In a decision published in June 2024, Sweden’s data protection authority, Integritetsskyddsmyndigheten (IMY), fined Avanza Bank SEK15 million (EUR 1.3 m) for its alleged use of a tracking pixel to send excessive personal data (information about, for example, customers’ securities holdings and account numbers) to the social media company Meta. The IMY said the bank did not take appropriate security measures under the EU General Data Protection Regulation (GDPR) to prevent the transfer of personal data.
The General Data Protection Regulation (GDPR) includes an obligation to report certain personal data breaches to the data protection authorities. The Swedish authority has received such a notification from Avanza that personal data has been transferred to Meta over a long period of time due to incorrect settings.
Avanza’s notification stated that personal data of up to one million from 15 November 2019 up to and including 2 June 2021 had been incorrectly transferred to Meta.
IMY’s review of the incident shows that Avanza has used Meta’s analysis tool Facebook pixel (now Meta pixel) both on its website and in its app in order to optimise the bank’s marketing on Facebook. The erroneous transfer of personal data was caused by the bank’s erroneous authorisation of new Meta-Pixel features.
The pixel has caused excessive financial data related to the bank’s customers to be transferred to Meta, such as data on securities holdings and value, loan amounts, account numbers and social security numbers.
“The bank has violated the General Data Protection Regulation (GDPR) by not having taken appropriate technical and organisational measures to ensure an adequate level of security for the personal data of website visitors and app users,” says Catharina Fernquist, Head of Unit at IMY.
As a result of the deficiencies, IMY issued an administrative fine of SEK 15 million against Avanza Bank AB.
When Avanza became aware of the incident, the bank deactivated the pixel. The bank states that Meta has confirmed that the personal data collected via the pixel has been deleted at Meta.