Spain

IBERCAJA BANCO, S.A.

180,000 €

GDPR enforcement action by Spanish Data Protection Authority (aepd) on 2024-10-22.

Rank · Sector

#64

of 322 in Finance, Insurance and Consulting

Rank · Spain

#77

of 1,075

Rank · All fines

#383

of 3,050

Case details

Authority: Spanish Data Protection Authority (aepd)
Date: 2024-10-22
Controller / Processor: IBERCAJA BANCO, S.A.
Sector: Finance, Insurance and Consulting
Quoted Articles: Art. 6 (1) GDPR
Type of violation: Insufficient legal basis for data processing

Summary

The Spanish DPA has fined IBERCAJA BANCO, S.A. for unlawfully accessing a customer’s credit file after the termination of their contractual relationship. The DPA concluded that without an existing contractual relationship, the bank had no valid legal basis for the access. The original fine of EUR 300,000 was reduced to EUR 180,000 due to immediate payment and admission of responsibility.

Open original source Links to the regulator's original publication or another source.