[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fuovrx35ppz3pP5U71N55lsTe5TaOo_quHF-1ugzz6Mw":3},{"article":4,"iocs":41,"watch_terms":42,"solutions":43,"lesson":118},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":20,"category":21,"article_tags":25},"15e7d9e4-cf95-41c7-86a9-017af20faa77","AEPD (Spain) - PS-00143-2025","aepd-spain-ps-00143-2025-5dcd95","← Older revision Revision as of 13:12, 8 June 2026 Line 63: Line 63: }} }} The AEPD fined CaixaBank €400,000 after wrongly sending customer complaint documents to third parties and failing to implement [[Article 25 GDPR]] measures. The DPA fined CaixaBank €400,000 after wrongly sending customer complaint documents to third parties and failing to implement [[Article 25 GDPR]] measures. == English Summary == == English Summary ==","Spain's AEPD has fined CaixaBank €400,000 for failing to implement adequate data protection measures. The bank wrongly sent customer complaint documents to third parties and disclosed personal data, including financial and identity information, in two separate incidents. The AEPD found that the bank's complaint-handling process was not sufficiently protected against human error, violating GDPR Article 25.","Spain's AEPD fines CaixaBank €400,000 for GDPR violations.","https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=AEPD_(Spain)_-_PS-00143-2025&diff=51829&oldid=51814","https:\u002F\u002Fgdprhub.eu\u002Fimages\u002F5\u002F59\u002FLogoES.jpg","2026-06-08T13:12:14+00:00","2026-06-08T14:00:11.320282+00:00",7,[17],{"name":18,"type":19},"CaixaBank","vendor","d95477d7-eb04-4fad-a2dc-be1428040ce7",{"id":20,"icon":22,"name":23,"slug":24},null,"Privacy Fines","privacy-fines",[26,31,36],{"category":27},{"id":28,"icon":22,"name":29,"slug":30},"3f0f8451-91df-4b6c-9a73-ef3b2509b7f1","GDPR","gdpr",{"category":32},{"id":33,"icon":22,"name":34,"slug":35},"53f9c4b6-8bc6-4964-9169-d09e5cd41d72","Compliance","compliance",{"category":37},{"id":38,"icon":22,"name":39,"slug":40},"c5c77cdb-f7d7-4990-9436-c81dcbff1163","Policy","policy",[],[18],{"controls":44,"vendors":117},[45,66,92],{"slug":46,"name":47,"problem":48,"products":49},"endpoint-management","Device management (MDM and UEM)","Every company laptop and phone is known, encrypted, locked down and up to date.",[50,58],{"vendor_slug":51,"vendor_name":52,"vendor_logo":53,"product_slug":54,"product_name":55,"url":56,"description":57},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"vendor_slug":59,"vendor_name":60,"vendor_logo":61,"product_slug":62,"product_name":63,"url":64,"description":65},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"slug":67,"name":68,"problem":69,"products":70},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.",[71,76,84],{"vendor_slug":59,"vendor_name":60,"vendor_logo":61,"product_slug":72,"product_name":73,"url":74,"description":75},"purview-dlp","Microsoft Purview Data Loss Prevention","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fdata-security-governance\u002Fmicrosoft-purview-data-security","Data classification and loss prevention across Microsoft 365, endpoints and connected cloud apps.",{"vendor_slug":77,"vendor_name":78,"vendor_logo":79,"product_slug":80,"product_name":81,"url":82,"description":83},"proofpoint","Proofpoint","\u002Fvendor-logos\u002Fproofpoint.png","enterprise-dlp","Proofpoint Enterprise DLP","https:\u002F\u002Fwww.proofpoint.com\u002Fus\u002Fproducts\u002Fdata-loss-prevention","Data loss prevention across email, cloud and endpoints.",{"vendor_slug":85,"vendor_name":86,"vendor_logo":87,"product_slug":88,"product_name":89,"url":90,"description":91},"forcepoint","Forcepoint","\u002Fvendor-logos\u002Fforcepoint.png","forcepoint-dlp","Forcepoint DLP","https:\u002F\u002Fwww.forcepoint.com\u002Fproduct\u002Fdlp-data-loss-prevention","Data loss prevention for endpoints, network, email and cloud applications.",{"slug":93,"name":94,"problem":95,"products":96},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",[97,104,110],{"vendor_slug":98,"vendor_name":99,"vendor_logo":100,"product_slug":93,"product_name":101,"url":102,"description":103},"knowbe4","KnowBe4","\u002Fvendor-logos\u002Fknowbe4.png","KnowBe4 Security Awareness Training","https:\u002F\u002Fwww.knowbe4.com\u002Fproducts\u002Fsecurity-awareness-training","Training library and simulated phishing with reporting.",{"vendor_slug":105,"vendor_name":106,"vendor_logo":107,"product_slug":105,"product_name":106,"url":108,"description":109},"hoxhunt","Hoxhunt","\u002Fvendor-logos\u002Fhoxhunt.png","https:\u002F\u002Fhoxhunt.com\u002F","Adaptive phishing simulations and micro-training, with a focus on reporting.",{"vendor_slug":111,"vendor_name":112,"vendor_logo":113,"product_slug":111,"product_name":114,"url":115,"description":116},"sosafe","SoSafe","\u002Fvendor-logos\u002Fsosafe.png","SoSafe Awareness Platform","https:\u002F\u002Fsosafe-awareness.com\u002F","Behaviour-based awareness training and phishing simulation in many languages.",[],{"slug":119,"title":120,"body":121,"framework_refs":122,"framework_notes":129},"caixabank-fined-400000-for-data-protection-process-failures","CaixaBank Fined €400,000 for Data Protection Process Failures","CaixaBank's complaint-handling process lacked adequate safeguards against human error, resulting in customer personal and financial data being wrongly disclosed to third parties in two separate incidents. The Spanish AEPD determined that the bank violated GDPR Article 25 by failing to implement data protection by design and by default. This case demonstrates that even established financial institutions can face significant penalties when their data handling processes don't adequately prevent accidental disclosures. Organizations must build robust controls into their workflows to protect against human mistakes that could expose sensitive customer information.",[123,124,125,126,127,128],"GDPR Article 25","GDPR Article 32","NIST Privacy Framework","CIS Control 3","CIS Control 13","ISO 27001 A.8.2",{}]