One of the bank’s clients requested access to personal information under Art. 15 GDPR. The bank could not answer this request in due time due to the fact that the client’s insurance contract was lost. The DPA considered this to be a violation of the data subject’s rights according to Art. 15 of the GDPR, and a violation of its obligations to protect personal data under Art. 15 (1) f) GDPR and Art. 32 GDPR. Additionally, the bank also violated the Data Breach Notification Obligations under Art. 33 f. GDPR by failing to inform the data subject of the security incident.
one of the bank’s clients requested access to personal information under   the bank could not answer this request in due time due to the fact that the client’s insurance contract was lost the dpa considered this to be a  of the data subject’s rights according to  of the  and a  of its obligations to protect personal data under   f  and   additionally the bank also violated the data breach notification obligations under  f  by failing to inform the data subject of the security incident
one   bank’ clients request access  personal information     bank could  answer  request  due time due   fact   client’ insurance contract  lose  dpa consider        data subject’ right accord           obligations  protect personal data    f     additionally  bank also violate  data breach notification obligations   f   fail  inform  data subject   security incident