On: GDPR Enforcement Tracker: List of GDPR fines

[londons_explore]

My guess is a user requested his data deleted, but N26 just disabled the account.

Then the user signed up again, enabling the same account.

The user then saw their old data hadn't in fact been deleted, and complained to the regulator.

[seqastian → londons_explore]

Are banks even allowed to wipe your whole account record? They probably have to keep most of it for tax collectors.

[pluma → seqastian]

If they only kept the data that was necessary for legal compliance with tax regulations, they wouldn't have been fined. That's explicitly allowed. That they were fined suggests they just kept everything, far beyond what they had to keep.