[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fPcAdINxK8RjfhPt_IeuzWojnFluw8cyKg4d_RLRqZKE":3},{"article":4,"iocs":43,"watch_terms":44,"solutions":45,"lesson":48},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":20,"category":21,"article_tags":25},"78297181-7c2d-433d-9aa8-0e7eddb93962","AEPD (Spain) - PS\u002F00421\u002F2020","aepd-spain-ps-00421-2020-5f4343","Standardized name and link ← Older revision Revision as of 11:12, 24 July 2026 Line 23: Line 23: |Currency=EUR |Currency=EUR |EU_Law_Name_1=e-Privacy Directive |EU_Law_Name_1=ePrivacy Directive 2002\u002F58\u002FEC |EU_Law_Link_1=https:\u002F\u002Feur-lex.europa.eu\u002Flegal-content\u002FEN\u002FTXT\u002FHTML\u002F?uri=CELEX:32002L0058&from=EN |EU_Law_Link_1=https:\u002F\u002Feur-lex.europa.eu\u002Feli\u002Fdir\u002F2002\u002F58\u002Foj |National_Law_Name_1=Article 21(1) LSSI |National_Law_Name_1=Article 21(1) LSSI","The Spanish Data Protection Agency (AEPD) has fined Banco de Sabadell €5,000 for violating the e-Privacy Directive and the Spanish Information Society Services Act. The bank sent commercial communications to a client who had explicitly opted out of receiving such messages, arguing it was necessary for contract fulfillment. The AEPD rejected this, classifying the communication as marketing and a breach of privacy.","Spain's AEPD fines Banco de Sabadell €5,000 for sending unsolicited commercial communications.","https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=AEPD_(Spain)_-_PS\u002F00421\u002F2020&diff=52461&oldid=38441","https:\u002F\u002Fgdprhub.eu\u002Fimages\u002F5\u002F59\u002FLogoES.jpg","2026-07-24T11:12:51+00:00","2026-07-24T12:00:18.1669+00:00",7,[17],{"name":18,"type":19},"Banco de Sabadell","vendor","d95477d7-eb04-4fad-a2dc-be1428040ce7",{"id":20,"icon":22,"name":23,"slug":24},null,"Privacy Fines","privacy-fines",[26,31,36,41],{"category":27},{"id":28,"icon":22,"name":29,"slug":30},"3f0f8451-91df-4b6c-9a73-ef3b2509b7f1","GDPR","gdpr",{"category":32},{"id":33,"icon":22,"name":34,"slug":35},"53f9c4b6-8bc6-4964-9169-d09e5cd41d72","Compliance","compliance",{"category":37},{"id":38,"icon":22,"name":39,"slug":40},"c5c77cdb-f7d7-4990-9436-c81dcbff1163","Policy","policy",{"category":42},{"id":20,"icon":22,"name":23,"slug":24},[],[18],{"controls":46,"vendors":47},[],[],{"slug":49,"title":50,"body":51,"framework_refs":52,"framework_notes":62},"banco-de-sabadell-fined-for-ignoring-customer-marketing-opt-out","Banco de Sabadell Fined for Ignoring Customer Marketing Opt-Out","Banco de Sabadell sent commercial communications to a customer who had explicitly withdrawn consent, then incorrectly attempted to justify the contact as a contractual necessity. The AEPD rejected this argument, affirming that marketing communications require affirmative consent and cannot be reframed as operational necessity. This case highlights how organisations frequently misclassify marketing activities to circumvent consent obligations, exposing themselves to regulatory penalties. Proper consent lifecycle management — from collection through to honouring withdrawal — is a fundamental requirement under e-Privacy and GDPR frameworks.",[53,54,55,56,57,58,59,60,61],"GDPR Article 6 (Lawfulness of Processing)","GDPR Article 7 (Conditions for Consent)","GDPR Article 21 (Right to Object)","ePrivacy Directive 2002\u002F58\u002FEC Article 13 (Unsolicited Communications)","Spanish LSSI-CE (Information Society Services Act)","NIST SP 800-53 PT-4 (Consent)","NIST SP 800-53 IP-1 (Consent)","CIS Control 3 (Data Protection)","ISO\u002FIEC 27701:2019 (Privacy Information Management)",{}]