Spain

CAIXABANK, S.A.

5,000,000 €

GDPR enforcement action by Spanish Data Protection Authority (aepd) on 2023-10-26.

Rank · Sector

of 322 in Finance, Insurance and Consulting

Rank · Spain

of 1,071

Rank · All fines

#69

of 3,042

Case details

Authority: Spanish Data Protection Authority (aepd)
Date: 2023-10-26
Controller / Processor: CAIXABANK, S.A.
Sector: Finance, Insurance and Consulting
Quoted Articles: Art. 5 (1) f) GDPR, Art. 25 GDPR, Art. 32 GDPR
Type of violation: Non-compliance with general data processing principles

Summary

The Spanish DPA has imposed a fine of EUR 5 million on CAIXABANK, S.A.. A customer had filed a complaint about having access to a document containing information on a transfer from a third party. The document contained personal data of the third party, such as the name and bank details of the data subject. During its investigation, the DPA found that the controller had failed to implement appropriate technical and organizational measures to protect personal data and prevent such incidents. The DPA also found that the controller had failed to comply with the principle of data protection by design and by default, as it acted reactively rather than proactively in handling the complaint.

Open original source Links to the regulator's original publication or another source.