BOI Data Breach


You are discussing administrative fines (which go to the DPC) and damages (which go to the data subject) in the same post. This might confuse people unfamiliar with this fairly dense topic. I also think your damages figures are high if you look to the U.K. where they’ve had non-material damages for years.
 

I'm confused.

Is this the same or a different data breach?
 
The same person yes. The bank denied that they had disclosed anything, however it was very clear that I had access to his accounts and when I got in touch with him, he was able to tell me how much I had in my accounts.
 
However, It is still not enough to cover the loan that they provided and they disclosed.

There is nothing in law to suggest it should cover this. Where did you get that from?

Just to emphasise DeeKie's point, GDRP fines should not be confused with any compensation that may or may not be awarded in such breeches. The majority of breeches result in little or no compensation to the victims. You can review details of past GDPR fines on tracker sites such as . Here you'll see a broad range of fines, but many might be surprise you in how small some of them are. For example the German Knuddells chat site only being fined €20k for exposing the details of 330k users. That's 6c per user.
 

I'm confused about this? Is the OP expected his loan to be covered by compensation? If so, why exactly? It's obviously very annoying that this happened and there should be some recourse but the idea that there should be material compensation for what appears to be a case of mistaken identity and a systems failure affecting two individuals with the same name and similar addresses is just silly.

OP, if I were you I'd press for as much compensation as reasonably possible, conscious of the fact that it is likely to be modest, and that it has no relationship with your loan. The suggestion of six figures compensation by another poster is off the wall stuff and should not be anchoring your expectations.
 
Really useful site. Thanks.