2023 Piraeus Bank — HDPA €30k GDPR decision on improper heir disclosure of joint-account data (plus separate €210k access/transfer case)
Data compromised
Retail customer / joint-account personal data categories per HDPA summaries
Technical writeup
Piraeus Bank, core operating bank under Piraeus Financial Holdings, received Hellenic DPA enforcement in 2023 including a €30,000 fine (Decision 4/2023) after unauthorised disclosure of joint-account details to an heir and related notification deficiencies, and a separate €210,000 penalty (Decision 25/2023) covering unlawful transfer to a loan-servicing third party and access‑request failures—useful for privacy‑program case law rather than criminal hacking.
Root cause
Process and lawful-basis failures in retail banking privacy operations adjudicated under GDPR