Swedish bank slammed with GDPR complaint for ignoring information request

Austrian privacy advocacy group Noyb has filed a complaint against Swedbank for rejecting a customer’s information request regarding the calculation of his personal mortgage interest rate.

Nowadays, more and more banks tend to set their interest rate fully automated, without any human intervention. This makes it practically impossible for consumers to learn how their interest rate come to be.

A Swedish consumer wasn’t going to let this slide. He wanted to know how Swedbank, one of the largest banks in Sweden, established the personal interest rate of his mortgage lending. Instead of providing the customer with detailed information, the bank rejected his information request by arguing that the composition and realization of mortgage rates are considered as a trade secret.

However, article 15.1 (h) of the General Data Protection Regulation (GDPR) states that when decision-making is subjected to an automated process, people are still entitled to ‘meaningful information about the logic involved’, and the envisaged consequences of such processing.

In other words, banks can’t ignore an information request regarding mortgage interest rates by calling it a trade secret. Especially when even a small change in the interest rate can have serious consequences for consumers.

“By insisting that the logic behind its interest rate calculation is a trade secret, the bank erodes what little trust consumers still have in them. It begs the question: how can we as consumers know we’re being treated fairly if we actually don’t know how we are treated?,” data protection lawyer at Noyb Joakim Söderberg wonders in a statement.

Moreover, Noyb argues that a piece of information can only be considered as a trade secret if it discloses something competitors don’t already know. In this case, information on mortgage interest rates composition is publicly available because of Swedish and European laws. Therefore, Swedbank can’t call it a trade secret.

Because Swedbank won’t comply with the plaintiff’s information request, Noyb has filed a complaint with the Swedish data protection authority (DPA). The Austrian privacy organization demands that Swedbank gives full access to the logic used for the calculation of his mortgage interest rate.

In addition, Swedbank should implement procedures to adequately respond to information requests in the future. Lastly, Noyb is asking the Swedish DPA to impose an administrative fine to prevent similar violations in the future.