Permanent TSB p.l.c.

Introduction .......................................................................................................................................... 1 B. Preliminary Matters .............................................................................................................................. 2 a) Data Controller ...................................................................................................................................... 2 b) Factual Scope of the Inquiry ................................................................................................................. 2 C. Legal Framework for the Inquiry and the Decision ............................................................................... 4 a) Legal Basis for the Inquiry ..................................................................................................................... 4 b) Legal Basis for the Decision ................................................................................................................... 4 D. Factual Background ............................................................................................................................... 5 E. Scope of the Inquiry and the Application of the GDPR ....................................................................... 13 F. Issues for Determination..................................................................................................................... 14 G. Analysis of the Issues for Determination ............................................................................................ 14 a) Issue 1: Articles 5(1)(f) and 32(1) GDPR .............................................................................................. 14 i. Assessment of the Risks ...................................................................................................................... 16 ii. Measures Implemented by PTSB and Appropriateness of those Measures ...................................... 22 (i) Technical measures ........................................................................................................................ 23 (ii) Organisational Measures ............................................................................................................... 25 Data Protection Governance ......................................................................................................... 25 Training and Awareness ................................................................................................................. 27 Additional organisational measures .............................................................................................. 29 Security Journeys ........................................................................................................................... 29 Monitoring of Calls/Adherence to Security Procedures ................................................................ 32 b) Issue 2: Article 33 GDPR ...................................................................................................................... 35 i. The Obligation to Notify Without Delay ........................................................................................ 35 ii. The Breach Notifications ................................................................................................................ 38 H. Findings ............................................................................................................................................... 44 I. Decision on Corrective Powers ........................................................................................................... 45 J. Decision on Reprimand ....................................................................................................................... 45 K. Order to Bring Processing into Compliance ........................................................................................ 46 L. Decision on Administrative Fines ........................................................................................................ 46 a) Whether to impose an administrative fine ......................................................................................... 48 i. Article 83(2)(a) GDPR: the nature, gravity and duration of the infringement taking into account the nature scope or purpose of the processing concerned as well as the number of data subjects affected and the level of damage suffered by them ..............................................................................

the Central Bank has sought to determine how and why PTSB failed to fulfil its regulatory obligations to protect its tracker mortgage customers’ best interests and honour their contractual entitlements. The investigation has found that PTSB denied its customers a tracker mortgage or did not put them on the correct tracker rate resulting from a number of failings: 1. Failure to warn certain customers about the consequences of decisions they might make relating to their mortgage: PTSB failed to warn certain customers that they would lose their tracker mortgage entitlements as a consequence of their request to break early from a fixed or discounted interest rate. 2. Operational and systems failings: PTSB did not have adequate systems and/or operational controls in place to enable them to meet their contractual and regulatory 2 obligations to certain customers. This included over-reliance on manual intervention and a lack of clarity at that time in relation to who was responsible for mortgage products within PTSB. 3. Decision to deny certain customers their correct tracker rate between 2009 and 2010: PTSB made a decision to deny certain customers their entitlements to the correct lower tracker rate between 2009 and 2010 unless the customer specifically requested it, or queried or complained. 4. Incorrect legal interpretation of contractual terms and conditions: PTSB denied certain customers their enduring contractual right to a tracker mortgage as a result of PTSB’s incorrect interpretation of the extent of certain customers’ contractual entitlements.