Spain

Banco Bilbao Vizcaya Argentaria, S.A.

5,000,000 €

GDPR enforcement action by Spanish Data Protection Authority (aepd) on 2020-12-11.

Rank · Sector

of 322 in Finance, Insurance and Consulting

Rank · Spain

of 1,075

Rank · All fines

#69

of 3,050

Case details

Authority: Spanish Data Protection Authority (aepd)
Date: 2020-12-11
Controller / Processor: Banco Bilbao Vizcaya Argentaria, S.A.
Sector: Finance, Insurance and Consulting
Quoted Articles: Art. 6 GDPR, Art. 13 GDPR
Type of violation: Insufficient fulfilment of information obligations

Summary

The Spanish DPA (AEPD) fined Banco Bilbao Vizcaya Argentaria, S.A. EUR 5,000,000 for violating Art. 6 GDPR (EUR 3,000,000) and Art. 13 GDPR (EUR 2,000,000).
The bank had not implemented a specific mechanism to obtain the consent of the customers to process their data. Furthermore, it did not use precise terminology in its privacy policy, nor did it provide adequate information about the type of personal data that might be processed. In particular the AEPD notes that the purpose and legal basis for data processing are not sufficiently identifiable in the privacy statement.

Open original source Links to the regulator's original publication or another source.