rego-gdpr5-1c-003

rules/rego/complyedge/data_protection/iban.rego

Citation

Regulation (EU) 2016/679 (GDPR), Article 5(1)(c)

Condition

The text carries an IBAN, in upper or lower case, compact or in groups of four separated by spaces, whose ISO 13616 check digits are valid (mod 97 = 1). A bank account number identifies its holder and is financial personal data. A string with the IBAN shape but wrong check digits does not fire. A word of up to four letters or digits after a grouped IBAN has the shape of one more group, so the check also runs on the IBAN with the trailing groups left off.

Layer 1 detects

two letters, two digits, then two to seven groups of four letters or digits and an optional last group of one to four, with or without a single space between groups, in any case, 15 to 34 characters in all, whose ISO 13616 check digits are valid (mod 97 equals 1) for the whole string or for the string with its trailing space-separated groups left off. It does not check the length a country sets for its IBANs. It matches formats, not purpose: it fires on every such value whatever the task, and it does not judge whether sending the value is necessary for the task (the Article 5(1)(c) test, which this rule does not apply). No model reviews a

Condition type

deterministic (format match plus checksum; no judgment of meaning)

Status in the file

review