Banco Bilbao Vizcaya Argentaria – €120,000 Fine (Spain, 2025)

An individual (data subject) together with his wife requested information from a bank, Banco Bilbao Vizcaya Argentaria (controller), regarding a mortgage loan. It later came to the data subject’s attention that an advisor of the controller had forged his and his wife’s signature on a document entitled “Personal Data Protection Policy and Statement of Economic Activity”. This signature included opting in to the processing of personal data for commercial purposes by both the controller and partner companies, as well as for profiling. The data subject went to a branch of the bank and inquired about this and was informed that this is something that the bank sometimes does in order to “speed up the procedures”. The data subject filed a complaint with the AEPD (Spanish DPA) on 10 March 2023. The DPA found that the controller had processed the data subject’s personal data without a lawful basis, in violation of Article 6(1) GDPR. The DPA reasoned that the falsified signature of the data subject was being attributed to him and that it wrongly indicated he consented to processing of his personal data. In determining an appropriate sanction, the DPA was influenced by the seriousness of the infringement, as well as the four previous infringements committed by the controller in the past year. The DPA initially set the fine at €200,000 but pursuant to Law 39/2015, a Spanish law concerning administrative proceedings, the DPA informed the controller that it may acknowledge its responsibility for the alleged violations and/or make a voluntary payment of the proposed fine. Each of these actions reduces the imposed fine by 20%. The controller opted to reduce the fine by 40%, both acknowledging its responsibility for the violations and paying the reduced sanction amount of €120,000.