Spain

Banco Bilbao Vizcaya Argentaria, S.A.

120,000 €

GDPR enforcement action by Spanish Data Protection Authority (aepd) on 2021-08-25.

Rank · Sector

#78

of 322 in Finance, Insurance and Consulting

Rank · Spain

#92

of 1,075

Rank · All fines

#436

of 3,050

Case details

Authority: Spanish Data Protection Authority (aepd)
Date: 2021-08-25
Controller / Processor: Banco Bilbao Vizcaya Argentaria, S.A.
Sector: Finance, Insurance and Consulting
Quoted Articles: Art. 32 GDPR
Type of violation: Insufficient technical and organisational measures to ensure information security

Summary

The Spanish DPA (AEPD) has imposed a fine on Banco Bilbao Vizcaya Argentaria, S.A.. The reason for this had been a complaint from a person relating to a lack of authentication. Accordingly, only the ID number had to be given as identification when providing information by telephone. This could allow any person to call, provide an ID number, and thus receive the information associated with the ID number without any verification that the caller is actually the ID holder. The DPA considered this to be a failure to implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk posed to the data subjects. The original fine of EUR 200,000 was reduced to EUR 120,000 due to voluntary payment and acknowledgement of guilt.

Open original source Links to the regulator's original publication or another source.