Data Protection Risks in Transitional Times: The Case of European Retail Banks

The banking sector has a highly developed procedural approach to risk. Faced with legal requirements to protect personal data using a risk-based approach, it may seem natural for banks to ‘translate’ existing risk management procedures to these new types of risks. We present findings of an empirical study into practices of personal data protection in European retail banks, with a focus on their conceptualisation of data protection risks. The study was mostly carried out during 2020, the first year of the COVID-19 pandemic. This offered the additional opportunity to study banks’ practices in managing data protection risks in transitional times, under conditions of accelerated digitalisation. Based on our findings, we argue that banks did not fully anticipate and mitigate risks that negatively affect data subjects’ interests. The reconciliation of the GDPR’s risk-based approach and banks’ procedural approach is likely to leave gaps in the latter’s management of data protection risks. We suggest including data subjects in risk assessment procedures as a potential remedy.