Model: IoannisKat1/legal-bert-base-uncased-new2
Author: IoannisKat1
Pipeline: sentence-similarity
Library: sentence-transformers
Tags: sentence-transformers, safetensors, bert, sentence-similarity, feature-extraction, dense, generated_from_trainer, dataset_size:1580, loss:MatryoshkaLoss, loss:MultipleNegativesRankingLoss, en, arxiv:1908.10084, arxiv:2205.13147, arxiv:1705.00652, base_model:nlpaueb/legal-bert-base-uncased, base_model:finetune:nlpaueb/legal-bert-base-uncased, license:apache-2.0, model-index, text-embeddings-inference, endpoints_compatible, region:us
Base models (finetune): id: nlpaueb/legal-bert-base-uncased
Card metadata: language: en
license: apache-2.0
tags: sentence-transformers, sentence-similarity, feature-extraction, dense, generated_from_trainer, dataset_size:1580, loss:MatryoshkaLoss, loss:MultipleNegativesRankingLoss
base_model: nlpaueb/legal-bert-base-uncased
widget: source_sentence: What types of data processing allow for derogations from certain rights under Union or Member State law?
sentences: 1.Where personal data relating to a data subject are collected from the data subject, the controller shall, at the time when personal data are obtained, provide the data subject with all of the following information: (a)  the identity and the contact details of the controller and, where applicable, of the controller's representative; (b)  the contact details of the data protection officer, where applicable; (c)  the purposes of the processing for which the personal data are intended as well as the legal basis for the processing; 4.5.2016 L 119/40   (d)  where the processing is based on point (f) of Article 6(1), the legitimate interests pursued by the controller or by a third party; (e)  the recipients or categories of recipients of the personal data, if any; (f)  where applicable, the fact that the controller intends to transfer personal data to a third country or international organisation and the existence or absence of an adequacy decision by the Commission, or in the case of transfers referred to in Article 46 or 47, or the second subparagraph of Article 49(1), reference to the appropriate or suitable safeguards and the means by which to obtain a copy of them or where they have been made available.
2.In addition to the information referred to in paragraph 1, the controller shall, at the time when personal data are obtained, provide the data subject with the following further information necessary to ensure fair and transparent processing: (a)  the period for which the personal data will be stored, or if that is not possible, the criteria used to determine that period; (b)  the existence of the right to request from the controller access to and rectification or erasure of personal data or restriction of processing concerning the data subject or to object to processing as well as the right to data portability; (c)  where the processing is based on point (a) of Article 6(1) or point (a) of Article 9(2), the existence of the right to withdraw consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal; (d)  the right to lodge a complaint with a supervisory authority; (e)  whether the provision of personal data is a statutory or contractual requirement, or a requirement necessary to enter into a contract, as well as whether the data subject is obliged to provide the personal data and of the possible consequences of failure to provide such data; (f)  the existence of automated decision-making, including profiling, referred to in Article 22(1) and (4) and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject.
3.Where the controller intends to further process the personal data for a purpose other than that for which the personal data were collected, the controller shall provide the data subject prior to that further processing with information on that other purpose and with any relevant further information as referred to in paragraph 2
4.Paragraphs 1, 2 and 3 shall not apply where and insofar as the data subject already has the information., The processing of personal data should also be regarded to be lawful where it is necessary to protect an interest which is essential for the life of the data subject or that of another natural person. Processing of personal data 4.5.2016 L 119/8 Official Journal of the European Union EN, 1.Processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes, shall be subject to appropriate safeguards, in accordance with this Regulation, for the rights and freedoms of the data subject. Those safeguards shall ensure that technical and organisational measures are in place in particular in 4.5.2016 L 119/84   order to ensure respect for the principle of data minimisation. Those measures may include pseudonymisation provided that those purposes can be fulfilled in that manner. Where those purposes can be fulfilled by further processing which does not permit or no longer permits the identification of data subjects, those purposes shall be fulfilled in that manner.
2.Where personal data are processed for scientific or historical research purposes or statistical purposes, Union or Member State law may provide for derogations from the rights referred to in Articles 15, 16, 18 and 21 subject to the conditions and safeguards referred to in paragraph 1 of this Article in so far as such rights are likely to render impossible or seriously impair the achievement of the specific purposes, and such derogations are necessary for the fulfilment of those purposes.
3.Where personal data are processed for archiving purposes in the public interest, Union or Member State law may provide for derogations from the rights referred to in Articles 15, 16, 18, 19, 20 and 21 subject to the conditions and safeguards referred to in paragraph 1 of this Article in so far as such rights are likely to render impossible or seriously impair the achievement of the specific purposes, and such derogations are necessary for the fulfilment of those purposes.
4.Where processing referred to in paragraphs 2 and 3 serves at the same time another purpose, the derogations shall apply only to processing for the purposes referred to in those paragraphs., source_sentence: What is the specific date mentioned in the text?
sentences: 1.Processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes, shall be subject to appropriate safeguards, in accordance with this Regulation, for the rights and freedoms of the data subject. Those safeguards shall ensure that technical and organisational measures are in place in particular in 4.5.2016 L 119/84   order to ensure respect for the principle of data minimisation. Those measures may include pseudonymisation provided that those purposes can be fulfilled in that manner. Where those purposes can be fulfilled by further processing which does not permit or no longer permits the identification of data subjects, those purposes shall be fulfilled in that manner.
2.Where personal data are processed for scientific or historical research purposes or statistical purposes, Union or Member State law may provide for derogations from the rights referred to in Articles 15, 16, 18 and 21 subject to the conditions and safeguards referred to in paragraph 1 of this Article in so far as such rights are likely to render impossible or seriously impair the achievement of the specific purposes, and such derogations are necessary for the fulfilment of those purposes.
3.Where personal data are processed for archiving purposes in the public interest, Union or Member State law may provide for derogations from the rights referred to in Articles 15, 16, 18, 19, 20 and 21 subject to the conditions and safeguards referred to in paragraph 1 of this Article in so far as such rights are likely to render impossible or seriously impair the achievement of the specific purposes, and such derogations are necessary for the fulfilment of those purposes.
4.Where processing referred to in paragraphs 2 and 3 serves at the same time another purpose, the derogations shall apply only to processing for the purposes referred to in those paragraphs., 1) 'personal data' means any information relating to an identified or identifiable natural person ('data subject'); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;
(2) ‘processing’ means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction;
(3) ‘restriction of processing’ means the marking of stored personal data with the aim of limiting their processing in the future;
(4) ‘profiling’ means any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects concerning that natural person's performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements;
(5) ‘pseudonymisation’ means the processing of personal data in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organisational measures to ensure that the personal data are not attributed to an identified or identifiable natural person;
(6) ‘filing system’ means any structured set of personal data which are accessible according to specific criteria, whether centralised, decentralised or dispersed on a functional or geographical basis;
(7) ‘controller’ means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law;
(8) ‘processor’ means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller;
(9) ‘recipient’ means a natural or legal person, public authority, agency or another body, to which the personal data are disclosed, whether a third party or not. However, public authorities which may receive personal data in the framework of a particular inquiry in accordance with Union or Member State law shall not be regarded as recipients; the processing of those data by those public authorities shall be in compliance with the applicable data protection rules according to the purposes of the processing;
(10) ‘third party’ means a natural or legal person, public authority, agency or body other than the data subject, controller, processor and persons who, under the direct authority of the controller or processor, are authorised to process personal data;
(11) ‘consent’ of the data subject means any freely given, specific, informed and unambiguous indication of the data subject's wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her;
(12) ‘personal data breach’ means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed;
(13) ‘genetic data’ means personal data relating to the inherited or acquired genetic characteristics of a natural person which give unique information about the physiology or the health of that natural person and which result, in particular, from an analysis of a biological sample from the natural person in question;
(14) ‘biometric data’ means personal data resulting from specific technical processing relating to the physical, physiological or behavioural characteristics of a natural person, which allow or confirm the unique identification of that natural person, such as facial images or dactyloscopic data;
(15) ‘data concerning health’ means personal data related to the physical or mental health of a natural person, including the provision of health care services, which reveal information about his or her health status;
(16) ‘main establishment’ means: (a) as regards a controller with establishments in more than one Member State, the place of its central administration in the Union, unless the decisions on the purposes and means of the processing of personal data are taken in another establishment of the controller in the Union and the latter establishment has the power to have such decisions implemented, in which case the establishment having taken such decisions is to be considered to be the main establishment; (b) as regards a processor with establishments in more than one Member State, the place of its central administration in the Union, or, if the processor has no central administration in the Union, the establishment of the processor in the Union where the main processing activities in the context of the activities of an establishment of the processor take place to the extent that the processor is subject to specific obligations under this Regulation;
(17) ‘representative’ means a natural or legal person established in the Union who, designated by the controller or processor in writing pursuant to Article 27, represents the controller or processor with regard to their respective obligations under this Regulation;
(18) ‘enterprise’ means a natural or legal person engaged in an economic activity, irrespective of its legal form, including partnerships or associations regularly engaged in an economic activity;
(19) ‘group of undertakings’ means a controlling undertaking and its controlled undertakings;
(20) ‘binding corporate rules’ means personal data protection policies which are adhered to by a controller or processor established on the territory of a Member State for transfers or a set of transfers of personal data to a controller or processor in one or more third countries within a group of undertakings, or group of enterprises engaged in a joint economic activity;
(21) ‘supervisory authority’ means an independent public authority which is established by a Member State pursuant to Article 51;
(22) ‘supervisory authority concerned’ means a supervisory authority which is concerned by the processing of personal data because: (a) the controller or processor is established on the territory of the Member State of that supervisory authority; (b) data subjects residing in the Member State of that supervisory authority are substantially affected or likely to be substantially affected by the processing; or (c) a complaint has been lodged with that supervisory authority;
(23) ‘cross-border processing’ means either: (a) processing of personal data which takes place in the context of the activities of establishments in more than one Member State of a controller or processor in the Union where the controller or processor is established in more than one Member State; or (b) processing of personal data which takes place in the context of the activities of a single establishment of a controller or processor in the Union but which substantially affects or is likely to substantially affect data subjects in more than one Member State.
(24) ‘relevant and reasoned objection’ means an objection to a draft decision as to whether there is an infringement of this Regulation, or whether envisaged action in relation to the controller or processor complies with this Regulation, which clearly demonstrates the significance of the risks posed by the draft decision as regards the fundamental rights and freedoms of data subjects and, where applicable, the free flow of personal data within the Union;
(25) ‘information society service’ means a service as defined in point (b) of Article 1(1) of Directive (EU) 2015/1535 of the European Parliament and of the Council (1);
(26) ‘international organisation’ means an organisation and its subordinate bodies governed by public international law, or any other body which is set up by, or on the basis of, an agreement between two or more countries., 1.A transfer of personal data to a third country or an international organisation may take place where the Commission has decided that the third country, a territory or one or more specified sectors within that third country, or the international organisation in question ensures an adequate level of protection. Such a transfer shall not require any specific authorisation.
2.When assessing the adequacy of the level of protection, the Commission shall, in particular, take account of the following elements: (a)  the rule of law, respect for human rights and fundamental freedoms, relevant legislation, both general and sectoral, including concerning public security, defence, national security and criminal law and the access of public authorities to personal data, as well as the implementation of such legislation, data protection rules, professional rules and security measures, including rules for the onward transfer of personal data to another third country or international organisation which are complied with in that country or international organisation, case-law, as well as effective and enforceable data subject rights and effective administrative and judicial redress for the data subjects whose personal data are being transferred; (b)  the existence and effective functioning of one or more independent supervisory authorities in the third country or to which an international organisation is subject, with responsibility for ensuring and enforcing compliance with the data protection rules, including adequate enforcement powers, for assisting and advising the data subjects in exercising their rights and for cooperation with the supervisory authorities of the Member States; and (c)  the international commitments the third country or international organisation concerned has entered into, or other obligations arising from legally binding conventions or instruments as well as from its participation in multilateral or regional systems, in particular in relation to the protection of personal data.
3.The Commission, after assessing the adequacy of the level of protection, may decide, by means of implementing act, that a third country, a territory or one or more specified sectors within a third country, or an international organisation ensures an adequate level of protection within the meaning of paragraph 2 of this Article. The implementing act shall provide for a mechanism for a periodic review, at least every four years, which shall take into account all relevant developments in the third country or international organisation. The implementing act shall specify its territorial and sectoral application and, where applicable, identify the supervisory authority or authorities referred to in point (b) of paragraph 2 of this Article. The implementing act shall be adopted in accordance with the examination procedure referred to in Article 93(2).
4.The Commission shall, on an ongoing basis, monitor developments in third countries and international organisations that could affect the functioning of decisions adopted pursuant to paragraph 3 of this Article and decisions adopted on the basis of Article 25(6) of Directive 95/46/EC.
5.The Commission shall, where available information reveals, in particular following the review referred to in paragraph 3 of this Article, that a third country, a territory or one or more specified sectors within a third country, or an international organisation no longer ensures an adequate level of protection within the meaning of paragraph 2 of this Article, to the extent necessary, repeal, amend or suspend the decision referred to in paragraph 3 of this Article by means of implementing acts without retro-active effect. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 93(2). On duly justified imperative grounds of urgency, the Commission shall adopt immediately applicable implementing acts in accordance with the procedure referred to in Article 93(3).
6.The Commission shall enter into consultations with the third country or international organisation with a view to remedying the situation giving rise to the decision made pursuant to paragraph 5
7.A decision pursuant to paragraph 5 of this Article is without prejudice to transfers of personal data to the third country, a territory or one or more specified sectors within that third country, or the international organisation in question pursuant to Articles 46 to 49
8.The Commission shall publish in the Official Journal of the European Union and on its website a list of the third countries, territories and specified sectors within a third country and international organisations for which it has decided that an adequate level of protection is or is no longer ensured.
9.Decisions adopted by the Commission on the basis of Article 25(6) of Directive 95/46/EC shall remain in force until amended, replaced or repealed by a Commission Decision adopted in accordance with paragraph 3 or 5 of this Article., source_sentence: Which type of requests did the banks accept?
sentences: **Court (Civil/Criminal): Civil**

**Provisions:**

**Time of commission of the act:**

**Outcome (not guilty, guilty):**

**Rationale:**

**Facts:**
The plaintiff holds credit card number ............ with the defendant banking corporation. Based on the application for alternative networks dated 19/7/2015 with number ......... submitted at a branch of the defendant, he was granted access to the electronic banking service (e-banking) to conduct banking transactions (debit, credit, updates, payments) remotely. On 30/11/2020, the plaintiff fell victim to electronic fraud through the "phishing" method, whereby an unknown perpetrator managed to withdraw a total amount of €3,121.75 from the aforementioned credit card. Specifically, the plaintiff received an email at 1:35 PM on 29/11/2020 from sender ...... with address ........, informing him that due to an impending system change, he needed to verify the mobile phone number linked to the credit card, urging him to complete the verification process within the next 24 hours by following a link titled ........; otherwise, his account would be locked for security reasons. The plaintiff read this email on the afternoon of 30 November 2020 and, believing it was from the defendant, followed the instructions and proceeded via the provided link to a website that was identical (a clone) to that of the defendant. On this page, he was asked to enter the six-digit security code (.........) that had just been sent to his mobile phone by the defendant at 3:41 PM, with the note that it was an activation code for his ........ card at ........., which he entered.

Subsequently, the plaintiff received, according to his statements, a new email (not submitted), which requested him to enter the details of the aforementioned credit card, specifically the name of the cardholder and the card number, not the PIN, which he also entered, convinced that he was within the online environment of the defendant. Then, at 3:47 PM, he received a message on his mobile phone from the defendant containing the exact same content as the one he received at 3:41 PM, while at 3:50 PM he received a message stating that the activation of his ......... card at ....... had been completed. Once the plaintiff read this, he became concerned that something was not right, and immediately called (at 4:41 PM) the defendant's call center to inform them. There, the employees, with whom he finally connected at 5:04 PM due to high call center volume, advised him to delete the relevant emails, cancel his credit card, change his access passwords for the service, and submit a dispute request regarding the conducted transactions. The plaintiff electronically sent this request to the defendant, disputing the detailed transactions amounting to €3,121.75, which were conducted on 30/11/2020 during the time frame of 16:37:45-16:43:34 PM, arguing that he had neither performed them himself nor authorized anyone else to do so. The plaintiff specifically disputed the following transactions, as evidenced by the account activity of the disputed credit card during the aforementioned timeframe: a) transaction number ......... amounting to €150.62 conducted on 30/11/2020 at 4:43:34 PM, b) transaction number ........ amounting to €293.20 conducted on 30/11/2020 at 4:42:40 PM, c) transaction number ............ amounting to €295.21 conducted on 30/11/2020 at 4:42:10 PM, d) transaction number .......... amounting to €299.22 conducted on 30/11/2020 at 4:41:31 PM, e) transaction number ........ amounting to €297.21 conducted on 30/11/2020 at 4:41:01 PM, f) transaction number ........ amounting to €299.22 conducted on 30/11/2020 at 4:40:27 PM, g) transaction number ....... amounting to €299.22 conducted on 30/11/2020 at 4:39:55 PM, h) transaction number ...... amounting to €299.22 conducted on 30/11/2020 at 4:39:22 PM, i) transaction number ......... amounting to €297.22 conducted on 30/11/2020 at 4:38:52 PM, j) transaction number ......... amounting to €295.21 conducted on 30/11/2020 at 4:38:17 PM, and k) transaction number ......... amounting to €296.21 conducted on 30/11/2020 at 4:37:45 PM. In its response letter dated 21/12/2020, the defendant denied responsibility for the costs of the aforementioned transactions, placing the entire blame on the plaintiff for the leak of his card details and security code to the fraudulent page. The plaintiff, completely denying any fault for the conducted transactions, repeatedly contacted the defendant, both by phone and via email (see emails dated 15/1/2021 and 11/2/2021), while on 2/3/2021, he electronically sent a report dated 1/03/2021 to the Consumer Advocate’s email address, recounting the events and requesting that the aforementioned Independent Authority intervene to have the disputed debt canceled. In its letter with reference number ...../27.04.2021, the aforementioned Independent Authority informed the plaintiff that the case was outside its mediating role and was therefore archived. Subsequently, the plaintiff sent the defendant on 5/3/2021 his extrajudicial statement dated 4/3/2021, calling upon it to fully cancel the debt of €3,121.75 that had been unjustly incurred against him within two days and to immediately instruct the representatives of the collection agency working with it to cease contacting him regarding the disputed case. The defendant sent the plaintiff a message on his mobile phone on 20/04/2021 informing him that his case was still being processed due to lengthy operational requirements, while on 23/04/2021, via email, it informed him that considering their good cooperation and his efforts to keep them updated, it had reviewed his case and decided to refund him the amounts of the transactions that were conducted after his contact with their representatives on 30/11/2020 at 4:41 PM, totaling €1,038.25, specifically the following: a) transaction of €150.62 conducted on 30/11/2020 at 4:43 PM, b) transaction of €295.21 conducted on 30/11/2020 at 4:42 PM, c) transaction of €293.20 conducted on 30/11/2020 at 4:42 PM, and d) transaction of €299.22 conducted on 30/11/2020 at 4:41 PM. Beyond this, the defendant refused to refund the plaintiff the amount of the remaining transactions conducted on 30/11/2020, totaling €2,376.08 (and not €2,376.48 as incorrectly stated by the plaintiff in his lawsuit), which the plaintiff ultimately fully paid, transferring €2,342.77 to the defendant on 7/06/2021 and €33.31 on 15/06/2021 (see related deposit receipts)., 1.Processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person's sex life or sexual orientation shall be prohibited.
2.Paragraph 1 shall not apply if one of the following applies: (a)  the data subject has given explicit consent to the processing of those personal data for one or more specified purposes, except where Union or Member State law provide that the prohibition referred to in paragraph 1 may not be lifted by the data subject; (b)  processing is necessary for the purposes of carrying out the obligations and exercising specific rights of the controller or of the data subject in the field of employment and social security and social protection law in so far as it is authorised by Union or Member State law or a collective agreement pursuant to Member State law providing for appropriate safeguards for the fundamental rights and the interests of the data subject; (c)  processing is necessary to protect the vital interests of the data subject or of another natural person where the data subject is physically or legally incapable of giving consent; (d)  processing is carried out in the course of its legitimate activities with appropriate safeguards by a foundation, association or any other not-for-profit body with a political, philosophical, religious or trade union aim and on condition that the processing relates solely to the members or to former members of the body or to persons who have regular contact with it in connection with its purposes and that the personal data are not disclosed outside that body without the consent of the data subjects; (e)  processing relates to personal data which are manifestly made public by the data subject; (f)  processing is necessary for the establishment, exercise or defence of legal claims or whenever courts are acting in their judicial capacity; (g)  processing is necessary for reasons of substantial public interest, on the basis of Union or Member State law which shall be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject; (h)  processing is necessary for the purposes of preventive or occupational medicine, for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services on the basis of Union or Member State law or pursuant to contract with a health professional and subject to the conditions and safeguards referred to in paragraph 3; (i)  processing is necessary for reasons of public interest in the area of public health, such as protecting against serious cross-border threats to health or ensuring high standards of quality and safety of health care and of medicinal products or medical devices, on the basis of Union or Member State law which provides for suitable and specific measures to safeguard the rights and freedoms of the data subject, in particular professional secrecy; 4.5.2016 L 119/38   (j)  processing is necessary for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) based on Union or Member State law which shall be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject.
3.Personal data referred to in paragraph 1 may be processed for the purposes referred to in point (h) of paragraph 2 when those data are processed by or under the responsibility of a professional subject to the obligation of professional secrecy under Union or Member State law or rules established by national competent bodies or by another person also subject to an obligation of secrecy under Union or Member State law or rules established by national competent bodies.
4.Member States may maintain or introduce further conditions, including limitations, with regard to the processing of genetic data, biometric data or data concerning health., **Court (Civil/Criminal): Civil**  
**Provisions:**  
**Time of commission of the act:**  
**Outcome (not guilty, guilty):**  
**Reasoning:** Claim for compensation and monetary satisfaction due to moral damage against a mobile phone company and a credit institution within the framework of inadequate fulfillment of a payment services contract for "web banking." Appropriate actions for mobile phone companies in case of a request for a "sim" card replacement due to wear or loss. They must verify the customer's identity based on the personal details and identification information registered in their system but are not liable for any changes in the latter that were not timely communicated to them. Further security measures such as phone communication or sending an SMS to the mobile number holder are not required. Payment services under Law 4357/2018. Obligation of the payment service provider, such as banks, to inform the payer after receiving a relevant order for making a payment. The content of this varies per case, such as sending a personalized code to the user's mobile phone for transaction approval, as well as sending an email immediately after its completion. However, the bank is not liable for customer damage resulting from illicit electronic transactions due to third-party interception of either the access codes for electronic banking transactions or the sim card and the phone number to which the personalized codes for approving the aforementioned transactions are sent, within the framework of increased security protocols. Appropriate actions by banks upon diagnosing illicit banking transactions that may be fraudulent. Relevant criteria for consideration. The evidence did not indicate negligent and thus tortious behavior from all defendants. The claim is dismissed.  

**Facts:** In the present claim, upon due assessment of its content, the plaintiff states that he has a mobile phone subscription with the first defendant, a mobile phone company. On October 26, 2020, in the morning, he realized that his mobile phone was offline, and by noon, he received email notifications from Bank .......... and ............ (whose third and fourth defendants are de facto universal successors, respectively), with which he holds an account, regarding transactions he had made. From phone calls from his home phone to Bank .............. and ............ Bank, he was informed that on the same day, in a very short period, four money transfers had been made from the account he maintains at Bank .............., specifically, an amount of €15,000 was transferred to the account mentioned in the claim document under the name ..........., at ........ an amount of €15,000 was transferred to the account mentioned in the claim document under the name ......... at ........... Bank, an amount of €15,000 was transferred to the plaintiff's account with his daughter as a co-holder at ......... Bank, and an amount of €6,700 was transferred from another of his accounts to the account from which the transfer to the aforementioned accounts of €45,000 was made. Additionally, from the plaintiff's account with his daughter as a co-holder at .......... Bank, an amount of €9,999 was transferred to an account under the name of .... . He attempted to log into the online banking service of Bank ......... from his home computer, but found that the service was locked, while regarding the corresponding service of ........... Bank, he requested alongside his daughter to 'lock' it. In a phone call with the call center of Bank ............, he was informed about the locking of his electronic account in the online banking service and was told to dispute the transactions, which he did immediately through ... banking, while his daughter communicated about this with ....... Bank. The transfer to the account with the beneficiary was canceled, and the amount of €15,000 was returned to the plaintiff. After his investigation, he discovered that an unknown individual appeared at the branch of the first defendant, served by the second defendant, who posed as the plaintiff and presented a forged military ID card of the plaintiff, requesting and receiving a new sim card, resulting in the deactivation of the plaintiff's sim card and gaining access to the codes sent to him by the banks for completing the transfers. Due to the negligence of the second defendant, he did not realize that the identity used was forged, as since 2010, when the plaintiff retired, he has had a police identification card. The first defendant does not have security protocols to prevent such incidents, which constitute the sim .... method, despite the issuance of a press release from the Attica Security and numerous publications regarding the aforementioned method, unlike other mobile phone companies, which implement a specific procedure for changing sim cards. The second defendant did not take the obvious step to check the functioning of the sim card before replacing it, where he would have realized that the plaintiff's mobile phone was functioning normally. Bank .......... and ........... Bank: a) accepted requests for transferring large amounts of money from accounts that had no similar activity in the past, while the plaintiff's online banking account with the above banks was locked quite some time later, b) sent email notifications regarding successful transactions in succession, under a single email, c) did not check the address ... of the perpetrators, which was different from that used by the plaintiff, and d) did not take necessary security measures to prevent fraud via sim ... against the plaintiff, as the security code (pin) sent by the banks via message to the mobile phone proved to be compromised. As a result of the above illegal and culpable behavior of the defendants, the plaintiff suffered property damage amounting to a total of €24,999, which constitutes the total amount of the transfers made by third unknown persons to accounts of unknown individuals, as stated above, and has not been refunded despite his repeated inquiries, while he also suffered distress and mental anguish, and his trust in the banks was shaken, thus entitling him to monetary compensation for his moral damage, amounting to €5,000., source_sentence: Who can bring proceedings before the courts if a complaint has been rejected?
sentences: 1.Supervisory authorities shall provide each other with relevant information and mutual assistance in order to implement and apply this Regulation in a consistent manner, and shall put in place measures for effective cooperation with one another. Mutual assistance shall cover, in particular, information requests and supervisory measures, such as requests to carry out prior authorisations and consultations, inspections and investigations.
2.Each supervisory authority shall take all appropriate measures required to reply to a request of another supervisory authority without undue delay and no later than one month after receiving the request. Such measures may include, in particular, the transmission of relevant information on the conduct of an investigation.
3.Requests for assistance shall contain all the necessary information, including the purpose of and reasons for the request. Information exchanged shall be used only for the purpose for which it was requested.
4.The requested supervisory authority shall not refuse to comply with the request unless: (a)  it is not competent for the subject-matter of the request or for the measures it is requested to execute; or (b)  compliance with the request would infringe this Regulation or Union or Member State law to which the supervisory authority receiving the request is subject.
5.The requested supervisory authority shall inform the requesting supervisory authority of the results or, as the case may be, of the progress of the measures taken in order to respond to the request. The requested supervisory authority shall provide reasons for any refusal to comply with a request pursuant to paragraph 4
6.Requested supervisory authorities shall, as a rule, supply the information requested by other supervisory authorities by electronic means, using a standardised format.
7.Requested supervisory authorities shall not charge a fee for any action taken by them pursuant to a request for mutual assistance. Supervisory authorities may agree on rules to indemnify each other for specific expenditure arising from the provision of mutual assistance in exceptional circumstances.
8.Where a supervisory authority does not provide the information referred to in paragraph 5 of this Article within one month of receiving the request of another supervisory authority, the requesting supervisory authority may adopt a provisional measure on the territory of its Member State in accordance with Article 55(1). In that case, the urgent need to act under Article 66(1) shall be presumed to be met and require an urgent binding decision from the Board pursuant to Article 66(2).
9.The Commission may, by means of implementing acts, specify the format and procedures for mutual assistance referred to in this Article and the arrangements for the exchange of information by electronic means between supervisory authorities, and between supervisory authorities and the Board, in particular the standardised format referred to in paragraph 6 of this Article. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 93(2)., **Court (Civil/Criminal): Civil**  
**Provisions:**  
**Time of commission of the act:**  
**Outcome (not guilty, guilty):**  
**Reasoning:** Partially accepts the lawsuit.  
**Facts:** The plaintiff, who works as a lawyer, maintains a savings account with the defendant banking corporation under account number GR.............. Pursuant to a contract dated June 11, 2010, established in Thessaloniki between the defendant and the plaintiff, the plaintiff was granted access to the electronic banking system (e-banking) to conduct banking transactions remotely. On October 10, 2020, the plaintiff fell victim to electronic fraud through the "phishing" method, whereby an unknown perpetrator managed to extract and transfer €3,000.00 from the plaintiff’s account to another account of the same bank. Specifically, on that day at 6:51 a.m., the plaintiff received an email from the sender ".........", with the address ..........., informing him that his debit card had been suspended and that online payments and cash withdrawals could not be made until the issue was resolved. The email urged him to confirm his details within the next 72 hours by following a link titled "card activation."  
The plaintiff read the above email on his mobile phone around 8:00 a.m., and believing it came from the defendant, he followed the instructions and accessed a website that was identical (a clone) to that of the defendant. On this page, he was asked to enter his login credentials to connect to the service, which he did, and he was subsequently asked to input his debit card details for the alleged activation, which he also provided. Then, to complete the process, a number was sent to his mobile phone at 8:07 a.m. from the sender ........, which he entered, and two minutes later he received a message from the same sender in English stating that the quick access code had been activated on his mobile. A few minutes later, at 8:18 a.m., he received an email from the defendant informing him of the transfer of €3,000.00 from his account to account number GR ........... held at the same bank, with the beneficiary's details being .......... As soon as the plaintiff read this, he immediately called the defendant's call center and canceled his debit card, the access codes for the service ......., and locked the application .......... At the same time, he verbally submitted a request to dispute and cancel the contested transaction, and in a subsequent phone call, he also canceled his credit card. On the same day, he also sent an email to the defendant informing them in writing of the above and requesting the cancellation of the transaction and the return of the amount of €3,000.00 to his account, as this transfer was not made by him but by an unknown perpetrator through electronic fraud and was not approved by him. It should also be noted that the plaintiff, as the sole beneficiary according to the aforementioned contract for using the defendant's Internet Banking service, never received any update via SMS or the VIBER application from the bank regarding the transaction details before its completion, nor did he receive a one-time code (OTP) to approve the contested transaction. He subsequently filed a complaint against unknown persons at the Cyber Crime Division for the crime of fraud. The defendant sent an email to the plaintiff on October 16, 2020, informing him that his request had been forwarded to the appropriate department of the bank for investigation, stating that the bank would never send him an email or SMS asking him to enter his personal data and that as of October 7, 2020, there was a notice posted for its customers regarding malicious attempts to steal personal data in the "Our News" section on ....... A month after the disputed incident, on November 10, 2020, an amount of €2,296.82 was transferred to the plaintiff's account from the account to which the fraudulent credit had been made. The plaintiff immediately sent an email to the defendant asking to be informed whether this transfer was a return of part of the amount that had been illegally withdrawn from his account and requested the return of the remaining amount of €703.18. In its response dated January 13, 2021, the defendant confirmed that the aforementioned amount indeed came from the account to which the fraudulent credit had been made, following a freeze of that account initiated by the defendant during the investigation of the incident, but refused to return the remaining amount, claiming it bore no responsibility for the leak of the personal codes to third parties, according to the terms of the service contract established between them.  
From the entirety of the evidence presented to the court, there is no indication of the authenticity of the contested transaction, as the plaintiff did not give his consent for the execution of the transfer of the amount of €3,000.00, especially in light of the provision in Article 72 paragraph 2 of Law 4537/2018 stating that the mere use of the Internet Banking service by the plaintiff does not necessarily constitute sufficient evidence that the payer approved the payment action. Specifically, it was proven that the contested transaction was not carried out following a strong identification of the plaintiff – the sole beneficiary of the account – and his approval, as the latter may have entered his personal codes on the counterfeit website; however, he was never informed, before the completion of the contested transaction, of the amount that would be transferred from his account to a third-party account, nor did he receive on his mobile phone, either via SMS or through the VIBER application or any other means, the one-time code - extra PIN for its completion, which he was required to enter to approve the contested transaction (payment action) and thus complete his identification, a fact that was not countered by any evidence from the defendant. Furthermore, it is noted that the defendant's claims that it bears no responsibility under the terms of the banking services contract, whereby it is not liable for any damage to its customer in cases of unauthorized use of their personal access codes to the Internet Banking service, are to be rejected as fundamentally unfounded. This is because the aforementioned contractual terms are invalid according to the provision of Article 103 of Law 4537/2018, as they contradict the provisions of Articles 71, 73, and 92 of the same Law, which provide for the provider's universal liability and its exemption only for unusual and unforeseen circumstances that are beyond the control of the party invoking them and whose consequences could not have been avoided despite all efforts to the contrary; these provisions establish mandatory law in favor of users, as according to Article 103 of Law 4537/2018, payment service providers are prohibited from deviating from the provisions to the detriment of payment service users, unless the possibility of deviation is explicitly provided and they can decide to offer only more favorable terms to payment service users; the aforementioned contractual terms do not constitute more favorable terms but rather disadvantageous terms for the payment service user. In this case, however, the defendant did not prove the authenticity of the transaction and its approval by the plaintiff and did not invoke, nor did any unusual and unforeseen circumstances beyond its control, the consequences of which could not have been avoided despite all efforts to the contrary, come to light. Therefore, the contested transaction transferring the amount of €3,000.00 is considered, in the absence of demonstrable consent from the plaintiff, unapproved according to the provisions of Article 64 of Law 4537/2018, and the defendant's contrary claims are rejected, especially since the plaintiff proceeded, according to Article 71 paragraph 1 of Law 4537/2018, without undue delay to notify the defendant regarding the contested unapproved payment action. Consequently, the defendant is liable for compensating the plaintiff for the positive damage he suffered under Article 73 of Law 4537/2018 and is obliged to pay him the requested amount of €703.18, while the plaintiff’s fault in the occurrence of this damage cannot be established, as he entered his personal details in an online environment that was a faithful imitation of that of the defendant, as evidenced by the comparison of the screenshots of the fake website and the real website provided by the plaintiff, a fact that he could not have known while being fully convinced that he was transacting with the defendant. Furthermore, the defendant’s liability to compensate the plaintiff is based on the provision of Article 8 of Law 2251/1994, which applies in this case, as the plaintiff's damage resulted from inadequate fulfillment of its obligations in the context of providing its services, but also on the provision of Article 914 of the Civil Code in the sense of omission on its part of unlawfully and culpably imposed actions. In this case, given that during the relevant period there had been a multitude of similar incidents of fraud against the defendant's customers, the latter, as a service provider to the consumer public and bearing transactional obligations of care and security towards them, displayed gross negligence regarding the security provided for electronic transaction services, which was compromised by the fraudulent theft of funds, as it did not comply with all required high-security measures for executing the contested transaction, failing to implement the strict customer identification verification process and to check the authenticity of the account to which the funds were sent, thus not assuming the suspicious nature of the transaction, did not adopt comprehensive and improved protective measures to fully protect its customers against malicious attacks and online fraud and to prevent the infiltration of unauthorized third parties, nor did it fulfill its obligations to inform, accurately inform, and warn its consumers - customers, as it failed to adequately inform them of attempts to steal their personal data through the sending of informative emails or SMS, while merely posting in a section rather than on a central banner (as it later did) does not constitute adequate information such that it meets the requirement of protecting its customers and the increased safeguarding of their interests. Although the plaintiff acted promptly and informed the defendant on the same day about the contested incident, the defendant did not act as promptly regarding the investigation of the incident and the freezing of the account that held the fraudulent credit to prevent the plaintiff's loss, but only returned part of the funds to the plaintiff a month later. This behavior, beyond being culpable due to gross negligence, was also unlawful, as it would have been illegal even without the contractual relationship, as contrary to the provisions of Law 4537/2018 and Law 2251/1994, regarding the lack of security of the services that the consumer is legitimately entitled to expect, as well as the building of trust that is essential in banking transactions, elements that it was obligated to provide within the sphere of the services offered, and contrary to the principles of good faith and commercial ethics, as crystallized in the provision of Article 288 of the Civil Code, as well as the general duty imposed by Article 914 of the Civil Code not to cause harm to another culpably. This resulted not only in positive damage to the plaintiff but also in causing him moral harm consisting of his mental distress and the disruption, agitation, and sorrow he experienced, for which he must be awarded financial compensation. Taking into account all the general circumstances of the case, the extent of the plaintiff's damage, the severity of the defendant's fault, the mental distress suffered by the plaintiff, the insecurity he felt regarding his deposits, the sorrow he experienced, and the stress caused by his financial loss, which occurred during the pandemic period when his earnings from his professional activity had significantly decreased, as well as the financial and social situation of the parties, it is the court's opinion that he should be granted, as financial compensation for his moral harm, an amount of €250.00, which is deemed reasonable and fair. Therefore, the total monetary amount that the plaintiff is entitled to for his positive damage and financial compensation for the moral harm suffered amounts to a total of (€703.18 + €250.00) = €953.18., Any natural or legal person has the right to bring an action for annulment of decisions of the Board before the Court of Justice under the conditions provided for in Article 263 TFEU. As addressees of such decisions, the supervisory authorities concerned which wish to challenge them have to bring action within two months of being notified of them, in accordance with Article 263 TFEU. Where decisions of the Board are of direct and individual concern to a controller, processor or complainant, the latter may bring an action for annulment against those decisions within two months of their publication on the website of the Board, in accordance with Article 263 TFEU. Without prejudice to this right under Article 263 TFEU, each natural or legal person should have an effective judicial remedy before the competent national court against a decision of a supervisory authority which produces legal effects concerning that person. Such a decision concerns in particular the exercise of investigative, corrective and authorisation powers by the supervisory authority or the dismissal or rejection of complaints. However, the right to an effective judicial remedy does not encompass measures taken by supervisory authorities which are not legally binding, such as opinions issued by or advice provided by the supervisory authority. Proceedings against a supervisory authority should be brought before the courts of the Member State where the supervisory authority is established and should be conducted in accordance with that Member State's procedural law. Those courts should exercise full jurisdiction, which should include jurisdiction to examine all questions of fact and law relevant to the dispute before them. Where a complaint has been rejected or dismissed by a supervisory authority, the complainant may bring proceedings before the courts in the same Member State. In the context of judicial remedies relating to the application of this Regulation, national courts which consider a decision on the question necessary to enable them to give judgment, may, or in the case provided for in Article 267 TFEU, must, request the Court of Justice to give a preliminary ruling on the interpretation of Union law, including this Regulation. Furthermore, where a decision of a supervisory authority implementing a decision of the Board is challenged before a national court and the validity of the decision of the Board is at issue, that national court does not have the power to declare the Board's decision invalid but must refer the question of validity to the Court of Justice in accordance with Article 267 TFEU as interpreted by the Court of Justice, where it considers the decision invalid. However, a national court may not refer a question on the validity of the decision of the Board at the request of a natural or legal person which had the opportunity to bring an action for annulment of that decision, in particular if it was directly and individually concerned by that decision, but had not done so within the period laid down in Article 263 TFEU., source_sentence: What are the defendant's claims described as?
sentences: 1.Without prejudice to other tasks set out under this Regulation, each supervisory authority shall on its territory: (a)  monitor and enforce the application of this Regulation; (b)  promote public awareness and understanding of the risks, rules, safeguards and rights in relation to processing. Activities addressed specifically to children shall receive specific attention; (c)  advise, in accordance with Member State law, the national parliament, the government, and other institutions and bodies on legislative and administrative measures relating to the protection of natural persons' rights and freedoms with regard to processing; (d)  promote the awareness of controllers and processors of their obligations under this Regulation; (e)  upon request, provide information to any data subject concerning the exercise of their rights under this Regulation and, if appropriate, cooperate with the supervisory authorities in other Member States to that end; (f)  handle complaints lodged by a data subject, or by a body, organisation or association in accordance with Article 80, and investigate, to the extent appropriate, the subject matter of the complaint and inform the complainant of the progress and the outcome of the investigation within a reasonable period, in particular if further investigation or coordination with another supervisory authority is necessary; (g)  cooperate with, including sharing information and provide mutual assistance to, other supervisory authorities with a view to ensuring the consistency of application and enforcement of this Regulation; (h)  conduct investigations on the application of this Regulation, including on the basis of information received from another supervisory authority or other public authority; (i)  monitor relevant developments, insofar as they have an impact on the protection of personal data, in particular the development of information and communication technologies and commercial practices; (j)  adopt standard contractual clauses referred to in Article 28(8) and in point (d) of Article 46(2); (k)  establish and maintain a list in relation to the requirement for data protection impact assessment pursuant to Article 35(4); (l)  give advice on the processing operations referred to in Article 36(2); (m)  encourage the drawing up of codes of conduct pursuant to Article 40(1) and provide an opinion and approve such codes of conduct which provide sufficient safeguards, pursuant to Article 40(5); (n)  encourage the establishment of data protection certification mechanisms and of data protection seals and marks pursuant to Article 42(1), and approve the criteria of certification pursuant to Article 42(5); (o)  where applicable, carry out a periodic review of certifications issued in accordance with Article 42(7); 4.5.2016 L 119/68   (p)  draft and publish the criteria for accreditation of a body for monitoring codes of conduct pursuant to Article 41 and of a certification body pursuant to Article 43; (q)  conduct the accreditation of a body for monitoring codes of conduct pursuant to Article 41 and of a certification body pursuant to Article 43; (r)  authorise contractual clauses and provisions referred to in Article 46(3); (s)  approve binding corporate rules pursuant to Article 47; (t)  contribute to the activities of the Board; (u)  keep internal records of infringements of this Regulation and of measures taken in accordance with Article 58(2); and (v)  fulfil any other tasks related to the protection of personal data.
2.Each supervisory authority shall facilitate the submission of complaints referred to in point (f) of paragraph 1 by measures such as a complaint submission form which can also be completed electronically, without excluding other means of communication.
3.The performance of the tasks of each supervisory authority shall be free of charge for the data subject and, where applicable, for the data protection officer.
4.Where requests are manifestly unfounded or excessive, in particular because of their repetitive character, the supervisory authority may charge a reasonable fee based on administrative costs, or refuse to act on the request. The supervisory authority shall bear the burden of demonstrating the manifestly unfounded or excessive character of the request., **Court (Civil/Criminal): Civil**  
**Provisions:**  
**Time of commission of the act:**  
**Outcome (not guilty, guilty):**  
**Reasoning:** Partially accepts the lawsuit.  
**Facts:** The plaintiff, who works as a lawyer, maintains a savings account with the defendant banking corporation under account number GR.............. Pursuant to a contract dated June 11, 2010, established in Thessaloniki between the defendant and the plaintiff, the plaintiff was granted access to the electronic banking system (e-banking) to conduct banking transactions remotely. On October 10, 2020, the plaintiff fell victim to electronic fraud through the "phishing" method, whereby an unknown perpetrator managed to extract and transfer €3,000.00 from the plaintiff’s account to another account of the same bank. Specifically, on that day at 6:51 a.m., the plaintiff received an email from the sender ".........", with the address ..........., informing him that his debit card had been suspended and that online payments and cash withdrawals could not be made until the issue was resolved. The email urged him to confirm his details within the next 72 hours by following a link titled "card activation."  
The plaintiff read the above email on his mobile phone around 8:00 a.m., and believing it came from the defendant, he followed the instructions and accessed a website that was identical (a clone) to that of the defendant. On this page, he was asked to enter his login credentials to connect to the service, which he did, and he was subsequently asked to input his debit card details for the alleged activation, which he also provided. Then, to complete the process, a number was sent to his mobile phone at 8:07 a.m. from the sender ........, which he entered, and two minutes later he received a message from the same sender in English stating that the quick access code had been activated on his mobile. A few minutes later, at 8:18 a.m., he received an email from the defendant informing him of the transfer of €3,000.00 from his account to account number GR ........... held at the same bank, with the beneficiary's details being .......... As soon as the plaintiff read this, he immediately called the defendant's call center and canceled his debit card, the access codes for the service ......., and locked the application .......... At the same time, he verbally submitted a request to dispute and cancel the contested transaction, and in a subsequent phone call, he also canceled his credit card. On the same day, he also sent an email to the defendant informing them in writing of the above and requesting the cancellation of the transaction and the return of the amount of €3,000.00 to his account, as this transfer was not made by him but by an unknown perpetrator through electronic fraud and was not approved by him. It should also be noted that the plaintiff, as the sole beneficiary according to the aforementioned contract for using the defendant's Internet Banking service, never received any update via SMS or the VIBER application from the bank regarding the transaction details before its completion, nor did he receive a one-time code (OTP) to approve the contested transaction. He subsequently filed a complaint against unknown persons at the Cyber Crime Division for the crime of fraud. The defendant sent an email to the plaintiff on October 16, 2020, informing him that his request had been forwarded to the appropriate department of the bank for investigation, stating that the bank would never send him an email or SMS asking him to enter his personal data and that as of October 7, 2020, there was a notice posted for its customers regarding malicious attempts to steal personal data in the "Our News" section on ....... A month after the disputed incident, on November 10, 2020, an amount of €2,296.82 was transferred to the plaintiff's account from the account to which the fraudulent credit had been made. The plaintiff immediately sent an email to the defendant asking to be informed whether this transfer was a return of part of the amount that had been illegally withdrawn from his account and requested the return of the remaining amount of €703.18. In its response dated January 13, 2021, the defendant confirmed that the aforementioned amount indeed came from the account to which the fraudulent credit had been made, following a freeze of that account initiated by the defendant during the investigation of the incident, but refused to return the remaining amount, claiming it bore no responsibility for the leak of the personal codes to third parties, according to the terms of the service contract established between them.  
From the entirety of the evidence presented to the court, there is no indication of the authenticity of the contested transaction, as the plaintiff did not give his consent for the execution of the transfer of the amount of €3,000.00, especially in light of the provision in Article 72 paragraph 2 of Law 4537/2018 stating that the mere use of the Internet Banking service by the plaintiff does not necessarily constitute sufficient evidence that the payer approved the payment action. Specifically, it was proven that the contested transaction was not carried out following a strong identification of the plaintiff – the sole beneficiary of the account – and his approval, as the latter may have entered his personal codes on the counterfeit website; however, he was never informed, before the completion of the contested transaction, of the amount that would be transferred from his account to a third-party account, nor did he receive on his mobile phone, either via SMS or through the VIBER application or any other means, the one-time code - extra PIN for its completion, which he was required to enter to approve the contested transaction (payment action) and thus complete his identification, a fact that was not countered by any evidence from the defendant. Furthermore, it is noted that the defendant's claims that it bears no responsibility under the terms of the banking services contract, whereby it is not liable for any damage to its customer in cases of unauthorized use of their personal access codes to the Internet Banking service, are to be rejected as fundamentally unfounded. This is because the aforementioned contractual terms are invalid according to the provision of Article 103 of Law 4537/2018, as they contradict the provisions of Articles 71, 73, and 92 of the same Law, which provide for the provider's universal liability and its exemption only for unusual and unforeseen circumstances that are beyond the control of the party invoking them and whose consequences could not have been avoided despite all efforts to the contrary; these provisions establish mandatory law in favor of users, as according to Article 103 of Law 4537/2018, payment service providers are prohibited from deviating from the provisions to the detriment of payment service users, unless the possibility of deviation is explicitly provided and they can decide to offer only more favorable terms to payment service users; the aforementioned contractual terms do not constitute more favorable terms but rather disadvantageous terms for the payment service user. In this case, however, the defendant did not prove the authenticity of the transaction and its approval by the plaintiff and did not invoke, nor did any unusual and unforeseen circumstances beyond its control, the consequences of which could not have been avoided despite all efforts to the contrary, come to light. Therefore, the contested transaction transferring the amount of €3,000.00 is considered, in the absence of demonstrable consent from the plaintiff, unapproved according to the provisions of Article 64 of Law 4537/2018, and the defendant's contrary claims are rejected, especially since the plaintiff proceeded, according to Article 71 paragraph 1 of Law 4537/2018, without undue delay to notify the defendant regarding the contested unapproved payment action. Consequently, the defendant is liable for compensating the plaintiff for the positive damage he suffered under Article 73 of Law 4537/2018 and is obliged to pay him the requested amount of €703.18, while the plaintiff’s fault in the occurrence of this damage cannot be established, as he entered his personal details in an online environment that was a faithful imitation of that of the defendant, as evidenced by the comparison of the screenshots of the fake website and the real website provided by the plaintiff, a fact that he could not have known while being fully convinced that he was transacting with the defendant. Furthermore, the defendant’s liability to compensate the plaintiff is based on the provision of Article 8 of Law 2251/1994, which applies in this case, as the plaintiff's damage resulted from inadequate fulfillment of its obligations in the context of providing its services, but also on the provision of Article 914 of the Civil Code in the sense of omission on its part of unlawfully and culpably imposed actions. In this case, given that during the relevant period there had been a multitude of similar incidents of fraud against the defendant's customers, the latter, as a service provider to the consumer public and bearing transactional obligations of care and security towards them, displayed gross negligence regarding the security provided for electronic transaction services, which was compromised by the fraudulent theft of funds, as it did not comply with all required high-security measures for executing the contested transaction, failing to implement the strict customer identification verification process and to check the authenticity of the account to which the funds were sent, thus not assuming the suspicious nature of the transaction, did not adopt comprehensive and improved protective measures to fully protect its customers against malicious attacks and online fraud and to prevent the infiltration of unauthorized third parties, nor did it fulfill its obligations to inform, accurately inform, and warn its consumers - customers, as it failed to adequately inform them of attempts to steal their personal data through the sending of informative emails or SMS, while merely posting in a section rather than on a central banner (as it later did) does not constitute adequate information such that it meets the requirement of protecting its customers and the increased safeguarding of their interests. Although the plaintiff acted promptly and informed the defendant on the same day about the contested incident, the defendant did not act as promptly regarding the investigation of the incident and the freezing of the account that held the fraudulent credit to prevent the plaintiff's loss, but only returned part of the funds to the plaintiff a month later. This behavior, beyond being culpable due to gross negligence, was also unlawful, as it would have been illegal even without the contractual relationship, as contrary to the provisions of Law 4537/2018 and Law 2251/1994, regarding the lack of security of the services that the consumer is legitimately entitled to expect, as well as the building of trust that is essential in banking transactions, elements that it was obligated to provide within the sphere of the services offered, and contrary to the principles of good faith and commercial ethics, as crystallized in the provision of Article 288 of the Civil Code, as well as the general duty imposed by Article 914 of the Civil Code not to cause harm to another culpably. This resulted not only in positive damage to the plaintiff but also in causing him moral harm consisting of his mental distress and the disruption, agitation, and sorrow he experienced, for which he must be awarded financial compensation. Taking into account all the general circumstances of the case, the extent of the plaintiff's damage, the severity of the defendant's fault, the mental distress suffered by the plaintiff, the insecurity he felt regarding his deposits, the sorrow he experienced, and the stress caused by his financial loss, which occurred during the pandemic period when his earnings from his professional activity had significantly decreased, as well as the financial and social situation of the parties, it is the court's opinion that he should be granted, as financial compensation for his moral harm, an amount of €250.00, which is deemed reasonable and fair. Therefore, the total monetary amount that the plaintiff is entitled to for his positive damage and financial compensation for the moral harm suffered amounts to a total of (€703.18 + €250.00) = €953.18., **Court (Civil/Criminal):**
Provisions: Articles 8 of Law 2251/1994, Articles 2, 4, 48 et seq. of Law 4537/2018, Article 11 paragraph 1 of Law 4261/2014, Articles 830, 806, 827, 914, 932 of the Civil Code and 176 of the Code of Civil Procedure.
Time of commission of the act:
Outcome (not guilty, guilty):
Rationale: Electronic fraud through the method of phishing. A third party fraudulently obtained money from the plaintiff's bank account and transferred it to another bank account. Both the defendant is liable for the inadequate protection of its systems, which should have been excellent, and the plaintiff who failed to fulfill his obligation to protect his information and disregarded the defendant's security instructions. Law 4537/2018 introduces mandatory law in favor of users, as according to Article 103, payment service providers are prohibited from deviating from the provisions to the detriment of payment service users. It is determined that a resumption of the discussion should be ordered in order to provide all possible evidence, with diligence from both parties, especially from the defendant, who has access to the transaction data through its systems, but also bears the relevant burden of proof concerning the exact timing of the execution of the money transfer order at each stage (withdrawal from the plaintiff's account, transfer to another bank, transfer to the third party's account).
Facts: The plaintiff maintains a joint bank account with his wife at the defendant bank and has also agreed to online banking transactions (e-banking). On July 31, 2020, at 13:45, the plaintiff was informed of a transfer of €3,000 from his account, which he had not initiated, nor had his wife. At 14:05, he immediately contacted the bank’s customer service line and reported the incident, stating that it was not his action and requesting its cancellation. The bank employee found that the plaintiff had provided his details to a fake website 10 days earlier, and subsequently, the mobile number used for transaction confirmations had been changed. The employee informed him that the money was at the other bank and that they would logically be able to retrieve it, provided it had not already been transferred to a third party's account. Since then, the plaintiff has not seen any return of the amount to his account, and he has made numerous attempts to resolve the issue with the bank, with effort, costs, and distress; however, nothing was achieved, as the money had already entered a third party's account and the defendant denied responsibility for the transfer of the funds.
Facts: The plaintiff maintained a joint account with his wife at a bank and used internet banking services. On July 21, 2020, a third party deceived the plaintiff through phishing (a misleading SMS with a link), obtaining his banking credentials. The third party, using the stolen information, requested a phone number change for receiving OTP (one-time password) and completing electronic transactions. The bank completed the change process based on the correct credentials. On July 31, 2020, a transfer of €3,000 was made from the plaintiff's account to a third party. The plaintiff was immediately informed, called the bank, and reported the fraud; however, the recovery of the funds was not successful. The plaintiff claims that the bank is responsible for inadequate protection of its systems, while the bank asserts that it followed the procedure based on the agreed identification methods. 
The court recognizes that there is responsibility on both sides: the bank for inadequate security and prevention of phishing, and the plaintiff for negligence in safeguarding his personal information, despite the bank's relevant warnings. A critical issue is the exact timing of the completion of the transfer: if the bank was timely notified of the fraud but did not intervene, it may be fully liable. The court requests a resumption of the discussion and further evidence, mainly from the bank, which has access to the relevant technical details.
pipeline_tag: sentence-similarity
library_name: sentence-transformers
metrics: cosine_accuracy@1, cosine_accuracy@3, cosine_accuracy@5, cosine_accuracy@10, cosine_precision@1, cosine_precision@3, cosine_precision@5, cosine_precision@10, cosine_recall@1, cosine_recall@3, cosine_recall@5, cosine_recall@10, cosine_ndcg@10, cosine_mrr@10, cosine_map@100
model-index: name: legal-bert-base-uncased
results: task: type: information-retrieval
name: Information Retrieval
dataset: name: dim 768
type: dim_768
metrics: type: cosine_accuracy@1
value: 0.3560606060606061
name: Cosine Accuracy@1
verified: no, type: cosine_accuracy@3
value: 0.3813131313131313
name: Cosine Accuracy@3
verified: no, type: cosine_accuracy@5
value: 0.43434343434343436
name: Cosine Accuracy@5
verified: no, type: cosine_accuracy@10
value: 0.49747474747474746
name: Cosine Accuracy@10
verified: no, type: cosine_precision@1
value: 0.3560606060606061
name: Cosine Precision@1
verified: no, type: cosine_precision@3
value: 0.3409090909090909
name: Cosine Precision@3
verified: no, type: cosine_precision@5
value: 0.31565656565656564
name: Cosine Precision@5
verified: no, type: cosine_precision@10
value: 0.27222222222222225
name: Cosine Precision@10
verified: no, type: cosine_recall@1
value: 0.08338845128654723
name: Cosine Recall@1
verified: no, type: cosine_recall@3
value: 0.21218012780623383
name: Cosine Recall@3
verified: no, type: cosine_recall@5
value: 0.28051933181101324
name: Cosine Recall@5
verified: no, type: cosine_recall@10
value: 0.39632435240497227
name: Cosine Recall@10
verified: no, type: cosine_ndcg@10
value: 0.42014150424266994
name: Cosine Ndcg@10
verified: no, type: cosine_mrr@10
value: 0.38587461920795246
name: Cosine Mrr@10
verified: no, type: cosine_map@100
value: 0.46701192478698805
name: Cosine Map@100
verified: no, task: type: information-retrieval
name: Information Retrieval
dataset: name: dim 512
type: dim_512
metrics: type: cosine_accuracy@1
value: 0.351010101010101
name: Cosine Accuracy@1
verified: no, type: cosine_accuracy@3
value: 0.3888888888888889
name: Cosine Accuracy@3
verified: no, type: cosine_accuracy@5
value: 0.4393939393939394
name: Cosine Accuracy@5
verified: no, type: cosine_accuracy@10
value: 0.49242424242424243
name: Cosine Accuracy@10
verified: no, type: cosine_precision@1
value: 0.351010101010101
name: Cosine Precision@1
verified: no, type: cosine_precision@3
value: 0.34006734006734
name: Cosine Precision@3
verified: no, type: cosine_precision@5
value: 0.31616161616161614
name: Cosine Precision@5
verified: no, type: cosine_precision@10
value: 0.27474747474747474
name: Cosine Precision@10
verified: no, type: cosine_recall@1
value: 0.0811845209576169
name: Cosine Recall@1
verified: no, type: cosine_recall@3
value: 0.21096571721682325
name: Cosine Recall@3
verified: no, type: cosine_recall@5
value: 0.2782625608042422
name: Cosine Recall@5
verified: no, type: cosine_recall@10
value: 0.3889942981999181
name: Cosine Recall@10
verified: no, type: cosine_ndcg@10
value: 0.41774434112925773
name: Cosine Ndcg@10
verified: no, type: cosine_mrr@10
value: 0.38250360750360746
name: Cosine Mrr@10
verified: no, type: cosine_map@100
value: 0.46582524009522214
name: Cosine Map@100
verified: no, task: type: information-retrieval
name: Information Retrieval
dataset: name: dim 256
type: dim_256
metrics: type: cosine_accuracy@1
value: 0.3434343434343434
name: Cosine Accuracy@1
verified: no, type: cosine_accuracy@3
value: 0.3813131313131313
name: Cosine Accuracy@3
verified: no, type: cosine_accuracy@5
value: 0.4065656565656566
name: Cosine Accuracy@5
verified: no, type: cosine_accuracy@10
value: 0.4823232323232323
name: Cosine Accuracy@10
verified: no, type: cosine_precision@1
value: 0.3434343434343434
name: Cosine Precision@1
verified: no, type: cosine_precision@3
value: 0.3341750841750841
name: Cosine Precision@3
verified: no, type: cosine_precision@5
value: 0.3106060606060606
name: Cosine Precision@5
verified: no, type: cosine_precision@10
value: 0.2691919191919192
name: Cosine Precision@10
verified: no, type: cosine_recall@1
value: 0.07709196999006594
name: Cosine Recall@1
verified: no, type: cosine_recall@3
value: 0.19818817839761774
name: Cosine Recall@3
verified: no, type: cosine_recall@5
value: 0.2633729750813232
name: Cosine Recall@5
verified: no, type: cosine_recall@10
value: 0.3825298521521387
name: Cosine Recall@10
verified: no, type: cosine_ndcg@10
value: 0.40624359869930343
name: Cosine Ndcg@10
verified: no, type: cosine_mrr@10
value: 0.3728455186788519
name: Cosine Mrr@10
verified: no, type: cosine_map@100
value: 0.45498240804974704
name: Cosine Map@100
verified: no, task: type: information-retrieval
name: Information Retrieval
dataset: name: dim 128
type: dim_128
metrics: type: cosine_accuracy@1
value: 0.3434343434343434
name: Cosine Accuracy@1
verified: no, type: cosine_accuracy@3
value: 0.3686868686868687
name: Cosine Accuracy@3
verified: no, type: cosine_accuracy@5
value: 0.39646464646464646
name: Cosine Accuracy@5
verified: no, type: cosine_accuracy@10
value: 0.45707070707070707
name: Cosine Accuracy@10
verified: no, type: cosine_precision@1
value: 0.3434343434343434
name: Cosine Precision@1
verified: no, type: cosine_precision@3
value: 0.3274410774410774
name: Cosine Precision@3
verified: no, type: cosine_precision@5
value: 0.302020202020202
name: Cosine Precision@5
verified: no, type: cosine_precision@10
value: 0.2598484848484849
name: Cosine Precision@10
verified: no, type: cosine_recall@1
value: 0.07661351326160921
name: Cosine Recall@1
verified: no, type: cosine_recall@3
value: 0.1918760158828037
name: Cosine Recall@3
verified: no, type: cosine_recall@5
value: 0.25215259008056984
name: Cosine Recall@5
verified: no, type: cosine_recall@10
value: 0.3587527703094874
name: Cosine Recall@10
verified: no, type: cosine_ndcg@10
value: 0.39179726664623976
name: Cosine Ndcg@10
verified: no, type: cosine_mrr@10
value: 0.3657567740901074
name: Cosine Mrr@10
verified: no, type: cosine_map@100
value: 0.4478819490198904
name: Cosine Map@100
verified: no, task: type: information-retrieval
name: Information Retrieval
dataset: name: dim 64
type: dim_64
metrics: type: cosine_accuracy@1
value: 0.2777777777777778
name: Cosine Accuracy@1
verified: no, type: cosine_accuracy@3
value: 0.29797979797979796
name: Cosine Accuracy@3
verified: no, type: cosine_accuracy@5
value: 0.33585858585858586
name: Cosine Accuracy@5
verified: no, type: cosine_accuracy@10
value: 0.39141414141414144
name: Cosine Accuracy@10
verified: no, type: cosine_precision@1
value: 0.2777777777777778
name: Cosine Precision@1
verified: no, type: cosine_precision@3
value: 0.265993265993266
name: Cosine Precision@3
verified: no, type: cosine_precision@5
value: 0.248989898989899
name: Cosine Precision@5
verified: no, type: cosine_precision@10
value: 0.21212121212121213
name: Cosine Precision@10
verified: no, type: cosine_recall@1
value: 0.061055029539267065
name: Cosine Recall@1
verified: no, type: cosine_recall@3
value: 0.1586017468669595
name: Cosine Recall@3
verified: no, type: cosine_recall@5
value: 0.22049184152294302
name: Cosine Recall@5
verified: no, type: cosine_recall@10
value: 0.3034883649569159
name: Cosine Recall@10
verified: no, type: cosine_ndcg@10
value: 0.3248314052080558
name: Cosine Ndcg@10
verified: no, type: cosine_mrr@10
value: 0.3000260541927209
name: Cosine Mrr@10
verified: no, type: cosine_map@100
value: 0.38153227130259265
name: Cosine Map@100
verified: no
Likes: 0 | All-time downloads: 31
Created: 2025-09-15 22:31:53