CAIXABANK, S.A. – €408,000 Fine (Spain, 2026)

A data subject and other heirs were handling the inheritance of a deceased customer through CaixaBank, S.A., the controller. In the course of the inheritance procedure, the controller obtained a complete notarised deed of acceptance, partition and allocation of the inheritance. The data subject considered that the controller had obtained substantially more personal and financial information than necessary to distribute the funds held with the controller. In particular, the deed contained information concerning the deceased's entire estate and personal and financial information relating to the heirs, including assets unrelated to the controller. The data subject subsequently complained to the controller and asked for the legal basis for requesting the complete deed. The controller replied that it had not required the submission of a complete public deed and claimed that the heirs could have provided only the relevant parts or used a private document. It also stated that its inheritance guidance informed customers of the available alternatives. The data subject lodged a complaint with the DPA. During its investigation, the DPA established that the controller's internal inheritance guide generally instructed heirs to submit a public deed of acceptance of the inheritance. The guide did not adequately inform heirs that the inheritance could instead be partitioned through a private document containing only the information necessary for the distribution of the relevant bank assets. The investigation also concerned whether the controller had complied with its transparency obligations. The controller argued that its general privacy policy and a specific inheritance form provided the information required under Article 13 GDPR. However, it could not demonstrate that the relevant form or equivalent privacy information had actually been provided to the data subject when the personal data were collected. The DPA initially investigated a possible infringement of Article 5(1)(c) GD