- Enforcing jurisdiction
- Spain · Geography does not establish applicable law.
- Confirmed applicable legislation
- Privacy topics
CAIXABANK, S.A. – €3,500,000 Fine (Spain, 2024)
Privacy enforcement record
This record is classified outside cookie consent. Subject classification does not confirm an applicable law. It is not included in cookie statistics or the Risk Calculator.
CaixaBank was fined €3.5 million for allowing unauthorized access to a joint account on its online platform. A customer's mother accessed the account without permission, showing that the bank failed to protect personal data. This case highlights the importance of strong security measures for customer information.
What happened
CaixaBank allowed an unauthorized person to access a joint account through its online platform.
Who was affected
Customers of CaixaBank, particularly those with joint accounts, were affected by the unauthorized access.
What the authority found
The Spanish DPA found that CaixaBank did not implement adequate measures to protect personal data, violating GDPR principles.
Why this matters
This ruling emphasizes the need for financial institutions to enhance their data protection practices. Other banks should review their security protocols to prevent similar breaches.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Linked-source text retrieved.
Review needed — 5 March 2026.
Processing notes: date discrepancy.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
The Spanish DPA has imposed a fine of EUR 3.5 million on CAIXABANK, S.A. Following a complaint from customers, it was found that the mother of an account holder had access to a joint account via the bank's online platform, even though she was neither the account holder nor an authorized user. The DPA found that CaixaBank had not taken adequate technical and organizational measures to protect personal data. In addition, the principle of data protection by design and by default had been violated.
Related Enforcement Actions (2)
Other enforcement actions involving CAIXABANK, S.A. in ES
Fine
€3.5M
Details
Fine Date
12 December 2024
Authority
Agencia Española de Protección de Datos
Fine Amount
€3,500,000
Enforcement Tracker ID
ETid-2562
About this data
Cite as: Cookie Fines. CAIXABANK, S.A. - Spain (2024). Retrieved from cookiefines.eu
Last updated: