6 million Euro fine against CAIXABANK, S.A.
Violation of the duties to inform and unlawful processing of personal data.

Customers of the bank had been encouraged by the responsible person to accept new data protection provisions which authorised the recipient of the fine to transfer the personal data of the data subjects to all companies within the group of companies belonging to the bank (Grupo CaixaBank). The data subjects were not given the option of not agreeing to this transfer in principle. Instead, if they wanted to object to the transfer of their data, they had to send a letter of objection to each individual company. A customer filed a complaint about this with the Spanish data protection authority.

The bank had previously stated in a statement to the Spanish data protection authority as part of the investigation that, as an adaptation to the GDPR, the consent of customers to the processing of their personal data, which is the basis for the business relationship, would be obtained at the level of the group of companies. Customers will be asked to consent to data analysis and possible promotional activities by the ten companies belonging to the group, which will enable a joint evaluation of information on all products of the group. In this context, the bank emphasised that after the consent of the data subjects at the corporate group level, an objection can be raised at any time for individual companies and that the data protection provisions comply with its information obligations pursuant to Art. 13 DSGVO.

However, the data protection authority concluded that the bank had breached its information obligations pursuant to Art. 13 and 14 of the GDPR, as the information provided to bank customers in various documents within the scope of the data protection provisions was not consistent, contained imprecise terminology and did not provide sufficient information on the type of personal data processed and the type of processing. Similarly, the information on the rights of data subjects and the data protection officer and the contact information of the controller were not provided in a consistent manner.

Furthermore, the authority found that the defendant had processed the data of its customers partly without a legal basis beyond its legitimate interests and that the consent it obtained from the customers did not comply with data protection requirements. Furthermore, inadequacies in the operational process allowed the bank to obtain the consent of the clients. Also as a result, the bank had unlawfully transferred the personal data of its clients to Grupo CaixaBank companies.