[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f8-OJEy4KkHueTSTI4BosA6QcOtbeH4NksZHlgnc4PK8":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":23,"status":24,"created_at":25,"published_at":26,"article":27,"tags":31,"podcasts":44,"controls":45},"0d77e640-2afe-4018-8663-3c7486a53d3d","caixabank-fined-408k-for-gdpr-data-minimization-failures-in-inheritance-processes","755b4f51-177c-4d99-9cf5-37e08f3f67e4","CaixaBank Fined €408K for GDPR Data Minimization Failures in Inheritance Processes","CaixaBank violated GDPR by failing to embed data minimization principles into its inheritance procedures by design, collecting more personal data than was necessary for the process. Additionally, the bank did not adequately inform heirs of their data rights, undermining the transparency obligations required under GDPR Articles 13 and 14. This case highlights that GDPR compliance must be actively engineered into business processes — not treated as an afterthought — particularly in sensitive contexts such as handling deceased customers' estates. Regulators are increasingly scrutinizing whether organizations implement 'privacy by design and by default' in operational workflows, not just in technical systems. The financial and reputational consequences underscore that even established institutions face significant penalties for procedural non-compliance.","**Immediate actions:**\n- Audit all data collection points in estate and inheritance procedures to identify fields that exceed what is strictly necessary for the stated purpose.\n- Update heir-facing communications (letters, forms, online portals) to clearly articulate data rights including access, erasure, and objection rights per GDPR Articles 13–14.\n\n**Privacy by Design improvements:**\n- Mandate a Data Protection Impact Assessment (DPIA) for any new or revised customer-facing process involving sensitive personal data, including inheritance workflows.\n- Embed a data minimization review checklist into the process design lifecycle so every new procedure is validated before deployment.\n- Appoint process-level privacy champions within business units to ensure ongoing compliance beyond the DPO's office.\n\n**Governance & Training measures:**\n- Train front-line staff handling inheritance cases on GDPR rights, data minimization obligations, and how to respond to data subject requests.\n- Establish a periodic compliance review cycle (at least annually) for high-risk processes to detect and remediate GDPR gaps proactively.",[12,13,14,15,16,17,18,19,20,21,22],"GDPR Article 5(1)(c) – Data minimisation principle","GDPR Article 13 – Information to be provided where personal data are collected from the data subject","GDPR Article 14 – Information to be provided where personal data have not been obtained from the data subject","GDPR Article 25 – Data protection by design and by default","GDPR Article 83(4) – Administrative fines for infringements","NIST Privacy Framework PR.DS-P1 – Data minimization in system design","NIST SP 800-53 PT-2 – Purpose Specification","NIST SP 800-53 PT-3 – Personally Identifiable Information Processing","CIS Control 3 – Data Protection","ISO\u002FIEC 29101 – Privacy Architecture Framework","ITIL Service Design – Privacy and data governance considerations",{},"published","2026-09-22T14:21:15.995228+00:00","2026-09-22T14:21:15.7+00:00",{"id":7,"url":28,"slug":29,"title":30},"https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=AEPD_(Spain)_-_ps-00028-2025&diff=53149&oldid=53032","aepd-spain-ps-00028-2025-c598a2","AEPD (Spain) - ps-00028-2025",[32,38],{"id":33,"name":34,"slug":35,"description":36,"color":37},"c0dcc566-3654-4d70-8ede-262a198e732f","Regulatory Compliance","regulatory-compliance","GDPR, NIS2, DORA, sector-specific violations","#ec4899",{"id":39,"name":40,"slug":41,"description":42,"color":43},"c8b843a5-d5a7-41d1-8d3b-cabded09d2ef","Data Protection","data-protection","Unencrypted data, missing DLP, poor classification","#3b82f6",[],[46,50],{"slug":47,"name":48,"problem":49},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.",{"slug":51,"name":52,"problem":53},"compliance-automation","Compliance automation (GRC)","Evidence for NIS2, DORA and ISO 27001 is collected continuously, not in a rush before the audit."]