- Enforcing jurisdiction
- Spain · Geography does not establish applicable law.
- Confirmed applicable legislation
- Privacy topics
BANCO BILBAO VIZCAYA ARGENTARIA, S.A. – €800,000 Fine (Spain, 2023)
Privacy enforcement record
This record is classified outside cookie consent. Subject classification does not confirm an applicable law. It is not included in cookie statistics or the Risk Calculator.
Banco Bilbao Vizcaya Argentaria was fined €800,000 for failing to protect a customer's personal data after she lost her handbag containing her bank card. The bank did not block her banking products as requested, allowing unauthorized access. This case highlights the importance of implementing strong data protection measures.
What happened
The bank failed to block a customer's banking products after she reported her lost handbag containing her bank card.
Who was affected
A customer of Banco Bilbao Vizcaya Argentaria was affected by the bank's failure to protect her personal data.
What the authority found
The Spanish data protection authority found that the bank did not implement adequate measures to safeguard personal data, violating GDPR requirements.
Why this matters
This ruling stresses that companies must take data protection seriously and implement effective measures to prevent unauthorized access. It serves as a warning to financial institutions about the consequences of negligence in data security.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Linked-source text retrieved.
Review needed — 5 March 2026.
Processing notes: amount discrepancy.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
The Spanish DPA has fined BANCO BILBAO VIZCAYA ARGENTARIA, S.A. EUR 800,000. A customer had lost her handbag, which also contained her bank card. The individual therefore requested the controller to block all banking products. However, the controller failed to comply, which is why it was then possible for third parties to access the individual's bank products and transfer money under false identities. During its investigation, the DPA found that the controller had failed to implement appropriate technical and organizational measures to prevent such a case and protect personal data.
Related Enforcement Actions (2)
Other enforcement actions involving BANCO BILBAO VIZCAYA ARGENTARIA, S.A. in ES
Fine
€800K
Details
Fine Date
20 October 2023
Authority
Agencia Española de Protección de Datos
Fine Amount
€800,000
Enforcement Tracker ID
ETid-2091
About this data
Cite as: Cookie Fines. BANCO BILBAO VIZCAYA ARGENTARIA, S.A. - Spain (2023). Retrieved from cookiefines.eu
Last updated: