Bank should have ensured that inaccurate personal data is erased or rectified, data commissioner says.