Some ATM machines demand your PIN as the very first step. More privacy-respecting machines let you enter your order details first and PIN entry is the last step. So if the order cannot be filled (e.g. not enough banknotes, not the preferred denominations, no balance inquiry service, printer out of paper, etc), then you can get your card back without having the card read.

When the PIN is demanded 1st, we can only wonder what information is being collected and what is being needlessly sent over the network. Some machines apparently silently check your balance/credit line automatically (if it’s a legit purpose, perhaps it tries to avoid offering an preselected withdrawal amount that is over a limit).

Some ATMs will reject a card instantly, before entering anything. Then they report a bogus error (“card fault”), which would seem to violate the GDPR.

So this is why we need a FOSS app for smartcard readers. Something that will show you what information is available on your bank card without entering your PIN, and then show you what additional information is available using your PIN. Ultimately, it would be useful to know whether to reject ATMs that demand a PIN as a 1st step.