CAIXABANK, S.A. – €5,000,000 Fine (Spain, 2023)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
CAIXABANK, S.A. was fined €5 million for failing to protect customer data after a document containing sensitive information was accessed by a customer. This is significant because it shows that banks must take strong measures to secure personal data and prevent unauthorized access. Other companies should review their data protection practices to avoid similar penalties.
What happened
CAIXABANK failed to secure a document that contained personal data of a third party, leading to unauthorized access.
Who was affected
Customers whose personal information was included in the document accessed by another customer.
What the authority found
The Spanish DPA determined that CAIXABANK did not implement adequate security measures to protect personal data, violating GDPR requirements.
Why this matters
This ruling highlights the critical need for financial institutions to proactively secure personal data. It sets a precedent for accountability in data protection, urging all companies to strengthen their security practices.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Linked-source text retrieved.
Automated check recorded — 5 March 2026.
Processing notes: articles corrected.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
The Spanish DPA has imposed a fine of EUR 5 million on CAIXABANK, S.A.. A customer had filed a complaint about having access to a document containing information on a transfer from a third party. The document contained personal data of the third party, such as the name and bank details of the data subject. During its investigation, the DPA found that the controller had failed to implement appropriate technical and organizational measures to protect personal data and prevent such incidents. The DPA also found that the controller had failed to comply with the principle of data protection by design and by default, as it acted reactively rather than proactively in handling the complaint.
Related Enforcement Actions (2)
Other enforcement actions involving CAIXABANK, S.A. in ES
Fine
€5.0M
Details
Fine Date
26 October 2023
Authority
Agencia Española de Protección de Datos
Fine Amount
€5,000,000
Enforcement Tracker ID
ETid-2216
About this data
Cite as: Cookie Fines. CAIXABANK, S.A. - Spain (2023). Retrieved from cookiefines.eu
Last updated: