Caixabank, S.A. – €2,000,000 Fine (Spain, 2024)

On 7 December 2022, a data subject filed a complaint with the AEPD against Caixabank (the controller). The controller required new clients to sign a contract for provision of services, which included a clause stating that data subjects consent to their data being requested from the General Treasury of Social Security. For existing clients, the same clause was included in a declaration or modification contract. The provision cited Law 10/2010, a Spanish law on the prevention of money laundering and terrorist financing, stating that it required the collection of such data. For both new and existing clients, the contract did not give an option to refuse consent – instead, consent was pre-established by the clause. 3,026,247 new clients signed the contract, and 3,401,052 existing clients signed the modification contract. The data subject claimed that, after they expressed their disagreement, the controller stated that failure to sign the form with these clauses would result in the bank account being blocked. On 30 January 2023, the AEPD informed the controller of the complaint. In its defense brief, the controller stated that it is required by [https://www.boe.es/buscar/act.php?id=BOE-A-2010-6737 Law 10/2010]. In particular, it pointed to Article 11, which obliges financial institutions to guarantee that they are engaging with professional or business activities of the client. The controller interpreted this to mean that the identification of the client was necessary, as well as the collection of information concerning the client’s professional or business activities. The AEPD concluded that consent was improperly obtained in this case and the controller thus lacked a legal basis for processing. The AEPD proposed a fine of €2,000,000. The controller acknowledged responsibility of the violations and paid a portion of proposed fine; thus, the fine was reduced 40% to €1,200,000. The AEPD acknowledged that [https://www.boe.es/buscar/act.php?id=BOE-A-2010-6737 Law 10/2010] requires banks to verify professional and business activities of its clients. However, it noted that the law does not specify how a bank is to assess this data; instead, the controller decides on the form of verification, and it should do so in a way that complies with data protection regulations. The [https://www.boe.es/diario_boe/txt.php?id=BOE-A-2018-5203 Convention] established between the General Treasury for Social Security and the Spanish Association of Financial Entities, which guides financial institutions on compliance with Law 10/2010, also does not establish an obligation to verify personal data with the General Treasury of Social Security. There was thus no legal obligation requiring the controller to collect its clients’ personal data from the General Treasury of Social Security. However, insofar as this was the method chosen by a controller to comply with Law 10/2010, the AEPD noted that the [https://www.boe.es/diario_boe/txt.php?id=BOE-A-2018-5203 sixth clause of Annex III of the Convention] explicitly requires data subject consent in order for the controller to verify their personal data with the General Treasury of Social Security. The AEPD found that consent was not properly obtained in this case. As a result, the controller lacked a legal basis for processing pursuant to Article 6(1) GDPR. The AEPD emphasized that consent is not free when the data subject cannot refuse consent without suffering any damage, or when the fulfillment of a contract or provision of service is dependent on consent even when it is not necessary for the service. In this case, consent was not free because it was included as a non-negotiable aspect of the controller’s contract. Additionally, the controller failed to obtain specific consent in each case where data was being processed for different purposes -- instead, it combined consent to processing for the provision of banking services with consent to processing of the data subject’s data from the General Treasury of Social Security. Finally, consent was not informed because it was presented as a requirement rather than an option within the contract, and because the clause falsely stated that the controller was obligated to process the personal data under national law. Given these violations, the AEPD resolved to initiate sanction proceedings against the controller and recommended a sanction of € 2,000,000. Pursuant to [https://www.boe.es/buscar/act.php?id=BOE-A-2015-10565 Law 39/2015], a Spanish law concerning administrative proceedings, the AEPD informed the controller that it may acknowledge its responsibility for the alleged violations and/or pay the proposed fine. Each of these actions reduces the imposed fine by 20%. The controller opted to reduce the fine by 40%, both acknowledging its responsibility for the violations and paying the reduced sanction amount of €1,200,000.