Skip to main content
ConsentMark
Free Scan

Precedent corpus / DPC (Ireland)

Bank of Ireland Group plc

DPC (Ireland) case IN-20-7-2, decided . EUR 750k.

ContextAppeal status not checked

We have not checked whether this decision was appealed. This is not a statement that no appeal exists.

No ConsentMark grade rests on this decision. It is published here because it is relevant enforcement, not because it bears on what a browser does before consent.

What the regulator decided

A series of ten personal data breaches in the Bank of Ireland 365 mobile banking application resulted in unauthorised users gaining access to other customers' accounts; Bank of Ireland failed to implement appropriate technical and organisational measures to ensure the integrity and confidentiality of personal data, breaching Article 5(1)(f) GDPR and the security-of-processing obligation in Article 32(1) GDPR.

Archived snapshot

Wayback Machine snapshot of the primary source. Use this when the regulator URL might be refactored or expire.

https://web.archive.org/web/20260428141316/https://www.dataprotection.ie/sites/default/files/uploads/2023-03/Final%20Decision%20IN-20-7-2%20Bank%20of%20Ireland%20%28BOI%29%20365.pdf

ConsentMark interpretation

Operator-readable note on how this case shapes the ConsentMark scanner narrative. Not a legal opinion; cites the primary source.

EUR 750k administrative fine plus reprimand and compliance order. Cite when the scanner narrative covers an authenticated-app authorisation bug that surfaces another customer's data in-session - the DPC frames this as Article 32(1) security, not Article 25 design.

Verification trail

Checked against the primary source on 27th May 2026. Next review 27th November 2026.

Cite this case
BibTeX
@misc{consentmark-precedent-dpc-in-20-7-2,
  author       = {{ConsentMark}},
  year         = {2023},
  title        = {DPC (Ireland) IN-20-7-2 - Bank of Ireland Group plc},
  howpublished = {\url{https://www.consentmark.com/precedent/dpc-in-20-7-2}},
  note         = {ConsentMark methodology v7.8.1}
}
APA
ConsentMark. (2023, February 27). DPC (Ireland) IN-20-7-2 - Bank of Ireland Group plc. Methodology v7.8.1. https://www.consentmark.com/precedent/dpc-in-20-7-2
Markdown
[DPC (Ireland) IN-20-7-2 - Bank of Ireland Group plc - ConsentMark](https://www.consentmark.com/precedent/dpc-in-20-7-2)
Plain text
DPC (Ireland) IN-20-7-2 - Bank of Ireland Group plc - ConsentMark, 2023-02-27, methodology v7.8.1, https://www.consentmark.com/precedent/dpc-in-20-7-2