The Spanish data protection authority ('AEPD') published, on 21 March 2023, its decision in Proceeding No. PS-00482-2022, as issued on 30 January 2023, in which it imposed a fine of €70,000 on Caixabank Payments & Consumer, EFC, EP, S.A.U., for violation of Article 6(1) of the General Data Protection Regulation (Regulation (EU) 2016/679) ('GDPR'), following a complaint from a customer of the company.

Background to the decision

In particular, the AEPD noted that the complainant alleged that Caixabank demanded, through debt collection companies, the payment of a debt that was annulled by a court ruling. Nonetheless, the AEPD outlined that the claimant received an SMS message following the cancellation of their contract with Caixabank, demanding payment of the debt.

Findings of the AEPD

Following its investigation, the AEPD found that, despite evidence of the cancellation of procedures and statements to demonstrate the cancellation of the complainant's contract, Caixabank continued to process the personal data of the complainant, with the same receiving further SMS messages from relevant collection companies. Accordingly, the AEPD found Caixabank to have violated Article 6(1) of the GDPR.

Outcomes

Consequently, the AEPD imposed a fine of €70,000 on Caixabank for violating Article 6(1) of the GDPR.

You can read the decision, only available in Spanish, here.

UPDATE (24 March 2023)

AEPD dismisses CaixaBank's appeal for reconsideration

The AEPD published, on 23 March 2023, its decision in Proceeding No. PS-00482-2022, as issued on 30 January 2023, in which it dismissed Caixabank's appeal, issued on 28 February 2023, for reconsideration, as the same had not provided new facts or legal arguments that would have allowed the reconsideration of the contested decision.

You can read the decision, only available in Spanish, here.