Spain

BANCO BILBAO VIZCAYA ARGENTARIA, S.A.

800,000 €

GDPR enforcement action by Spanish Data Protection Authority (aepd) on 2023-10-20.

Rank · Sector

#37

of 322 in Finance, Insurance and Consulting

Rank · Spain

#34

of 1,075

Rank · All fines

#200

of 3,051

Case details

Authority: Spanish Data Protection Authority (aepd)
Date: 2023-10-20
Controller / Processor: BANCO BILBAO VIZCAYA ARGENTARIA, S.A.
Sector: Finance, Insurance and Consulting
Quoted Articles: Art. 25 GDPR, Art. 32 GDPR
Type of violation: Insufficient technical and organisational measures to ensure information security

Summary

The Spanish DPA has fined BANCO BILBAO VIZCAYA ARGENTARIA, S.A. EUR 800,000. A customer had lost her handbag, which also contained her bank card. The individual therefore requested the controller to block all banking products. However, the controller failed to comply, which is why it was then possible for third parties to access the individual's bank products and transfer money under false identities. During its investigation, the DPA found that the controller had failed to implement appropriate technical and organizational measures to prevent such a case and protect personal data.

Open original source Links to the regulator's original publication or another source.