Spanish Data Protection Authority (AEPD) · 22 October 2024

IBERCAJA BANCO, S.A.

Insufficient legal basis for data processing

Fine€180,000Fine issued

Regulator: Spanish Data Protection Authority (AEPD)
Decided: 22 October 2024
Country: Spain
Sector: Finance, Insurance and Consulting
Regulator’s reference: Not recorded
Fino case number: 2024/ES/036

Export as PDF

What happened

The DPA fined a bank €180,000 for accessing the data of a former customer more than 47 times without any legal basis under Article 6(1) GDPR after the contractual relationship had ended.

Summary from the GDPRhub page for this decision, written by its volunteers, not by Fino. CC BY-NC-SA 4.0.

Rules involved

Art. 6Lawfulness of processing6(1)Read →

Unlawful processing

Sources

The regulator’s decision ↗
CMS Enforcement Tracker ↗
GDPRhub ↗

The facts on this page come from the sources above, as they recorded them. Nothing has been estimated or filled in. Not legal advice.

Spotted a mistake? Write to angelillolorenzo@gmail.com and quote 2024/ES/036.