Support Centre

You have out of 5 free articles left for the month

Signup for a trial to access unlimited content.

Start Trial

Continue reading on DataGuidance with:

Free Member

Limited Articles

Create an account to continue accessing select articles, resources, and guidance notes.

Free Trial

Unlimited Access

Start your free trial to access unlimited articles, resources, guidance notes, and workspaces.

Spain: AEPD fines CaixaBank €70,000 for unlawful processing of personal data

The Spanish data protection authority ('AEPD') published, on 21 March 2023, its decision in Proceeding No. PS-00482-2022, as issued on 30 January 2023, in which it imposed a fine of €70,000 on Caixabank Payments & Consumer, EFC, EP, S.A.U., for violation of Article 6(1) of the General Data Protection Regulation (Regulation (EU) 2016/679) ('GDPR'), following a complaint from a customer of the company.

Background to the decision

In particular, the AEPD noted that the complainant alleged that Caixabank demanded, through debt collection companies, the payment of a debt that was annulled by a court ruling. Nonetheless, the AEPD outlined that the claimant received an SMS message following the cancellation of their contract with Caixabank, demanding payment of the debt.

Findings of the AEPD

Following its investigation, the AEPD found that, despite evidence of the cancellation of procedures and statements to demonstrate the cancellation of the complainant's contract, Caixabank continued to process the personal data of the complainant, with the same receiving further SMS messages from relevant collection companies. Accordingly, the AEPD found Caixabank to have violated Article 6(1) of the GDPR.

Outcomes

Consequently, the AEPD imposed a fine of €70,000 on Caixabank for violating Article 6(1) of the GDPR.

You can read the decision, only available in Spanish, here.

UPDATE (24 March 2023)

AEPD dismisses CaixaBank's appeal for reconsideration

The AEPD published, on 23 March 2023, its decision in Proceeding No. PS-00482-2022, as issued on 30 January 2023, in which it dismissed Caixabank's appeal, issued on 28 February 2023, for reconsideration, as the same had not provided new facts or legal arguments that would have allowed the reconsideration of the contested decision.

You can read the decision, only available in Spanish, here.