The new DPC website is currently under construction. Our latest guidance in relation to GDPR, which comes into effect on 25th May, 2018, can be found at gdprandyou.ie and via pages on this website starting with "NEW" as per the navigation pane on the left. All other material on this site relates to the previous legislative regime under the Data Protection Acts 1988-2003 ("the Acts"). While the Acts may continue to apply in some circumstances, as of 25th May, 2018 the GDPR is the primary piece of legislation governing data protection.

Data Protection Commission

Case Study 7  - Complaint against AIB - excessive information sought regarding Savings Account

I received a complaint against AIB Bank that unnecessary personal data relating to employment and salary were asked for by the Bank on opening a Savings Deposit Account. 

My Office took this up with the Bank, acknowledging that the Bank has responsibilities under the Criminal Justice/Money Laundering Act to collect a certain amount of data when an individual is opening a bank account e.g. name, address, previous address, date of birth, gender.  However, the Bank was advised that personal data relating to the individual's employment and salary would be considered by this Office to be excessive data when opening this type of an account, having regard to section 2(1)(c) of the Data Protection Acts which provide that data 'shall be adequate, relevant and not excessive' in relation to the purpose for which it is kept.    

The Bank stated that its purpose in collecting the information was to 'allow us to shape our  relationship with the customer into the future. It also gives us the opportunity to inform customers on the automated/electronic options available to them to meet their daily banking needs, while simultaneously giving them the comfort of knowing that they can contact their relationship manager for any of their future financial needs.  By operating a customer consultant fact-find process when opening new accounts, we can better assess the customers financial needs now and in the future'.

Following further correspondence, the Bank advised this Office that they had circulated training manuals to all branches in November, 2005 highlighting the difference between mandatory information and information that would be excessive to ask for. In addition, the Bank informed this Office that a new Savings Account opening form was to be launched in February 2006.  

I was satisfied that the Bank were aware of their responsibilities under the Acts and appreciated the prompt manner in which they addressed this issue.

The guiding principle always must be that no more information than is necessary for the purpose should be collected from the data subject.