Germany: LfD Niedersachsen issues fine against Bank over its data processing practices for profiling purposes

On 28 July 2022, the State Commissioner for Data Protection (LfD) of Lower Saxony announced that it has issued a fine of EUR 900’000 on a banking institution, without disclosing the name of the entity. The LfD noted that the banking institution processed the personal data of its current and former customers with the purpose of profiling them for targeted advertising without obtaining their explicit consent. In particular, the entity contracted a third party and through its services analyzed the users' online behavioural data and assessed their online purchases history, frequency of account statement usage and the number of online banking transfers. Furthermore, the LfD stated that the banking institution compared its data findings with the data from other credit agencies to identify the customers that use predominantly digital media and electronic communication channels to focus their digital advertising on them. Finally, the LfD stressed that the banking institution's data processing practices cannot be justified under Article 6 of the General Data Protection, which allows for data processing if there is a“legitimate interest”. The LfD will continue its investigation and issue a final ruling.