AEPD (Spain) - PS/00421/2020
Spain's AEPD fines Banco de Sabadell €5,000 for sending unsolicited commercial communications.
The Spanish Data Protection Agency (AEPD) has fined Banco de Sabadell €5,000 for violating the e-Privacy Directive and the Spanish Information Society Services Act. The bank sent commercial communications to a client who had explicitly opted out of receiving such messages, arguing it was necessary for contract fulfillment. The AEPD rejected this, classifying the communication as marketing and a breach of privacy.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Banco de Sabadell?
Get an email when a new story names Banco de Sabadell, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonBanco de Sabadell sent commercial communications to a customer who had explicitly withdrawn consent, then incorrectly attempted to justify the contact as a contractual necessity. The AEPD rejected this argument, affirming that marketing communications require affirmative consent and cannot be reframed as operational necessity. This case highlights how organisations frequently misclassify marketing activities to circumvent consent obligations, exposing themselves to regulatory penalties. Proper consent lifecycle management — from collection through to honouring withdrawal — is a fundamental requirement under e-Privacy and GDPR frameworks.