons for rejection should be sent in writing to the following address: Cembra Money Bank AG, Customer Care / UWC, PO Box, 8048 Zurich.
6 By letter dated January 5, 2024, Reporter 2 contacted Cembra in writing and

requested a reason for the rejection of his application for a TCS Member Mastercard.
7.
Because Reporter 2 received no response, he repeated his request for information by registered letter dated January 24, 2024, requesting the following information:

A reason for the rejection of the application;

The aforementioned legal and internal guidelines;

What information Cembra Money Bank has stored about Reporter 2;

The source of the stored information.
8.
Because Reporter 2 again received no response to his request, he submitted another request for information to Cembra by registered letter dated February 16, 2024.
In its letter, Complainant 2, using the FDPIC's sample letter, requests the legally defined minimum information from Cembra, namely "the processed personal data as such."

2/99 Since Complainant 2 received no response to this letter, it submitted a request for arbitration to the arbitration authority of the Civil Court of the Canton of Basel-Stadt on March 25, 2024 (postmark) and made the following legal requests:

"The respondent is to be obliged to disclose the requested data based on Article 25 of the Data Protection Act. (Reasons for rejecting the TCS Member Mastercard, the statutory and internal guidelines, what information it stores about me, and where this information comes from)."

At the expense of the defendant and at his own expense.


10 In a letter dated April 10, 2024, Cembra made the following statement to Anzeiger 2:

"We process all categories of data relating to a specific or specific natural person. This includes personal information (last name, first name, date of birth, address, contact details (telephone, email, etc.), particularly sensitive data (e.g., sexual orientation, which may be derived from marital status), all types of financial data (pay slips, tax assessments, etc.), credit information (ZEK/IKO, Kremo, etc.), as well as data that may result from profiling, such as when visiting our websites to improve customer satisfaction or for marketing purposes."

The letter also referred to Cembra's privacy policy for further information (see www.cembra.ch/datenschutzerklärung). Information
No information was provided regarding which personal data of Complainant 2 was processed by Cembra.

11 Cembra did not appear at the conciliation hearing on May 13, 2024, which is why the Conciliation Authority of the Civil Court of the Canton of Basel-Stadt granted leave to sue on May 13, 2024.

111. Investigation by the FDPIC

12. By letter dated September 6, 2024, the FDPIC informed Cembra of the opening of an investigation pursuant to Article 49 of the Data Protection Act (DSG, SR 235.1). Based on Cembra's reply dated April 10, 2024, the FDPIC noted that Cembra's practice apparently consists of responding to requests for information with a standardized letter and gave it the opportunity to comment on the facts outlined above.

13 In an email dated September 16, 2024, Attorney David Vasella, on behalf of and on behalf of Cembra, stated that Cembra attaches great importance to compliance with applicable law,

and, of course, data protection law. It has established the necessary processes and sensitized its employees. Cembra regrets that requests for information in the aforementioned cases were not answered to the satisfaction of those affected. The responses also do not meet Cembra's own standards. According to current knowledge, the reason for this is an acute staff shortage in the area of data protection.

The staff shortage has been remedied through external support until the necessary capacities can be filled internally. However, Cembra is taking the matter as an opportunity to
review the existing processes for requests for information. It would welcome any recommendations from the FDPIC in this regard. take into account.

14 In a letter dated October 8, 2024, Cembra responded to the FDPIC's finding of fact

stating that Cembra Money Bank AG's practice of sending a standardized letter to the data subjects in connection with the processing of requests for information did not correspond to Cembra's usual practice, but was the result of an acute staff shortage. This has since been remedied with external support, so that

there is no reason to fear that further requests for information will be processed in the same way. Cembra further pointed out that the finding of a general practice is not a finding of fact based on the files, but an inadmissible generalization of established facts.

3/9 Cembra has taken the matter as an opportunity to review the processes and documentation
for guaranteeing the right to information. Cembra would be happy to consider any recommendations in the event of an adjustment.

Cembra responded to the requests for information on October 8, 2024.

15 On October 10, 2024, the FDPIC requested Cembra to provide him with the following information:

<1. According to your letter of October 8, 2024, Cembra "has responded to the requests for information subject to the investigation [...]." Please provide copies of the replies to the FDPIC.

2. Please inform us of the period during which the "acute staff shortage" mentioned in the letters of October 8 and May 2, 2024,

or in the email of September 16, 2024, existed.

3. Please inform us how exactly this "acute staff shortage" was remedied, as per section 2 above.

4. Please inform us how many requests for information during the period of "acute staff shortage"
according to the previous paragraph 2 were not answered within the statutory period of 30 days, but with a delay.

5. Please inform us how many requests for information were complied with using the standardized text (...).

16. Cembra sent the requested copies of the response letters to the FDPIC on October 25, 2024. Regarding the staff shortage, Cembra stated that this had existed in varying constellations between December 2023 and September 2024, with Cembra having already taken various remedial measures starting in April 2024. Of 13 requests for information received between December 1, 2023, and September 31, 2024, 13 were received. Of the requests for information received by August 1, 2024, four were answered within 30 days. Nine requests for information were answered after a longer period.

The 13 requests for information received from December 1, 2023, to August 31, 2024, were answered with a standardized text, as received by Anzeiger 2 on April 10, 2024.

To Cembra's knowledge, of the 13 recipients, only the two individuals who then contacted the FDPIC responded. Cembra informed the FDPIC: "This led to Cembra not becoming aware earlier that the information process was inadequate."


``` Cembra further argues that the errors were caused by staff shortages

and not by a lack of legal knowledge or unwillingness. This is demonstrated by the fact that

before the period of staff shortages, Cembra always responded to requests for information in a timely manner and

enclosing the processed personal data as such. Before the acute staff shortage, for example, from August 1 to November 31, 2023, 20 of 23 requests for information were responded to in a timely manner and enclosing the processed personal data as such.

The average processing time was approximately 25 calendar days.

B. Considerations

1. Formalities

17. The Data Protection Act applies to the processing of personal data of natural persons by private individuals

and federal bodies (Article 2(1) Data Protection Act). Private persons are all subjects of private law

and thus all natural and legal persons. 4/918 As a legal entity and a stock corporation headquartered in Zurich, Cembra is a private individual
within the meaning of Article 2, Paragraph 1, Letter a of the Data Protection Act (FADP). According to its corporate purpose, Cembra

operates a bank. Its business activities include all types of banking transactions, in particular
the granting of all types of loans, the provision of related services, and the acceptance of funds. To fulfill this corporate purpose, it undisputedly processes the personal data of its customers, which is why the FADP applies according to Article 5, Letter a. Articles 25-29 of this Act apply to the granting of the right to information.


19. The FDPIC supervises the application of federal data protection regulations (Article 4, Paragraph 1 FADP). He opens an investigation against a federal body or a private individual, ex officio or upon notification, if there are sufficient indications that data processing could violate data protection regulations.

20. In this case, the FDPIC was informed by two notifications that Cembra had not responded to requests for information within the statutory deadline and without disclosing the personal data it processed. There were therefore sufficient indications that

Cembra's processing of requests for information could violate data protection regulations, which is why the FDPIC opened an investigation on September 6, 2024.

21. The investigation procedure and orders pursuant to Articles 50 and 51 of the Data Protection Act are governed by the Administrative Procedure Act. Only the federal body or private individual against whom an investigation was opened is a party (Article 52(1) and (2) of the Data Protection Act). The addressees of the order are the substantive norms of the DSG, i.e., either a federal body or a private individual, usually a (legally competent) company. Only they have party status (BuNDILlvlo, in: Bieri Adrian/Powell Julian (eds.), DSG Commentary, Commentary on the Swiss Data Protection Act with Further Decrees, Zurich 2023, Art. 51 Administrative Measures No. 20).

Cembra is a company with legal capacity, which is why it has party status in the present

proceedings.

According to Art. 11(1) VwVG, the party may be represented. Cembra has made use of this option by notifying its legal representative on September 16, 2024.


``` The power of attorney is dated January 16, 2025.

11. Substantive Issues

22 Pursuant to Article 32(1) of the Administrative Procedure Act (VwVG), the FDPIC shall consider all relevant and timely submissions of the parties before issuing a ruling (Article 32(1) of the Administrative Procedure Act).

1.
Compliance with the statutory deadline
23. According to Article 25(7) of the Data Protection Act (DSG), a request for information must be answered within 30 days of receipt of the request. If the information cannot be provided within 30 days,

the controller must inform the data subject and state the deadline within which the information will be provided. If the information is refused, restricted, or postponed, this must be communicated within the same deadline (Article 18(2) and (3) of the Data Protection Act).


Page 14
... 24 In a letter dated April 16, 2024, the FDPIC informed Cembra that, according to the information received regarding Report 1, a request for information had not been answered within the statutory deadline. In a letter dated May 2, 2024, the DPO confirmed that the request for information in the relevant report had not been answered within the statutory deadline and stated that the response had since been received. However, this does not change the fact that the statutory deadline had been exceeded in this case.

25
Reporter 2 submitted a total of three requests for information to Cembra. However, these requests were only answered more than three months after the first request for information was sent, or approximately three times the statutory deadline had passed. Up to this point, Reporter 2 was also not informed that the response could not be provided within the statutory deadline and within which deadline it would be provided. The response, which was more than three months late, also did not contain any information about the personal data processed by Cembra via Reporter 2, as required by Article 25 (2) (b) of the Data Protection Act. A response was not received until a letter dated October 8, 2024, approximately nine months after the request was submitted, thus significantly exceeding the statutory deadline. 26. In addition to these notifications, according to Cembra, during the period of "acute staff shortages" from December 1, 2023, to August 31, 2024, nine of the 13 requests for information received were answered after the expiry of the statutory deadline. Thus, more than three-quarters of the requests were answered too late.

27. In summary, it follows that the statutory deadline of Art. 25 (7) DSG was violated for the two above-mentioned notifications, and that this was the case for a total of nine out of 13 requests between December 1, 2023, and August 31, 2024.

2. Communication of processed personal data as such

28. According to Art. 25 (7) DSG, 1 DSG, any natural person may request information from the controller as to whether personal data concerning them is being processed. According to paragraph 2, they shall receive from the controller the information necessary to enable them to assert their rights under the DSG and to ensure transparent data processing. According to letter b of this paragraph, this includes, in particular, the personal data processed by the controller about the person requesting the information.

29. In order to assess the basis on which their bank rejected a loan application and, if necessary, to assert further rights such as the right to data rectification under Article 32 paragraph 1 DSG, natural persons as bank customers are dependent on information about the personal data processed about them. If it were to emerge that

a loan was rejected due to false or incomplete information,

this would constitute a significant infringement of the privacy of the data subject, against which they cannot defend themselves without information about the personal data processed about them. When responding to a request for information, banks must therefore examine

what business activities they have conducted with the data subject and disclose the relevant information.

2.1.
Report 1
30. Cembra initially responded to the first complainant's request for information only with a standardized text (see section 9) without disclosing any information about the personal data it processed or asserting a statutory exception to the right to information. This was confirmed by Cembra and is therefore undisputed. Only with a letter dated October 8, 2024, was the request for information fully answered, explaining the reason for rejecting the credit card application and disclosing the personal data processed as such as attachments.

31 Thus, the first response to the first complainant's request for information constituted a violation of
Article 25 (2) (b) of the Data Protection Act.

2.2. Report 2

32. Cembra also responded to Reporter 2's request for information only with a standardized text

and without providing any information about the information processed. Cembra did not assert a statutory exception to the right to information against Reporter 2 either (see

section 9). For further information, Cembra merely referred the reporter to the privacy policy,

which is available online. Cembra also only fully responded to Reporter 2's request for information in a letter dated October 8, 2024.

33
Consequently, the first response to Reporter 2's request for information was also in violation of
Article 25(2)(b) of the Data Protection Act.

2.3. Further findings

6/934. As Cembra admitted to the FDPIC, all 13 requests for information received from December 1, 2023, to August 31, 2024, were answered with a standardized text, as received by Advertiser 2 on April 10, 2024. During the course of the proceedings, Cembra subsequently fulfilled its obligation to provide information to the notifiers, but not to the remaining 11 recipients. Thus, a violation of Article 25 (2) (b) DSG continues.

3. Objections by Cembra

35. In the draft statement of facts dated September 6, 2024, which was submitted to Cembra for comment, the FDPIC stated in paragraph 13 that Cembra's practice in connection with requests for information was to send the data subjects a standardized letter, such as the one Anzeiger2 received on April 10, 2024. Cembra responded in its statement of October 8, 2024, stating that it was understandable that this impression had arisen, but that it was incorrect. The response to the relevant requests for information did not correspond to Cembra's usual practice, but was a consequence of an acute shortage of staff. Furthermore, the FDPIC's determination of a general practice was not a finding of fact, but an inadmissible generalization of established facts.

36 In a letter dated October 25, 2024, Cembra itself then stated that all of the

thirteen requests for information received between December 1, 2023, and August 31, 2024

were answered with standard letters, thus invalidating its objection of an inadmissible generalization.

37

Furthermore, Cembra claims that the delayed and incomplete response to the requests for information was due to a shortage of staff.

38. This reasoning is not convincing because Article 18 (2) of the Data Protection Ordinance provides for an extension of the deadline if information cannot be provided within 30 days. However, Cembra did not make use of this option in this case. The objection of staff shortages is therefore irrelevant.
39
The FDPIC therefore conclusively finds that the Data Protection Act was violated in that

the two reporting parties were not provided with the information on the personal data processed concerning them, as required by Article 25 (2) (b), within the 30-day period, and

no extension was requested.

40. Cembra further argues that, given the circumstances of the case, only a warning should be issued, since measures have since been taken to ensure the legally compliant processing of the information requests and the specific requests for information have now been answered.

41 If there is a violation of data protection regulations, the FDPIC can order that the processing be adjusted, interrupted, or terminated in whole or in part, and that the personal data be deleted or destroyed in whole or in part (Article 51 (1) FADP). He can, in particular, order that the data subject be provided with the information required by Article 25 (Article 51 (3) (g)). If the federal body or private individual has taken the necessary measures to restore compliance with data protection regulations during the investigation, the FDPIC can limit himself to issuing a warning (Art. 51 (5) DSG).

42. As stated above, multiple violations of the Data Protection Act have occurred. However, the processing of personal data was already adjusted during the investigation.

Likewise, during this investigation, the information pursuant to Art. 25 DSG was only provided to Complainants 1 and 2. The personal data being processed has not yet been communicated to the remaining 11 affected parties and must be provided later.

7/943. Cembra is required to apply Art. 25 DSG in a legally compliant manner in the future. In the event of further complaints, the FDPIC reserves the right to conduct follow-up checks and expressly refers Cembra to the penal provisions of Art. 63 DSG:

Private individuals who intentionally fail to comply with an order of the Federal Data Protection Officer (FDPIC) or a decision of the appeal courts issued with reference to the penalty provided for in this article will be punished with a fine of up to CHF 250,000.

c. Fees

44. Pursuant to Article 59(1)(d) DSG, the FDPIC charges private individuals fees for measures under Article 51 DSG. The amount of the fees is determined according to the provisions of Article 44 DSO, which provides for an hourly rate.

In this case, a warning has been issued to Cembra, which constitutes an administrative measure subject to a fee under Article 51 DSG.

45 The time spent in this case amounts to a total of 33 hours plus expenses of CHF
16.90. The resulting total fee is CHF 5,829.40.

46. The fee becomes due upon the finality of the order; the payment period is generally

30 days from the due date (see Art. 44 Para. 5 DSV in conjunction with Art. 12 Para. 1 Letter a and Para. 2 General Fee Ordinance).

8/9 Accordingly, it is

found:

Cembra Money Bank AG has violated the DSG several times by disregarding Art. 25 Para. 2 Letter b and Para. 7 in

the period from December 1, 2023, to August 31, 2024.

and orders:

1. Cembra Money Bank AG is requested to inform all persons who have so far received only a standard response to their request for information, based on Art. 51 Para. 3 lit. g in conjunction with Art. 25 Para. 2 lit. b DSG, which personal data about them is processed.

2.
Cembra Money Bank AG is informed of the penal provisions of Art. 63 DSG.

3. Cembra Money Bank AG is charged a total fee of CHF 5,829.40.

4. To be opened: Cembra Money Bank AG, Bändeliweg 20, 8048 Zurich, p.A. Walder Wyss AG, Attorneys at Law
David Vasella and Hannes Meyle, Seefeldstrasse 123, P.O. Box, 8034 Zurich

The Representative

Adrian Lobsiger

Information on Legal Remedies

An appeal against this order may be lodged within 30 days of receipt of the written copy (see Art. 52 para. 1 DSG in conjunction with Art. 50 of the Federal Act on Administrative Procedure, APA;
SR 172.021). This period is suspended from the seventh day before Easter until the seventh day after Easter; from

July 15 until August 15, and from December 18 until January 2 (see Art. 52 para. 1 DSG in conjunction with Art. 22a APA). The appeal must be filed with the

Post Office Box Administrative Court

9023 St. Gallen

It must contain the requests, their justification, including the evidence, and the signature of the complaining party or their representative. The contested order and the documents cited as evidence must be enclosed with the appeal, provided they are available to the complaining party (see Article 52(1) DSG in conjunction with Article 52(1) VwVG).

9/9
Retrieved from "https://gdprhub.eu/index.php?title=EDÖB/PFPDT/IFPDT_(Switzerland)_-_Cembra_Money_Bank_AG&oldid=48423"
Creative Commons Attribution-NonCommercial-ShareAlike
Powered by MediaWiki