BBVA – €36,000 Fine (Spain, 2020)

BBVA sent the claimant's personal data to a collection agency. The claimant had no relationship with the debt, as he was no longer the administrator of the company for which the bank was claiming the debt. Even so, the claimant was receiving mail and calls from the company hired by BBVA to claim the debt. BBVA failed to verify the accuracy of the data relating to the claimant and the debt incurred by the debtor company, and therefore the claimant could not request the deletion of his personal data held by BBVA. Is the lack of diligence in checking for accuracy when processing personal data an infringement of Article 5(1)(d) GDPR? The AEPD held that BBVA processed the complainant's personal data in infringement of the principle of accuracy. The AEPD took into account, in determining the amount of a significantly serious infringement, the lack of diligence in the conduct of BBVA and the volume of business of the complainant, and the relationship of its habitual activity in the data processing. BBVA made use of two reductions in the amount of a sanction: voluntary payment (20%) and acknowledgment of responsibility (20%). So they finally paid €36000 after the application of the reductions.