The Court of Appeal of Brussels has made an interesting ruling. A customer complained that their bank was spelling the customer's name incorrectly. The bank didn't have support for diacritical marks. Things like á, è, ô, ü, ç etc. Those accents are common in many languages. So it was a little surprising that the bank didn't support them.

The bank refused to spell their customer's name correctly, so the customer raised a GDPR complaint under Article 16.

The data subject shall have the right to obtain from the controller without undue delay the rectification of inaccurate personal data concerning him or her.

Cue much legal back and forth. The bank argued that they simply couldn't support diacritics due to their technology stack. Here's their argument (in Dutch - my translation follows)

Bank X also explained that the current customer data management application was launched in 1995 and is still running on a US manufactured mainframe system. This system only supported EBCDIC ("extended binary-coded decimal interchange code"). This is an 8-bit standard for storing letters and punctuation marks, developed in 1963-1964 by IBM for their mainframes and AS/400 computers. The code comes from of the use of punch cards and only contains the following characters…

(Emphasis added.)

EBCDIC is an ancient (and much hated) "standard" which should have been fired into the sun a long time ago. It baffles me that it was still being used in 1995 - let alone today.

Look, I'm not a lawyer (sorry mum!) so I've no idea whether this sort of ruling has any impact outside of this specific case. But, a decade after the seminal Falsehoods Programmers Believe About Names essay - we shouldn't tolerate these sorts of flaws.

Unicode - encoded as UTF-8 - just works. Yes, I'm sure there are some edge-cases. But if you can't properly store human names in their native language, you're opening yourself up to a lawsuit.

Source

GDPRhub - 2019/AR/1006

Dance

Reactions

Marie ʕʘᴥʘʔ Julien

@mariejulien

Très intéressant !

Terence Eden is on Mastodon

@edent

This is interesting.
A bank claimed it couldn't use diacritics in a customer's name due to technical limitations.
Customer sued… and won!
Your name is personal data, and GDPR says it should be recorded accurately.

---

---

Grumpy Nat 🇨🇭🇧🇷🇲🇫

@Nat_Keely

Hâte de mettre en justice tous les sites et autres compagnies qui ont décidé que le fait que j'ai un accent dans mon nom de famille soit source de bug (avec évidemment un message d'erreur qui n'a rien à voir. Histoire de bien pas comprendre pourquoi ça marche pas)

Terence Eden is on Mastodon

@edent

This is interesting.
A bank claimed it couldn't use diacritics in a customer's name due to technical limitations.
Customer sued… and won!
Your name is personal data, and GDPR says it should be recorded accurately.

---

---

Lays Y. M. Farra

@LYMFHSR

La France va sortir de l'UE juste pour que leur état-civil et autres administrations puissent continuer à ruiner la vie de quelqu'un parce qu'il a un tilde dans son nom

Terence Eden is on Mastodon

@edent

This is interesting.
A bank claimed it couldn't use diacritics in a customer's name due to technical limitations.
Customer sued… and won!
Your name is personal data, and GDPR says it should be recorded accurately.

---

---

KristoferA 🌏

@KristoferA

Does this mean that Z̷̡̧̢̰͓̪͖̭͙̰̣̱̬̹̙̜̪̣̏̿̏̋͑́̒͑́̒̿̇̈̍̇̌͝͝a̵̡̧͍̘̮̤̙̹͙̦̙͙͖͓̥̟̦͔͒̇̊̊̔̓́͒́̌̈́̑͋̏̏̏̚͘͝͠͝l̶͉̯̱͇̭̭̉̉̈́̿͐̽̒̎̽͌̚͜ģ̸̧̛͙̩̹̰̤̱̖̘̻̪̻̮̫̟̙̲͍̰̻͕̗̫̿̆̃́͗̽̊̽̌̔̂͂̈͊̐̈́̈̈́̈̓̆͌̑́̕͜ǫ̶̢̹̥̮̟͍̔̑̔̽ can finally open a bank account?

Terence Eden is on Mastodon

@edent

This is interesting.
A bank claimed it couldn't use diacritics in a customer's name due to technical limitations.
Customer sued… and won!
Your name is personal data, and GDPR says it should be recorded accurately.

---

---

Bastien Nocera

@hadessuk

Next up, I’m suing La Poste for still using ISO-8859-1 when printing labels. Poor “Frédéric” I recently sent a game to…

Terence Eden is on Mastodon

@edent

This is interesting.
A bank claimed it couldn't use diacritics in a customer's name due to technical limitations.
Customer sued… and won!
Your name is personal data, and GDPR says it should be recorded accurately.

---

---

Michael Büker 🇺🇦

@emtiu

Eine Erschütterung der Macht, als würden Millionen Banken-ITler in panischer Angst aufschreien und dann verstummen.

Terence Eden is on Mastodon

@edent

This is interesting.
A bank claimed it couldn't use diacritics in a customer's name due to technical limitations.
Customer sued… and won!
Your name is personal data, and GDPR says it should be recorded accurately.

---

---

There were three titles to choose from: Mr, Mrs, and Miss. Perhaps also Dr if you were feeling fancy.

But these fucking millennials with their "Ms" and "Mx" - amirite?!!?

Anyway, I was signing up to a service recently which wanted my title. I didn't think they needed a proxy for my gender, marital status, education level, or military rank - so I picked "Prefer not to say". Simples.

And then immediately got this email from them.

Slow clap, Virgin Wines, slow clap.

Bonus Track