[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$foKdWXxSo91JTZDoUfFos2_spFQhcGQjj8PT49DqaB_Q":3},{"article":4,"iocs":43,"watch_terms":44,"solutions":45,"lesson":120},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":20,"category":21,"article_tags":25},"1e770004-97ed-4ee3-8470-962f98b03974","AEPD (Spain) - ps-00028-2025","aepd-spain-ps-00028-2025-fb09bf","← Older revision Revision as of 08:32, 23 September 2026 Line 104: Line 104: }} }} The DPA fined CaixaBank €408,000 for failing to implement data minimisation by design in inheritance procedures and for not providing data subjects with the information required under [[Article 13 GDPR]]. The DPA fined CaixaBank €408,000 for a violation of the data protection by design principle since the bank’s standard process in inheritance cases required heirs to provide more information than necessary. == English Summary == == English Summary ==","Spain's data protection authority (AEPD) has fined CaixaBank €408,000 for violating GDPR principles. The bank was found to have collected more personal and financial information than necessary during inheritance procedures, failing to implement data minimization by design. Additionally, CaixaBank did not adequately demonstrate that it provided data subjects with the required information under Article 13 GDPR.","Spain's AEPD fines CaixaBank €408,000 for GDPR violations in inheritance procedures.","https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=AEPD_(Spain)_-_ps-00028-2025&diff=53176&oldid=53149","https:\u002F\u002Fgdprhub.eu\u002Fimages\u002F5\u002F59\u002FLogoES.jpg","2026-09-23T08:32:03+00:00","2026-09-23T10:00:28.225131+00:00",7,[17],{"name":18,"type":19},"CaixaBank","vendor","c5c77cdb-f7d7-4990-9436-c81dcbff1163",{"id":20,"icon":22,"name":23,"slug":24},null,"Policy","policy",[26,31,36,38],{"category":27},{"id":28,"icon":22,"name":29,"slug":30},"3f0f8451-91df-4b6c-9a73-ef3b2509b7f1","GDPR","gdpr",{"category":32},{"id":33,"icon":22,"name":34,"slug":35},"53f9c4b6-8bc6-4964-9169-d09e5cd41d72","Compliance","compliance",{"category":37},{"id":20,"icon":22,"name":23,"slug":24},{"category":39},{"id":40,"icon":22,"name":41,"slug":42},"d95477d7-eb04-4fad-a2dc-be1428040ce7","Privacy Fines","privacy-fines",[],[18],{"controls":46,"vendors":119},[47,76,102],{"slug":48,"name":49,"problem":50,"products":51},"cloud-security-posture","Cloud security posture management (CSPM and CNAPP)","Misconfigured cloud storage and over-permissive roles get caught before they leak.",[52,60,68],{"vendor_slug":53,"vendor_name":54,"vendor_logo":55,"product_slug":56,"product_name":57,"url":58,"description":59},"orca-security","Orca Security","\u002Fvendor-logos\u002Forca-security.png","orca-cloud-security-platform","Orca Cloud Security Platform","https:\u002F\u002Forca.security\u002Fplatform\u002F","Agentless cloud security platform for posture, vulnerabilities and data exposure.",{"vendor_slug":61,"vendor_name":62,"vendor_logo":63,"product_slug":64,"product_name":65,"url":66,"description":67},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","cortex-cloud","Cortex Cloud","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fcortex\u002Fcloud","Cloud security platform covering posture management and runtime protection.",{"vendor_slug":69,"vendor_name":70,"vendor_logo":71,"product_slug":72,"product_name":73,"url":74,"description":75},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-cloud","Microsoft Defender for Cloud","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fcloud-security\u002Fmicrosoft-defender-cloud","Cloud posture management and workload protection for Azure, AWS and Google Cloud.",{"slug":77,"name":78,"problem":79,"products":80},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.",[81,89,94],{"vendor_slug":82,"vendor_name":83,"vendor_logo":84,"product_slug":85,"product_name":86,"url":87,"description":88},"forcepoint","Forcepoint","\u002Fvendor-logos\u002Fforcepoint.png","forcepoint-dlp","Forcepoint DLP","https:\u002F\u002Fwww.forcepoint.com\u002Fproduct\u002Fdlp-data-loss-prevention","Data loss prevention for endpoints, network, email and cloud applications.",{"vendor_slug":69,"vendor_name":70,"vendor_logo":71,"product_slug":90,"product_name":91,"url":92,"description":93},"purview-dlp","Microsoft Purview Data Loss Prevention","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fdata-security-governance\u002Fmicrosoft-purview-data-security","Data classification and loss prevention across Microsoft 365, endpoints and connected cloud apps.",{"vendor_slug":95,"vendor_name":96,"vendor_logo":97,"product_slug":98,"product_name":99,"url":100,"description":101},"proofpoint","Proofpoint","\u002Fvendor-logos\u002Fproofpoint.png","enterprise-dlp","Proofpoint Enterprise DLP","https:\u002F\u002Fwww.proofpoint.com\u002Fus\u002Fproducts\u002Fdata-loss-prevention","Data loss prevention across email, cloud and endpoints.",{"slug":103,"name":104,"problem":105,"products":106},"compliance-automation","Compliance automation (GRC)","Evidence for NIS2, DORA and ISO 27001 is collected continuously, not in a rush before the audit.",[107,113],{"vendor_slug":108,"vendor_name":109,"vendor_logo":110,"product_slug":108,"product_name":109,"url":111,"description":112},"drata","Drata","\u002Fvendor-logos\u002Fdrata.png","https:\u002F\u002Fdrata.com\u002F","Continuous control monitoring and audit readiness across security frameworks.",{"vendor_slug":114,"vendor_name":115,"vendor_logo":116,"product_slug":114,"product_name":115,"url":117,"description":118},"vanta","Vanta","\u002Fvendor-logos\u002Fvanta.png","https:\u002F\u002Fwww.vanta.com\u002F","Automated evidence collection and continuous monitoring for ISO 27001, SOC 2, NIS2 and other frameworks.",[],{"slug":121,"title":122,"body":123,"framework_refs":124,"framework_notes":134},"caixabank-fined-408k-for-gdpr-data-minimization-and-transparency-failures","CaixaBank Fined €408K for GDPR Data Minimization and Transparency Failures","CaixaBank violated core GDPR principles by collecting excessive personal and financial data during inheritance procedures, breaching the data minimization principle enshrined in Article 5(1)(c) GDPR. The bank also failed to adequately demonstrate compliance with Article 13 transparency obligations, meaning data subjects were not properly informed about how their data was being used. This case highlights that GDPR compliance is not just about preventing breaches — it requires proactively designing processes that limit data collection to what is strictly necessary. Regulators are increasingly scrutinizing whether organizations can demonstrate compliance, not merely claim it. Fines of this magnitude signal that procedural GDPR violations carry significant financial and reputational consequences.",[125,126,127,128,129,130,131,132,133],"GDPR Article 5(1)(c) – Data Minimization","GDPR Article 13 – Information to be provided where personal data are collected from the data subject","GDPR Article 25 – Data Protection by Design and by Default","GDPR Article 5(2) – Accountability Principle","NIST Privacy Framework PR.DS-P1 – Data minimization","NIST SP 800-53 PT-2 – Purpose Specification","NIST SP 800-53 PT-3 – Personally Identifiable Information Processing Purposes","CIS Control 3 – Data Protection","ISO\u002FIEC 27701 – Privacy Information Management",{}]