The Lower Saxony data protection authority ('LfD Niedersachsen') issued, on 8 September 2022, a press release, warning banks against profiling for advertising purposes, following its inspection of a bank testing pilot data processes. In particular, the LfD Niedersachsen stated that though it had not yet completed its inspection of said bank, its findings so far have prompted warnings regarding the implementation of such data processes to other banks in Lower Saxony.

Furthermore, the LfD Niedersachsen highlighted that the data processes concerned have been used for targeted advertising of customers via the use of payment transaction data. as well as data on the living environment of customers obtained from external service providers. In this regard, the LfD Niedersachsen noted that such processing activities would be unlawful since they cannot be justified either by legitimate interests of the controller, i.e. weighing the interests of the bank against customers/data subjects, or by the consent forms used. More specifically, the LfD Niedersachsen clarified tha,t with regard to legitimate interests as legal basis for processing, behavioural analyses based on customers' transaction data would not meet the reasonable expectations of such customers, and similarly consent forms used in this regard would be unlawful since customers cannot decide for themselves whether and which specific data processing procedures are carried out and can only generally consent to profiling for advertising purposes without being able to control the extent to which this happens.

Moreover, the Lower Saxony data protection officer ('DPO'), Barbara Thiel, stated that on-the-spot checks will be conducted to verify that banks are implementing such data processing procedures with due regard to the warning issued.

You can read the press release, only available in German, here.