AEPD (Spain) - PS-00143-2025
Spain's AEPD fines CaixaBank €400,000 for GDPR violations.
Spain's AEPD has fined CaixaBank €400,000 for failing to implement adequate data protection measures. The bank wrongly sent customer complaint documents to third parties and disclosed personal data, including financial and identity information, in two separate incidents. The AEPD found that the bank's complaint-handling process was not sufficiently protected against human error, violating GDPR Article 25.
AI summary of the linked source. Not reviewed by an editor. How this works
Run CaixaBank?
Get an email when a new story names CaixaBank, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonCaixaBank's complaint-handling process lacked adequate safeguards against human error, resulting in customer personal and financial data being wrongly disclosed to third parties in two separate incidents. The Spanish AEPD determined that the bank violated GDPR Article 25 by failing to implement data protection by design and by default. This case demonstrates that even established financial institutions can face significant penalties when their data handling processes don't adequately prevent accidental disclosures. Organizations must build robust controls into their workflows to protect against human mistakes that could expose sensitive customer information.
What helps against this
How we list vendors- Device management (MDM and UEM)
Every company laptop and phone is known, encrypted, locked down and up to date.
- Data loss prevention (DLP)
Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.
- Security awareness training and phishing simulation
People recognise and report attacks instead of falling for them.