UNICAJA BANCO, S.A. – €400,000 Fine (Spain, 2026)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
UNICAJA BANCO, S.A. was fined €400,000 for allowing improper access to its video surveillance footage. This case is significant because it shows that banks must ensure secure access to sensitive data and protect customer privacy.
What happened
A bank was fined for allowing employees to access video surveillance footage using shared login credentials, compromising data security.
Who was affected
Customers of UNICAJA BANCO, S.A. were potentially affected by the lack of secure access to surveillance footage.
What the authority found
The Spanish data protection authority found that the bank did not implement proper access controls for its video surveillance system, violating GDPR requirements.
Why this matters
This case highlights the need for organizations to enforce strict access controls and individual accountability when handling sensitive data, especially in security contexts.
GDPR Articles Cited
View original scraped data
Original data from scraper before AI verification against source document.
National Law Articles
UNICAJA BANCO, S.A. (the controller) is a bank. In 2023, the controller entered into a service provision contract with a private security firm, GRUPO CONTROL EMPRESA DE SEGURIDAD, S.A. (the processor), under which the processor undertook to provide alarm installation and management services for the controller’s offices, buildings and premises, including the operation of alarm control centres and the verification of alarms via video surveillance or CCTV. In that context, the controller operated a video surveillance system connected to a Central Alarm Receiving Centre (CRA) managed by the processor. The CRA staff, composed of ten operators and one coordinator, could access and review recorded CCTV footage, including footage used to verify suspected fraud and identity impersonation cases reported internally by the controller’s Security Department. A data subject brought a formal complaint with the DPA, prompting it to open an investigation. The controller confirmed that access to the video surveillance system was made through a single shared username and password configured by another contractor responsible for the installation and maintenance of the CCTV system. As a result, the employees assigned to the CRA did not use individual credentials when accessing footage. Although access logs were retained for 90 days, those logs would in any event only show the shared account and the IP address of the terminal used, not the identity of the individual operator who had accessed the images. The investigation also showed that the contractual framework between the controller and the processor formally required nominal user accounts, role-based access, and traceability. However, the authority concluded that these requirements had not been effectively implemented in practice. The investigation further noted that the controller’s DPIA and internal documentation already identified the need for formal user registration, periodic review of access rights, and logging of user activity,
Related Enforcement Actions (0)
No other enforcement actions found for UNICAJA BANCO, S.A. in ES
This is the only recorded action for this entity in this jurisdiction.
Details
Fine Date
16 January 2026
Authority
Agencia Española de Protección de Datos
Fine Amount
€400,000
GDPRhub ID
gdprhub-9957About this data
Cite as: Cookie Fines. UNICAJA BANCO, S.A. - Spain (2026). Retrieved from cookiefines.eu
Last updated: