AEPD (Spain) - PS/00259/2020
Spain's AEPD fines Bankia €50,000 for sending commercial communications to a client who objected.
The Spanish Data Protection Agency (AEPD) has fined Bankia €50,000 for sending a client a letter with a commercial message on the envelope, despite the client having previously objected to receiving such communications. The bank's defense that it was not a commercial communication and was based on legitimate interest was rejected by the AEPD, which cited violations of GDPR Article 6(1)(f) and the ePrivacy Directive.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Bankia?
Get an email when a new story names Bankia, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonBankia violated GDPR by sending a client a letter with a commercial message on the envelope after the client had explicitly objected to receiving such communications. The bank's attempt to justify the communication under 'legitimate interest' was rejected, highlighting that legitimate interest cannot override a data subject's clear objection to direct marketing. This case underscores that data processing preferences and opt-out requests must be faithfully recorded and enforced across all communication channels—including physical mail. Failure to honour opt-out requests exposes organisations to regulatory sanctions and erodes customer trust.