CAIXABANK, S.A. – €408,000 Fine (Spain, 2026)

A data subject and other heirs were handling the inheritance of a deceased customer through CaixaBank, S.A., the controller. In the course of the inheritance procedure, the controller obtained a complete notarised deed of acceptance, partition and allocation of the inheritance. The data subject considered that the controller had obtained substantially more personal and financial information than necessary to distribute the funds held with the controller. In particular, the deed contained information concerning the deceased's entire estate and personal and financial information relating to the heirs, including assets unrelated to the controller. The data subject subsequently complained to the controller and asked for the legal basis for requesting the complete deed. The controller replied that it had not required the submission of a complete public deed and claimed that the heirs could have provided only the relevant parts or used a private document. It also stated that its inheritance guidance informed customers of the available alternatives. The data subject lodged a complaint with the DPA. During its investigation, the DPA established that the controller's internal inheritance guide generally instructed heirs to submit a public deed of acceptance of the inheritance. The guide did not adequately inform heirs that the inheritance could instead be partitioned through a private document containing only the information necessary for the distribution of the relevant bank assets. The investigation also concerned whether the controller had complied with its transparency obligations. The controller argued that its general privacy policy and a specific inheritance form provided the information required under Article 13 GDPR. However, it could not demonstrate that the relevant form or equivalent privacy information had actually been provided to the data subject when the personal data were collected. The DPA initially investigated a possible infringement of Article 5(1)(c) GDPR concerning data minimisation. Following the investigation, it considered that the systemic design of the controller's inheritance procedure was more appropriately assessed under Article 25 GDPR. The DPA also investigated a possible infringement of Article 30 GDPR. During the proceedings, the controller provided the complete version of its record of processing activities and demonstrated that inheritance-related processing was included in it. The DPA found that the controller infringed Article 25 GDPR because its inheritance procedure was not designed in accordance with the principle of data minimisation. The controller's internal process generally contemplated the collection of a complete notarised inheritance deed, although this could contain extensive personal and financial information unrelated to the specific banking assets concerned. The DPA considered that the controller could have relied on documentation limited to the information necessary to establish the heirs' rights over the relevant assets. Since this resulted from the design of the controller's general procedure, the DPA assessed the conduct under Article 25 GDPR rather than Article 5(1)(c) GDPR. The DPA also found an infringement of Article 13 GDPR. The controller could not demonstrate that the data subject had been provided with the required information when the personal data were collected. Its general privacy policy did not clearly cover inheritance-related processing and the specific information form submitted during the investigation was unsigned. The DPA imposed fines of €500,000 for the infringement of Article 25 GDPR and €10,000 for the infringement of Article 13 GDPR. The alleged infringement of Article 30 GDPR was archived after the controller demonstrated that inheritance-related processing was included in its record of processing activities. Following voluntary payment, the total fine of €510,000 was reduced by 20% to €408,000 according to Spanish Administrative Law (39/2015). The DPA also ordered the controller, within six months, to adopt measures ensuring compliance with Article 25 GDPR, provide the information required under Article 13 GDPR to affected data subjects and include inheritance-related processing in its privacy policy.