The National Authority for the Protection of Personal Data ('ANPD') announced, on 14 December 2021, that it had issued, on 24 November 2021, Directorial Resolution No. 3225-2021-JUS / DGTAIPD-DPDP, in which it imposed a fine of PEN 99,246 (approx. €21,611) to Banco Internacional del Perú S.A.A. ('Interbank Perú'), for violations regarding the transfer of customer data to a call center without informing clients.

Background to the case

In particular, the ANPD conducted an audit of the bank in 2018 whereby phone records were inspected for telesales calls to another company. The ANPD undertook A further inspection to verify the compliance of these calls in 2019, after which the ANPD sent an official letter to Interbank Perú asking officials to indicate whether they had the consent of the holders of personal data to collect the data and use it for telemarketing purposes. Interbank Perú provided evidence for all but 114 calls and requested ten business days to provide the remaining evidence, which was subsequently never provided to the ANPD.

Findings of the ANPD

As such the ANPD initiated an administrative procedure sanctioning Interbank Perú for having sent personal the data of their clients to a third party for commercial purposes without the consent of its owners in accordance with Article 13(13.5) of Law No. 29.733 on the Protection of Personal Data 2011 ('the Law') and Article 12 of Supreme Decree No. 003-2013-JUS which Approves the Regulation of Law No. 29733 ('the Regulation'). Furthermore, as a result of the nature of the violation, the ANPD determined this to be a serious infraction in accordance with Article 2(2) of the Regulation.

Outcomes

Furthermore, in a brief sent, on 21 December 2020, Interbank Perú filed a defense that acknowledged its responsibility and presented information on obtaining the consent of its clients. Finally, on the basis of the above, the ANPD concluded that a fine was necessary for a violation so Article 13(13.5) of the Law and Article 12 of the Regulation. Finally, the ANPD outlined, as part of the sanction, Interbank Perú must validly obtain the consent of the remaining customers for the transfer of their personal data and order the discontinuation of the agreement it holds with the third party that it transferred the personal information to. 

You can read the press release and the resolution, both only available in Spanish, here and here.