Ruling of the FDPIC against Cembra Money Bank AG
In its ruling of 29 January 2025, the FDPIC concluded its investigation against Cembra Money Bank AG (Cembra). In the proceedings, the FDPIC assessed the statutory time limits for processing requests for information and the information to be provided on the personal data processed. The company was requested to provide all persons who had previously received only a standardised response to their requests for information with the processed personal data as such.
After receiving a complaint, the FDPIC contacted Cembra with a view to a low-threshold intervention. The company was reminded of the legal deadline for responding to requests for information within 30 days. Cembra replied that due to staff shortages, responses to requests for information were delayed, but that no adjustments to the information process were necessary. A few months after this response, the FDPIC received another complaint that Cembra was not responding to requests for information despite repeated attempts.
During the investigation, the FDPIC found that between December 2023 and September 2024, Cembra had responded to nine out of 13 requests for information after the statutory deadline of 30 days had expired. In addition, all 13 requests for information were answered with a standardised text during the period in question.
In the course of the proceedings, Cembra subsequently complied with its obligation to provide information to the complainants, but not to the other applicants.
Both the ruling on the merits and the publication ruling remained uncontested, meaning that they became final after the 30-day appeal period expired.