Spain

CAIXABANK, S.A.

408,000 €

GDPR enforcement action by Spanish Data Protection Authority (aepd) on 2026-09-10.

Rank · Sector

#49

of 343 in Finance, Insurance and Consulting

Rank · Spain

#48

of 1,133

Rank · All fines

#282

of 3,267

Case details

Authority: Spanish Data Protection Authority (aepd)
Date: 2026-09-10
Controller / Processor: CAIXABANK, S.A.
Sector: Finance, Insurance and Consulting
Quoted Articles: Art. 25 (1), (2) GDPR, Art. 13 GDPR
Type of violation: Non-compliance with general data processing principles

Summary

The Spanish DPA has imposed a fine of EUR 408,000 on CAIXABANK, S.A. Following the death of a joint account holder, their heirs contacted the controller to arrange the inheritance. As part of this process, the controller obtained a notarised deed regarding the acceptance, allocation and distribution of the inheritance. However, the data subjects considered this to be excessive data collection, as they only wanted to collect the inheritance held with the bank. The AEPD found that the bank's guidance on inheritances instructed heirs to provide the complete deed. However, this was deemed excessive, particularly since the guide did not inform data subjects of the option to partition inheritances using private documents containing only the relevant information.

Open original source Links to the regulator's original publication or another source.