Banco Bilbao Vizcaya Argentaria, S.A.

What happened

The Spanish DPA fined BBVA €70,000 for not securely verifying the data subject's identity. A third party who had stolen the data subject's identity able to withdraw money, violating Article 6 and Article 32 GDPR.

Summary from GDPRhub (noyb), written by its volunteers, not by Fino. CC BY-NC-SA 4.0.

Rules involved

• Art. 6Lawfulness of processing6(1)Read →
• Art. 32Security of processing32(1)Read →
• Art. 83General conditions for imposing administrative fines83(4)(a) · 83(5)(a)Read →

• Data security
• Unlawful processing