UNICAJA BANCO, S.A. – €400,000 Fine (Spain, 2026)

UNICAJA BANCO, S.A. (the controller) is a bank. In 2023, the controller entered into a service provision contract with a private security firm, GRUPO CONTROL EMPRESA DE SEGURIDAD, S.A. (the processor), under which the processor undertook to provide alarm installation and management services for the controller’s offices, buildings and premises, including the operation of alarm control centres and the verification of alarms via video surveillance or CCTV. In that context, the controller operated a video surveillance system connected to a Central Alarm Receiving Centre (CRA) managed by the processor. The CRA staff, composed of ten operators and one coordinator, could access and review recorded CCTV footage, including footage used to verify suspected fraud and identity impersonation cases reported internally by the controller’s Security Department. A data subject brought a formal complaint with the DPA, prompting it to open an investigation. The controller confirmed that access to the video surveillance system was made through a single shared username and password configured by another contractor responsible for the installation and maintenance of the CCTV system. As a result, the employees assigned to the CRA did not use individual credentials when accessing footage. Although access logs were retained for 90 days, those logs would in any event only show the shared account and the IP address of the terminal used, not the identity of the individual operator who had accessed the images. The investigation also showed that the contractual framework between the controller and the processor formally required nominal user accounts, role-based access, and traceability. However, the authority concluded that these requirements had not been effectively implemented in practice. The investigation further noted that the controller’s DPIA and internal documentation already identified the need for formal user registration, periodic review of access rights, and logging of user activity, but those controls had not been operationalised in the relevant processing environment. In addition, the AEPD considered that the controller had not provided operational instructions with little specificity on how stored images were to be accessed, reviewed, or extracted in response to internal requests. The internal CRA protocol mainly regulated alarm handling, incidents and communications, but did not lay down detailed rules governing access to stored footage. The DPA held that the controller infringed Article 32 GDPR by failing to implement appropriate technical and organisational measures to ensure the security of the processing of CCTV footage. In particular, the use of a generic shared account for access to surveillance images prevented proper attribution of actions to individual users and undermined access control and traceability in relation to a processing operation involving sensitive security-related footage. The DPA rejected the controller argument that the failure was attributable solely to its processor. It found that, even if contractual clauses required nominal accounts and role-based permissions, the controller remained responsible for ensuring that those measures were actually implemented and effectively supervised. The DPA also stressed that the audits and controls carried out by the controller had not focused on the most critical issue in this case, namely who could access the footage, under which profile, and with what degree of traceability. The DPA fined the controller €500,000 in total for the violation of article 32 GDPR. Pursuant to Law 39/2015, a Spanish law concerning administrative proceedings, the DPA informed the controller that it may make a voluntary payment of the proposed fine and waive their right to appeal. This action reduces the imposed fine by 20%. The controller opted to make a voluntary payment and reduced the fine by 20%, paying the reduced sanction amount of €400,000.