Is a bank account history of transactions considered personal data in the sense of GDPR?

Question

For archival purposes, I'm trying to get the full history of transactions on my bank account since I opened it in 2019. I know my bank still has it since it's visible in the mobile app (I can scroll down to the very first transaction). However, there's no way to export it in a processable manner (the online export form only gives one month of transactions, and there's a paid service that can get up to two years).

I sent an e-mail to my bank asking for a dump of all the personal data their systems contain about me (as per GDPR article 15), and they provided me with... my name, address, phone number and SSN. In their (the DPO's) response, they wrote that any request about the transaction history is to be made to my bank advisor – this is not what I want, since they then point me to the paid service that only gives 2 years of operations.

In any case, I understand that transactions on my account fit the definition of personal data since they're directly attached to my bank account, which is under my name, and that since the transactions are stored on their systems I should be able to get them in a processable format as per article 15.

Am I wrong in that understanding?

Answer 1

Yes, it is personal data

That means they must provide you with access to it, and they have - through the app. They don’t have to provide it to you in any particular way or in a format you request.

Answer 2

Yes, your transaction history is your personal data. Personal data is any information relating to an identifiable person. Your transaction history relates to you, and you're definitely identifiable for the bank.

You have access to the transaction history to the app, which would probably satisfy Art 15 GDPR.

You do also have a right to data portability under Art 20 GDPR which allows you to get your data in a machine-readable format – but strictly speaking this right only applies to data you provided yourself. You could try to explicitly invoke this right. Your GDPR rights must be satisfied without cost.

Your bank almost certainly does provide machine-readable API access, in conformance with the open banking mandate from the Revised Payment Services Directive (PSD2, Directive (EU) 2015/2366). The Directive requires your EU member state to have passed a law that gives you “the right to make use of services enabling access to account information”, if you're already using online banking. However, the exact details of that right will depend on the laws in your EU member state. You might already be able to connect to your transaction history via Open Banking software such as GNU Cash.