The Belgian DPA had at least one bank pay a fine for their incompetence: https://gdprhub.eu/index.php?title=APD/GBA_(Belgium)_-_141/2...

Depending on how strongly you feel about this, there's a good chance you'll win if you take your bank to court.