{"id":236,"date":"2026-06-22T20:27:53","date_gmt":"2026-06-22T18:27:53","guid":{"rendered":"https:\/\/anvaconsulting.eu\/gdpr-incident-krivo-poslan-e-mail-s-bankovnim-izvjestajem-nepravomocna-presuda-kojom-se-dosudena-naknada-stete-zbog-povrede-gdpr-a\/"},"modified":"2026-07-20T14:19:59","modified_gmt":"2026-07-20T12:19:59","slug":"gdpr-incident-mis-sent-email-with-a-bank-report-non-final-judgment-awarding-damages-for-a-gdpr-breach","status":"publish","type":"post","link":"https:\/\/anvaconsulting.eu\/en\/gdpr-incident-mis-sent-email-with-a-bank-report-non-final-judgment-awarding-damages-for-a-gdpr-breach\/","title":{"rendered":"GDPR incident \u2013 mis-sent email with a bank report (non-final judgment awarding damages for a GDPR breach)"},"content":{"rendered":"

https:\/\/odluke.sudovi.hr\/Document\/View?id=9ebdf64c-a6d7-4793-8287-9827e3d499a9&q=Op%25c4%2587a+uredba+o+za%25c5%25a1titi+podataka<\/p>\n

The Municipal Civil Court in Zagreb (Pn-1378\/2023-18, 5 December 2025) awarded \u20ac3,500 in non-material damages to a client in a non-final judgment after a bank mistakenly sent a monthly custodial report to a third party (breach of privacy\/banking secrecy). The court placed particular emphasis on the uncertainty around \u201cwhat exactly was sent and to whom\u201d.<\/p>\n

Tips & Tricks \u2013 what to watch out for, even if you\u2019re not a bank<\/h2>\n

1. Prove the scope of the incident (don\u2019t \u201cassume\u201d).<\/h2>\n

Preserve and extract logs, recipient lists, and the exact content of the sent message\/attachments. In disputes, the key question is whether you can prove what was disclosed and to whom.<\/p>\n

2. \u201cI deleted the email\u201d is not a magic solution.<\/h2>\n

Courts may take the position that this does not guarantee the content was not further shared. Where possible, use solutions with revocable access (expiring links, secure portals).<\/p>\n

3. Do not send sensitive reports as standard email attachments.<\/h2>\n

For financial or identification data, use secure portals\/inboxes, encryption, and controlled access (DLP rules, blocking external sending, recipient verification).<\/p>\n

4. \u201cPassword = personal ID number\u201d is weak protection.<\/h2>\n

A personal ID number is often not confidential. Use one-time passwords (OTP), MFA, or access through authenticated user accounts.<\/p>\n

5. Reduce client uncertainty \u2013 it reduces liability risk.<\/h2>\n

In notifications, clearly state: what categories of data were affected, the number of recipients, what measures were taken, and what the client can do immediately.<\/p>\n

6. Incident response = remediation + evidence package.<\/h2>\n

In addition to technical fixes, prepare a clear timeline, root cause analysis, measures taken, risk assessment, and decisions regarding notifications (internal and to regulators\/data subjects where required).<\/p>\n","protected":false},"excerpt":{"rendered":"

https:\/\/odluke.sudovi.hr\/Document\/View?id=9ebdf64c-a6d7-4793-8287-9827e3d499a9&q=Op%25c4%2587a+uredba+o+za%25c5%25a1titi+podataka The Municipal Civil Court in Zagreb (Pn-1378\/2023-18, 5 December 2025) awarded \u20ac3,500 in non-material damages to a client in a non-final judgment after a bank mistakenly sent a monthly custodial report to a third party (breach of privacy\/banking secrecy). The court placed particular emphasis on the uncertainty around \u201cwhat exactly was sent and to […]<\/p>\n","protected":false},"author":1,"featured_media":234,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[20],"tags":[],"class_list":["post-236","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-tips-tricks"],"acf":[],"_links":{"self":[{"href":"https:\/\/anvaconsulting.eu\/en\/wp-json\/wp\/v2\/posts\/236","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/anvaconsulting.eu\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/anvaconsulting.eu\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/anvaconsulting.eu\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/anvaconsulting.eu\/en\/wp-json\/wp\/v2\/comments?post=236"}],"version-history":[{"count":2,"href":"https:\/\/anvaconsulting.eu\/en\/wp-json\/wp\/v2\/posts\/236\/revisions"}],"predecessor-version":[{"id":239,"href":"https:\/\/anvaconsulting.eu\/en\/wp-json\/wp\/v2\/posts\/236\/revisions\/239"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/anvaconsulting.eu\/en\/wp-json\/wp\/v2\/media\/234"}],"wp:attachment":[{"href":"https:\/\/anvaconsulting.eu\/en\/wp-json\/wp\/v2\/media?parent=236"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/anvaconsulting.eu\/en\/wp-json\/wp\/v2\/categories?post=236"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/anvaconsulting.eu\/en\/wp-json\/wp\/v2\/tags?post=236"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}