- Enforcing jurisdiction
- Spain · Geography does not establish applicable law.
- Confirmed applicable legislation
- Privacy topics
KUTXABANK S.A. – Complaint Upheld (Spain, 2019)
Privacy enforcement record
This record is classified outside cookie consent. Subject classification does not confirm an applicable law. It is not included in cookie statistics or the Risk Calculator.
KUTXABANK S.A. was ordered to allow a client access to their personal data after blocking their account. The Spanish data protection authority ruled that the bank still held the client's data despite the account being blocked. This decision emphasizes that customers have rights to access their information at all times.
What happened
A client complained that KUTXABANK S.A. blocked their account and refused to provide access to their personal data.
Who was affected
The client of KUTXABANK S.A. was affected as they were unable to access their personal information due to the account block.
What the authority found
The authority found that the bank must comply with the client's request for access, as they still held personal data related to the blocked account.
Why this matters
This ruling highlights that customers retain rights to their personal data, even if their accounts are inactive or blocked. Banks and other service providers must ensure they fulfill access requests regardless of account status.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Linked-source text retrieved.
Automated check recorded — 21 March 2026.
Processing notes: national law identified.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
A bank's client complained that they could not exercise their right to access after the bank had blocked his account due to debts. The bank refused to fulfill the request, claiming that it does not process personal data anymore since the account was blocked. Could the controller refuse to answer to a request for access because the requested data is part of a "blocked" account? The AEPD found that as there is an ongoing relationship, the bank still holds personal data. The DPA ordered the bank to fulfill the data subject’s request within the ten working days following the decision. It further ordered the company to inform the AEPD during the same time period on its compliance with the decision. Lastly, it decided that the fact that the controller blocked the account cannot is irrelevant and the controller must comply with the request of access, as required by Article 15 GDPR.
Outcome
Complaint Upheld
A data subject complaint that was upheld by the DPA.
Related Enforcement Actions (0)
No other enforcement actions found for KUTXABANK S.A. in ES
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. KUTXABANK S.A. - Spain (2019). Retrieved from cookiefines.eu
Last updated: