ING Bank Spain – €1,600,000 Fine (Spain, 2025)

The data subject opened a “non-payroll” bank account, one which does not require proof of income, with ING Bank Spain (controller). In 2022, the controller informed her that her account would be reclassified as a “non-account account” if her balance exceeds €30,000 and recommended she open a “non-account account”, different account offering from the bank, and split her balance between the two. In order to open this other account, however, the controller required she provided consent for the controller to contact the General Treasury of the Social Security to verify the origin of funds to be deposited. The controller claimed this was necessary to comply with Spanish money laundering and anti-terrorist financing laws. A clause giving consent for this processing was included in a document containing pre-contractual information, to which the data subject had to click “confirm”. The anti-money laundering law in question, Law 10/2010, requires the verification of origin of funds where prospective clients either present higher than average risks arising from a provision or the bank’s own risk analysis, or, where prospective client’s banking records do not correspond to their declared activity or operating history. On 3 November 2022 the data subject filed a complaint with the AEPD (Spanish DPA). She argued that she falls into neither of the categories envisaged by Law 10/2010 and the controller is using it as an excuse to make the data subject give her consent. The controller argued that consent being sought in this context does not equate to the concept of consent under the GDPR. They noted that they rely on their legal obligation under Article 6(1)(c) GDPR for this processing, and the collection of the consent is to satisfy the envisaged requirement of getting “authorisation” from the prospective account holder, as envisaged in the money laundering law. The controller further argued that the verification of origin of funds by the Treasury is the only meaningful way, given the technologies available, for them to comply with their general obligation to implement fraud prevention methods. Following initiation of the investigation, the controller updated their privacy policy to list their legitimate interest under Article 6(1)(f) GDPR as a basis for the processing. The DPA found that the cited anti-fraud provision did not, contrary to the controller’s claims, impose a general obligation to verify client’s submitted information with the Treasury. It is only where the level of risk is assessed to be sufficiently high where financial institutions are obliged to implement procedures to verify submitted financial activities. The DPA found, therefore, that the controller could thus not rely on Article 6(1)(c) GDPR to legitimise the processing, and would need to have obtained valid consent consistent with Article 4(11) GDPR. The DPA also rejected the controller’s assertion that the term “authorisation” under the money laundering law was different than the consent required under the GDPR. The DPA ruled that the consent collected was invalid and would not suffice to legitimise the processing under Article 6(1)(a) GDPR. The DPA reasoned that in order to create the account, the data subject had to click on the confirm checkbox. There was also no alternative means of verification of funds provided. In support of their conclusion, the DPA referenced the [https://www.edpb.europa.eu/our-work-tools/our-documents/guidelines/guidelines-052020-consent-under-regulation-2016679_en EDPB Guidelines 05/2020 on consent under Regulation 2016/679] which notes that data subjects should be given control and a real choice as to whether they accept or refuse the conditions offered, and that consent should not be included as a non-negotiable part of general terms and conditions. The DPA also held that the controller could not rely on their legitimate interest under Article 6(1)(f) GDPR for this processing activity. Referencing the three requirements for the lawful basis to apply in [https://ec.europa.eu/justice/article-29/documentation/opinion-recommendation/files/2014/wp217_en.pdf Opinion 06/2014 of the Article 29 Working Group], the DPA found that fundamental rights of customer would be unduly affected, and the controller was thus not entitled to rely on their legitimate interest in the circumstances. The DPA also made reference to [https://www.edpb.europa.eu/our-work-tools/our-documents/guidelines/guidelines-052020-consent-under-regulation-2016679_en EDPB Guidelines 05/2020] which states that controllers cannot move from consent to other legal bases and cannot seek to rely on their legitimate interest to retrospectively legitimise the processing activity. The DPA concluded, therefore, that the controller had infringed Article 6(1) GDPR for processing without a lawful basis. In determining the appropriate sanction, the controller was influenced by the controllers high turnover and the broad scope of the processing activity in question. The fine was initially set at €2,000,000 but pursuant to Law 39/2015, a Spanish law concerning administrative proceedings, the DPA informed the controller that it may make a voluntary payment of the proposed fine and waive their right to appeal. This action reduces the imposed fine by 20%. The controller opted to make a voluntary payment and reduced the fine by 20%, paying the reduced sanction amount of €1,600,000.