AEPD: CaixaBank requested excessive inheritance documentation from heirs

Case No.: EXP202403125 DECISION TO TERMINATE THE PROCEEDINGS DUE TO VOLUNTARY PAYMENT Regarding the proceedings conducted by the Spanish Data Protection Agency and based on the following BACKGROUND FIRST: On July 9, 2025, the Presidency of the Spanish Data Protection Agency agreed to initiate disciplinary proceedings against CAIXABANK, S.A. (hereinafter, CAIXABANK). Once the decision to initiate proceedings was notified and after analyzing the arguments submitted, on May 8, 2026, the proposed resolution was issued, as transcribed below: 1. Data Processing > Overview […] Definition Management of the operations related to products and services contracted with CaixaBank, which includes handling operational inquiries, managing resulting incidents, and recording and verifying accounting entries for collections and payments related to the products, as well as sending operational communications.”

In response to section 8 of the request: “Verification of the response provided, if applicable, to the complainant,” the respondent states: C/ Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es 11/46 “With regard to this complaint, CaixaBank has been unable to provide a response to the complainant in the same vein as set forth in this letter, as, barring any error, we do not have the complainant’s contact information to send the response. Should this Agency provide us with the contact information of the claimant, CaixaBank will proceed to send the response. We are attaching to this letter the response prepared for sending to the claimant as Annex V.” Annex V includes the following: “Finally, financial institutions are secondarily liable for the payment of Inheritance and Gift Tax; therefore, they are obligated to verify whether this tax has been paid correctly—that is, including all inherited assets and liabilities in the estate, as evidenced by the document of adjudication and partition of the estate.”

In the document “AnexIIIDGT_Cons_vinculante_V160008_2907_RSubsid.pdf” that is attached: “General Directorate of Taxes. DGT Binding Ruling No. V1600-08 of July 29. JUR\2008\327650,” in which the “QUESTION RAISED” is: “Scope of the bank’s subsidiary liability for the decedent’s deposits and procedure for the inquirer and heir to freely dispose of the deposited funds.” At the end of the third page, the document states: “The Inheritance and Gift Tax Regulations, approved by Royal Decree 1629/1991, of November 8 (Official State Gazette of November 16, 1991)—hereinafter, RISD—set forth the regime governing the of banking institutions in Articles 19 and 20 in the following terms: “Article 19. Subsidiary Liable Parties. 1. Banking institutions shall be subsidiarily liable for the payment of the tax, unless the provisions on joint and several liability under the General Tax Law apply: a) In the case of transfers “mortis causa” of deposits, guarantees, certificates of deposit, checking accounts, savings accounts, or special accounts, the financial intermediaries and other entities or persons who have delivered the deposited money and securities or returned the guarantees established.”

applies Art. 19, Art. 20

20. Scope and Termination of Subsidiary Liability. 1. The subsidiary liability referred to in the preceding article shall be limited to the portion of the tax corresponding to the acquisition of the assets giving rise to it, understood as the result of applying to the assessed value of the assets the effective average tax rate, calculated in the manner provided for in Article 46(b) of these Regulations. 2. Where a partial assessment or self-assessment is authorized, the amount thereof, calculated in accordance with the provisions of these Regulations, shall constitute the limit of any subsidiary liability, if it is less than that resulting from the application of the provisions of the preceding paragraph. 3. Payment of the amount of the partial assessment, or of the partial self-assessment carried out in accordance with the provisions of Article 89 of this Regulation, shall extinguish any subsidiary liability that may arise for the entities and individuals referred to in the preceding article arising from the non-payment of the C/ Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es 12/46 tax corresponding to the transfer by inheritance of the assets in question.”

applies Art. 46, Art. 89

In accordance with the provisions set forth above, therefore, in transfers mortis causa, credit institutions that deliver the money or securities deposited with them or return the collateral established therein are secondarily liable for the payment of Inheritance and Gift Tax, although such liability does not extend to the entire tax debt, but only to the portion thereof corresponding to the acquisition of the assets that gave rise to such liability, which shall be the cash or securities deposited and delivered or the collateral established and returned.” THIRD: On July 9, 2025, the Presidency of the Spanish Data Protection Agency Data Protection agreed to initiate disciplinary proceedings against the respondent, pursuant to the provisions of Articles 63 and 64 of Law 39/2015, of October 1, on the Common Administrative Procedure of Public Administrations (hereinafter “LPACAP”), for alleged violations of Article 13 of the GDPR, Article 30 of the GDPR, and Article 5.1.c) of the GDPR, classified, respectively, in Article 83(5)(b) of the GDPR, Article 83(4)(a) of the GDPR, and Article 83(5)(a) of the GDPR, respectively.

applies Art. 83(4)(a), Art. 83(5)(a), Art. 83(5)(b), Art. 5, Art. 13, Art. 30 , Law 39/2015 Art. 63, Law 39/2015 Art. 64

FOURTH: Once the aforementioned decision to initiate proceedings had been served in accordance with the rules established in Law 39/2015, of October 1, on the Common Administrative Procedure for Public Administrations (hereinafter, LPACAP), the respondent filed a written statement of defense in which, in summary, it stated: - Regarding the violation of Article 5.1.c) of the GDPR, that it had not violated data protection regulations because it never strictly required a full notarized deed, but rather a document proving heir status, accepting partial copies as well as private documents; the public or private form is irrelevant for the purposes of the GDPR, and, in any case, a notarized deed is preferable for reasons of legal certainty and data accuracy; it further asserts that this practice is widespread in the sector and that no infringement of a fundamental right has occurred. - With regard to Article 13 of the GDPR, it maintains that the data subject was already aware of the processing because they had requested the probate services and that it was not necessary to provide additional information or information on alternative documentation, invoking Article 13(4). - Finally, regarding Article 30 of the GDPR, it maintains that there is no violation because the processing of probate matters is included in its Record of Processing Activities, arguing that the omission was due to the partial submission of the document and not to an actual failure to record it.

applies Art. 13(4), Art. 5, Art. 13, Art. 30

FIFTH: As recorded in the official document in the case file, CAIXABANK’s total annual turnover was 1,310,563,000 euros, according to the most recent financial year available, corresponding to 2010, obtained through access to the website www.axesor.es. SIXTH: Attached as an appendix is a list of documents on file in the proceedings. 28001 - Madrid 6 sedeagpd.gob.es 13/46 Based on the proceedings conducted in this case and the documentation on file, the following have been established: PROVEN FACTS FIRST: During the processing of the probate proceedings arising from the death of (...), a client of CAIXABANK, the claimant submitted a deed of partition, adjudication, and acceptance of inheritance dated June 6, 2022. Subsequently, on October 27, 2023, the claimant sent an email to the address servicio.cliente@caixabank.com containing the following message, in which the claimant stated that, as a result of the submission of the information mentioned in the previous section, the claimant believed that information regarding the entirety of the estate of A.A.A. and B.B.B.

And, in light of information that came to light later and which supported the sufficiency of the private document signed by the data subjects, he requested an explanation for the request for the information that had been required of them SECOND: On October 31, 2023, in a letter sent by the head of CAIXABANK’s Customer Service at CAIXABANK to “C.C.C.,” the claimant was informed that at no time were the data subjects involved in the inheritance required to provide a public deed of Acceptance and Adjudication of the inheritance. Furthermore, they informed the claimant that the branch issues the corresponding heir’s guide when the probate proceedings begin, and that this guide gives the data subjects the option to provide either a private document or a notarized document. They also indicated that, in this specific case, the agency merely accepted the notarized deed of acceptance and adjudication of the inheritance submitted by the data subjects in the decedent’s estate.

In this regard, while it is true that all the information concerning the deceased’s inventory appears, A.A.A., it is no less true that the data subjects could have provided the relevant portions of the deed, striking from the inventory those assets that did not belong to the bank. THIRD: According to information obtained during the preliminary investigative proceedings conducted as part of this disciplinary proceeding, CaixaBank has established a specific procedure for managing contractual relationships arising from succession mortis causa in those contracts and services with deceased account holders. This process is outlined in the document, “GUIDE FOR MANAGING CAIXABANK PRODUCTS AND SERVICES IN THE PROCESSING OF AN INHERITANCE,” which CaixaBank provides to its customers and which details all the 28001 - Madrid 6 sedeagpd.gob.es 14/46 documents and procedures required for the operational management of those contracts for products and services with a deceased account holder.

Additionally, the aforementioned guide is published and kept up-to-date at all times on the CaixaBank website (Guia_Testamentarias.pdf (caixabank.es)). It is attached to this letter as Annex I. FOURTH: On page 14/21 of the “aforementioned Guide,” the following is stated: “4.1 Acceptance of the Inheritance Only the heirs to the balances of banking products must submit the notarized deed of acceptance of the inheritance. What is it? It is the document that records the acceptance of the inheritance and the allocation of the assets comprising it. It must include all the assets to be distributed and specify the proportions in which they are to be divided. The document must be signed by all heirs. How do you obtain it? This process must be formalized through a notarized deed by visiting a notary. Only the heirs need to sign it; beneficiaries do not need to complete this process. There is a faster and simpler process for estates considered simple and of low value.

Once the process has begun, you will be informed whether it applies to your specific case. Step 4.1 Required Documentation “Example of a Notarized Deed of Acceptance of Inheritance” Below is an image of a sample notarized deed in which the personal data of the parties involved has been redacted. FIFTH: In accordance with the form included in Annex IV to the response to the request for information sent by CAIXABANK to this Agency on July 9, 2024, (Annex_IV_Doc_Cesin_data_Word.pdf): “Contact Information Probate Proceedings In order to keep you informed about your estate settlement case, here is the information you have provided us: - Name: - Tax ID Number: - Phone number: - Email address: Personal Data Protection 28001 - Madrid 6 sedeagpd.gob.es 15/46 Below, we provide information regarding the conditions under which your personal data is processed. If you provide us with the personal data of another person (other heirs or persons entitled to the estate) as part of the request to process the estate, we will assume that you are authorized to do so.

Likewise, you will be responsible for providing them with the following information regarding the processing of their personal data. Controller CaixaBank, S.A. (“CaixaBank”), with Tax ID No. A-08663619 and registered office at c/ Pintor Sorolla, 2- 4, Valencia. Contact information for the Data Protection Officer: www.caixabank.com/delegadoprotecciondedatos Purposes and Legal Basis for Processing Identifying data are necessary to process the estate, and (i) will be processed for that purpose; furthermore, (ii) they will be processed to comply with the required regulatory obligations and (iii) to ensure the security of both your data and our networks and systems. The legal basis for the processing is (i) the fulfillment of your request, (ii) compliance with the regulatory obligations of CaixaBank, and (iii) the legitimate interest in protecting your data and our networks and systems […] Date: Signature of the applicant”.

This document does not appear to be signed by the claimant. SIXTH: The “Record of Processing Activities Regarding the Handling of an Inheritance,” provided by CAIXABANK, lists the processing activities carried out pursuant to Article 6.1.b) of the GDPR—processing necessary for the performance of contractual relationships to which the data subject is a party (in the case at hand, by inheritance): AT0008 – Management of products and services marketed by CaixaBank | Term from Caixabank RAT – AI > 1. Data Processing > Overview […] Definition Management of the operations of products and services contracted with CaixaBank, which includes handling operational inquiries, managing related incidents, recording and verifying accounting entries for collections and payments related to the products, and sending operational communications.” As of August 1, 2025, in the statements accompanying the initial agreement, this complete document is provided, in which the “Responsible Area” includes the “Estate Administration Service,” with “CaixaBank Operational Services (CoPS)” designated as the processor.

applies Art. 6

SEVENTH: In accordance with the privacy policy published on its website on June 30, 2022: C/ Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es 16/46 “6.2. PROCESSING NECESSARY FOR THE PERFORMANCE OF CONTRACTUAL RELATIONSHIPS The legal basis for this data processing is that it is necessary to manage the contracts you request or to which you are a party, or to implement, if you so request, pre-contractual measures, as established in Art. 6.1.b) of the General Data Protection Regulation (GDPR). Therefore, this processing is necessary for you to establish and maintain contractual relationships with us. If you object to this processing, we would terminate those relationships, or we would be unable to establish them if we have not yet done so. The processing operations necessary for the performance of the contractual relationships are listed below, numbered from (A) to (C). For each of these, we will indicate: a description of the purpose (Purpose), the type of data processed (Type of Data Processed), if applicable, information on the use of profiling (Use of Profiles), other necessary information regarding the processing (Other Relevant Information), and whether or not the processing is carried out under a joint controller arrangement with other enterprises in the CaixaBank Group (Joint Controllers/Controller).

applies Art. 6

A. Formalization, Maintenance, and Execution of Contractual Relationships Purpose: The purpose of this data processing is to formalize and maintain the Contractual Relationships established between you and us, including the processing of your requests or instructions, pre-contractual procedures ( pre-contractual relationships), and the implementation of measures to ensure compliance with the contracts you have with us and, where applicable, the management of debt collection. This data processing involves collecting the information necessary to establish the relationship or process the request, assessing the suitability of the contract, and processing the information necessary for the proper maintenance and performance of the contracts. The processing activities carried out in the formalization, maintenance, and execution of the Contractual Relationships are: o Collection and recording of the data and documents necessary for contracting the requested products o Formalizing the signing of contracts for products and services o Managing the operations related to the products and services you have contracted with us, which includes addressing your operational inquiries, managing any resulting issues, and recording and verifying the accounting entries for product collections and payments, and the sending of operational communications o Taking steps to resolve any non-payments that may occur, which includes: early debt collection management; notification, where appropriate, to external agencies to carry out collection actions; reporting, where appropriate, of data to credit reporting systems; the filing, appropriate cases, filing and tracking of legal claims, the identification and tracking of insolvency proceedings, and the review and assessment 28001 - Madrid 6 sedeagpd.gob.es 17/46 of in-kind settlements or proceedings subject to the Code of Good Practices under Royal Decree-Law 6/2012, of March 9, on urgent measures to protect insolvent mortgage debtors, and the review and evaluation of the sale of portfolios.”

At no point—neither in section 6.2 nor in the rest of the document—is there any reference to “data relating to estates or contractual management mortis causa.” EIGHTH: According to the Bank of Spain’s 2022 Complaints Service Report, in Section 10.1 “Inheritance Proceedings” (https://www.bde.es/f/webbe/Secciones/Publicaciones/PublicacionesAnuales/Memoria ServicioReclamaciones/22/MSR2022.pdf), the documents to be submitted for the administration of banking products in the event of probate proceedings, for the purpose of verifying the lawfulness and scope of the right of inheritance by the party invoking it, are as follows: “Without prejudice to the heirs’ right to information regarding the deceased’s accounts as of the date of death, in the interest of the due diligence required of them, in order to provide such information, financial institutions must ensure that Those who approach them requesting information are in fact heirs.

To substantiate the inheritance rights of the person requesting information about the accounts held by the decedent, institutions typically require the data subjects to provide: — The death certificate of their client, to prove the fact of death. — A certificate from the Registry of Last Wills and Testaments, which is the in which wills are registered, thereby certifying that the will provided is the last valid will executed by the decedent—in the case of a testate succession—or the absence of a will—in the case of an intestate succession. — A certified copy of the last will and testament or, failing that—when the decedent has died intestate—the declaration of intestate heirs, to which the CSE—in accordance with Regulation (EU) No. 650/2012 of the European Parliament and the Council. Furthermore, in the case of the declaration of heirs by intestate succession, it should be noted that the document submitted to financial institutions must include the certificate of conclusion of the declaration of heirs by intestate succession.”

In short, a title of succession is required to prove the status of heir. […] Proof of property rights arising from the inheritance: Document of Acceptance and Partition of the Estate. Public deed or private document, as applicable. “ (…) “Methods of estate partition: a) Testamentary partition is that which is carried out by the decedent himself or herself in his or her will” (…) b) In the absence of a testamentary partition, the heirs must proceed by mutual agreement C/ Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es 18/46 to formalize the document of acceptance, partition, and allocation—that is, conventional partition, which is the most common scenario in practice. Regarding this type of partition, it should be noted that it may be formalized either in a notarial deed or in a private document, provided that, in the latter case, it is signed by all the heirs or their representatives and the signatures are authenticated through the appropriate notarial procedure.

Consequently, in the recitals, this Department has considered it contrary to best practices for entities to require that the acceptance and partition of the estate be formalized in a public document, even in cases where real property is included in the estate.” (…) NINTH: In accordance with Articles 998 and 999 of the Civil Code, “An inheritance may be accepted purely and simply or subject to inventory.” “Pure and simple acceptance may be express or tacit. Express acceptance is that which is made in a public or private document.” (…) LEGAL GROUNDS I Jurisdiction In accordance with the powers granted by Article 58.2 of Regulation (EU) 2016/679 (General Data Protection Regulation, hereinafter GDPR) grants to each supervisory authority, and in accordance with Articles 47, 48.1, 64.2, and 68.1 of Organic Law 3/2018, of December 5, on the Data Protection of Personal Data and the Guarantee of Digital Rights (hereinafter LOPDGDD), the Presidency of the Spanish Data Protection Agency has jurisdiction to resolve this proceeding.

applies Art. 58 , Civil Code Art. 998, Civil Code Art. 999, Law 3/2018 Art. 47

II Preliminary Issues Article 4(1) of the GDPR defines “personal data” as: “any information relating to an identified or identifiable natural person (‘the data subject’); an identifiable natural person is one who can be identified, can be determined, directly or indirectly, in particular by reference to an identifier, such as a name, an identification number, location data, an online identifier, or one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that person; Article 4(2) of the GDPR defines “processing” as: “any operation or set of operations performed on personal data or sets of personal data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination, or 28001 - Madrid 6 sedeagpd.gob.es 19/46 any other form of making available, alignment or interconnection, restriction, erasure, or destruction.”

applies Art. 4(1), Art. 4(2)

For its part, article 4(7) of the GDPR defines the “controller” or “controller” as: “the natural or legal person, public authority, agency, or other body which, alone or jointly with others, determines the purposes and means of the processing; if Union or Member State law determines the purposes and means of the processing, the controller or the specific criteria for its appointment may be established by Union or Member State law.” In turn, Article 4(8) of the GDPR defines the “processor” or “data processor” as “a natural or legal person, public authority, agency, or other body that performs personal data processing on behalf of the controller.” In the present case, in accordance with the provisions of Article 4(1) and (2) of the GDPR, it is established that personal data processing is taking place, since CAIXABANK performs, among other things, the processing of personal data for natural persons, including: name, tax identification number (NIF), telephone number, email address, and data relating to probate matters or contractual administration mortis causa.

applies Art. 4(1), Art. 4(2), Art. 4(7), Art. 4(8)

CAIXABANK carries out this activity in its capacity as the controller, since it is the entity that determines the purposes and means of such activity, pursuant to Article 4.7 of the GDPR. III Response to the Objections to the Notice of Proceedings In response to the objections filed by the respondent, the following should be noted: “FIRST.— THE ALLEGED VIOLATION OF THE PRINCIPLE OF DATA MINIMIZATION” CAIXABANK maintains that it has not violated the principle of data minimisation because it never necessarily required a complete public deed—partial copies are permitted—and that the form (public or private) is irrelevant for data protection purposes; furthermore, in any case, a public deed guarantees greater accuracy and legal certainty. It adds that the practice is widespread in the sector and that there has been no infringement of the claimant’s fundamental right. In response, we must recall that a violation of the principle of data minimisation occurs when data is requested that is not “adequate, relevant, and limited to what is necessary in relation to the purposes for which it is processed”—in this case, for the administration of a bank estate settlement, which requires proof of heir status and the allocation of certain banking products, but not necessarily access to the entirety of the heirs’ financial and personal assets as set forth in a complete notarial deed of acceptance and partition of the estate.

applies Art. 4

Deeds of inheritance allocation contain detailed information on the entire estate 28001 - Madrid 6 sedeagpd.gob.es 20/46 estate, asset valuations, and information on all heirs, which may exceed what is strictly necessary for subrogation in specific banking products. The fact that CAIXABANK asserts that it may occasionally accept partial copies does not mitigate the violation if its internal procedure, established in the “GUIDE FOR MANAGING CAIXABANK PRODUCTS AND SERVICES IN THE PROCESSING OF AN INHERITANCE,” establishes the submission of the complete document as a general rule. Nor can the present case constitute evidence that the option to submit a partial copy of the inheritance award document was offered, since CAIXABANK does not demonstrate that it offered the claimant the possibility of providing a partial copy of the deed of partition and award of the inheritance. Nor does it show that, upon submission of a complete copy, CAIXABANK rejected it or provided information to that effect, indicating that the customer was submitting more information than legally required for the process.

With regard to the greater legal certainty of the data included in a notarized deed, aside from the fact that this contradicts CAIXABANK’s own practice of applying more restrictive standards to other situations, this circumstance does not justify access to categories of data that are not essential for the specific purpose. Furthermore, what the complaining party was seeking in its complaint to CAIXABANK was not simply to provide a private document detailing the division of the entire estate, but rather “a private document signed by all interested parties, stating the distribution they have decided upon for the balance in the deceased’s accounts”—that is, a document signed by the heirs and containing the information necessary for the administration of the estate regarding the CAIXABANK accounts held by the decedent. Finally, the absence of material harm to the claimant cannot be accepted as an argument to refute that the violation has occurred.

Indeed, according to established case law, the mere loss of access to personal data concerning the data subject—as in this case, since it involves regarding property in which the individual holds the status of heir—implies a violation of their right to data protection. In short, let us recall the words of the Constitutional Court in its Judgement 292/2000, of November 30, to the effect that “the content of the fundamental right to data protection consists of the power to dispose of and control personal data, which empowers the individual to decide which of those data to provide to a third party—whether the State or a private individual, and which data that third party may collect, and which also allows the individual to know who possesses that personal data and for what purpose, with the ability to object to such possession or use. These powers of disposition and control over personal data, which constitute part of the content of the fundamental right to data protection, are legally embodied in the right to consent to the collection, acquisition, and access to personal data, its subsequent storage and processing, as well as its possible use or uses, by a third party, whether the State or a private individual.

And that right to consent to the disclosure and processing—whether computerized or not—of personal data requires, as indispensable complements, on the one hand, the right to know at all times who possesses that personal data and for what purpose it is being used, and, on the other hand, the ability to object to such possession and uses.” Along the same lines, the CJEU ruling of September 4, 2023, in Case C- 655/23, determines that the mere loss of control over one’s own data 28001 - Madrid 6 sedeagpd.gob.es 21/46 by data subjects as a result of a violation of the GDPR, even if no specific misuse of the data in question has occurred, may be sufficient to cause “non-pecuniary damage”: “59 Second, as the European Commission has pointed out in its written observations, certain situations, such as those at issue in the main proceedings, relating to “damage to reputation” resulting from a personal data breach or a “loss of control” over such data are expressly included among the examples of possible damages listed in recitals 75 and 85 of the GDPR.

In particular, the Court of Justice of the European Union has emphasized that from the of “damages” or “harm” that data subjects may suffer, as set forth in the first sentence of Recital 85 of the GDPR, it follows that the EU legislature intended to include within these two concepts, in particular, the mere “loss of control” over those data subjects’ own personal data as a result of an infringement of that Regulation, even if there has been no specific misuse of the data in question. Such a loss of control may be sufficient to cause “non-pecuniary damage” within the meaning of Article 82, paragraph 1, of that Regulation, provided that the data subject demonstrates that he or she has in fact suffered such damage, however minimal, without the concept of “non-pecuniary damage” require proof of the existence of additional tangible negative consequences (see, in this regard, the judgement of October 4, 2024, Agentsia po vpisvaniyata, C-200/23, EU:C:2024:827, paragraphs 145, 150, and 156, and the case law cited therein).”

applies Art. 82

CAIXABANK also points out that the Bank of Spain circular cited by the AEPD as having been breached dates from 2025, while the proceedings in question took place in 2022. In this regard, it should be noted that the respondent is mistaken in this assertion, since what is dated 2025 is the document incorporating the information indicated by the Bank of Spain regarding the processing of probate matters. For all of the foregoing reasons, this argument is dismissed. “SECOND.—INFORMATION TO THE DATA SUBJECT” CAIXABANK asserts that there was no violation of Article 13 of the GDPR because the data subject himself requested the processing of the estate and was fully aware of the processing of his data. It invokes Article 13(4) of the GDPR, pursuant to which it is not necessary to provide the information when the data subject already has it, and further maintains that there is no obligation to inform the data subject of the possibility of submitting a private document.

applies Art. 13(4), Art. 13

In this regard, it should be noted that a general understanding of the purpose of the processing does not constitute possession of the complete information required by Article 13 of the GDPR. This provision requires that the data subject be informed, at the time of data collection, of the specific legal basis for the processing, the recipients, the retention periods, storage, their rights, the possibility of lodging a complaint with the supervisory authority, the identity of the data protection officer, and, where applicable, international transfers . Article 13(4) of the GDPR applies only when the data subject is already aware of all these details, not merely because they know that a 28001 - Madrid 6 sedeagpd.gob.es 22/46 inheritance: “The provisions of paragraphs 1, 2, and 3 shall not apply when and to the extent that the data subject already has the information.” Furthermore, the mere existence of a privacy policy published on the website does not in itself satisfy the duty to inform unless it is demonstrated that it was actually provided or made available to the claimant in a clear and accessible manner at the time the data was collected.

applies Art. 13(4), Art. 13

And there is no documentary evidence that such information was effectively provided, since CAIXABANK has submitted an informational template (a document named “Anexo_IV_Doc_Cesin_datos_Word.pdf”) that was left blank and unsigned by the claimant, intended for informational purposes regarding data processing and information on the handling of the inheritance proceedings. On the other hand, the possible absence of an obligation to provide information regarding the various civil remedies provided for by law does not eliminate the requirement to fully comply with Article 13 of the GDPR with respect to the processing actually carried out. Similarly, the reference in Art 13(4) to the fact that the information in the preceding paragraphs need not be provided to the extent that the data subject already has the information is, logically, based on the premise that it can be demonstrated that the data subject possesses the information.

applies Art. 13

And all of this is intended to avoid repeatedly providing information that is already available. This is a circumstance which, as we have pointed out, has not been established in the case at hand. Finally, the argument that the purpose of collecting such information is solely the processing of the probate is not negated by the fact that the data subject—whose data is contained in the documentation provided—must have information regarding the processing. This is a basic principle of transparency that provides safeguards for the processing of personal data that is carried out. Its absence, consequently, causes harm to the data subject whose data is being processed. For all of the foregoing reasons, this argument is dismissed. “THIRD.— THE RECORD OF PROCESSING ACTIVITIES” Regarding the Record of Processing Activities, CAIXABANK maintains that a clerical error occurred, as it only partially provided the content of the record, and that the processing related to probate matters is indeed included under the general heading of product and service management, and it is now providing the complete content.

In light of CAIXABANK’s statements and the fact that it has been established that the information contained in the RAT complies with the provisions of Article 30 of the GDPR, this argument must be accepted, and the case regarding the violation relating to this provision should be dismissed. IV Breach of obligation: violation of Article 25 of the GDPR 28001 - Madrid 6 sedeagpd.gob.es 23/46 Compliance with data protection by design and by default—obligations imposed by the GDPR—plays a crucial role in promoting privacy and data protection in society. Article 25 of the GDPR, regarding Data protection by design and by default, provides as follows: “1. Taking into account the state of the art, the cost of implementation, and the nature, scope, context, and purpose of the processing, as well as the risks of varying likelihood and severity that the processing poses to the rights and freedoms of natural persons, the controller shall implement, both at the time of determining the means of processing and at the time during the processing itself, appropriate technical and organizational measures, such as pseudonymisation, designed to effectively implement data protection principles, such as data minimisation, and to incorporate the necessary safeguards into the processing, in order to meet the requirements of this Regulation and to protect the data subject rights. 2.

applies Art. 25, Art. 30

The controller shall implement appropriate technical and organizational measures to ensure that, by default, only personal data that is necessary for each of the specific purposes of the processing is processed. This obligation applies to the amount of personal data collected, the scope of its processing, its storage period, and its accessibility. Such measures shall ensure, in particular, that, by default, personal data is not accessible to an indeterminate number of natural persons an individual, to an indeterminate number of natural persons. 3. A certification mechanism approved in accordance with Article 42 may be used as evidence of compliance with the obligations set forth in paragraphs 1 and 2 of this article.” In line with these provisions, Recital 78 of the GDPR states: “The protection of the rights and freedoms of natural persons with regard to the processing of personal data requires the adoption of appropriate technical and organizational measures to ensure compliance with the purpose of data protection requirements of this Regulation.

applies Art. 42

In order to be able to demonstrate compliance with this Regulation, the controller must adopt internal policies and implement measures that comply, in particular, with the principles of data protection by design and by default. Such measures could include, among others, minimizing the processing of personal data, pseudonymisation of personal data as soon as possible, ensuring transparency regarding the functions and processing of , enabling data subjects to monitor data processing and allowing the controller to create and improve security measures. When developing, designing, selecting, and using applications, services, and products that are based on the processing of personal data or that process personales para cumplir su función, productores de tales productos products, services, and applications to take into account the right to data protection when developing and designing these products, services, and applications, and to ensure, with due regard to the state of the art, that controllers and processors are in a position to fulfill their data protection obligations.

The principles of data protection by design and by default must also be taken into account in the context of public procurement.” The principle of privacy by design reflects a shift from reactivity to proactivity and is a direct manifestation of the risk-based approach mandated by the GDPR. As part of this accountability, this principle must be considered from the very earliest stages of planning data processing: the controller must, from the moment a potential processing operation involving personal data is designed and planned, identify all the elements that constitute the processing, in order to effectively apply the principles of data protection, by integrating the necessary safeguards into the processing with the ultimate goal of, in compliance with the provisions of the GDPR, protecting data subject rights. Thus, with regard to the risks that may be present in the processing, the controller shall conduct an analysis and detection of risks throughout the entire data processing cycle, with the primary and ultimate purpose of protecting the rights and freedoms of data subjects, and not only when the processing actually takes place.

This is set forth in the EDPB’s Guidelines 4/2019 on Article 25, “Data Protection by Design and by Default,” adopted on October 20, 2020. The aforementioned Guidelines state in this regard that: “35. The ‘point in time when the means of processing are determined’ refers to the period during which the controller is deciding how the processing will be carried out and how it will take place, as well as the mechanisms that will be used to carry out such processing. In the process of making such decisions, the controller must assess the appropriate measures and safeguards to effectively implement the principles and rights of data subjects, and take into account factors such as risks, the state of the art, and the cost of implementation, as well as the nature, scope, context, and purpose. This includes the time of acquisition and implementation of software, hardware, and data processing services. 36.

applies Art. 25

Taking the PDDD into account from the outset is crucial for the proper application of the principles and for the protection of data subject rights. Furthermore, from a cost-effectiveness standpoint, it is also in the best interest of controllers to take the PDDD into account as early as possible, since it could later prove difficult and costly to make changes to plans that have already been formulated and processing operations that have already been designed.” To this end, when designing the processing, one must rely on the principles set forth in Article 5 of the GDPR, which will serve to assess effective compliance with the GDPR. 28001 - Madrid 6 sedeagpd.gob.es 25/46 Thus, the aforementioned EDPB Guidelines 4/2019 stipulate that to effectively implement the DPDD, controllers must apply the principles of transparency, lawfulness, fairness, purpose limitation, data minimisation, accuracy, storage limitation, integrity and confidentiality, and proactive accountability.

applies Art. 5

These principles are set forth in Article 5 and Recital 39 of the GDPR. The AEPD’s Privacy by Design Guide states that “Privacy by Design (hereinafter, PbD) involves using a risk management-oriented approach and proactive accountability to establish strategies that incorporate privacy protection throughout the entire lifecycle of the object (whether it is a system, a hardware or software product, a service, or a process). The lifecycle of the object refers to all the stages it goes through, from its conception to its decommissioning, including the phases of development, deployment, operation, maintenance, and decommissioning.” The Guide states that “Privacy must be an integral and inseparable part of the organization’s systems, applications, products, and services, as well as its business practices and processes. It is not an additional layer or module added to something that already exists, but rather must be integrated into the set of non-functional requirements from the very moment they are conceived and designed (…) Privacy is built into the design, before the system is operational, and must be guaranteed throughout the entire data lifecycle.”

applies Art. 5

A true culture of data protection within the organization involves the ability to document all decisions made with a comprehensive approach to privacy, thereby demonstrating compliance with the GDPR in this regard as well. The aim is to protect individuals from the risks posed by the processing of personal data to their rights and freedoms. These risks may vary in severity and probability and may result in physical, material, or non-material harm, as well as tangible or intangible consequences. In the case at hand, the investigation of this disciplinary proceeding has revealed that the procedure designed by CAIXABANK for processing estate settlements has failed to take into account the requirements of the regulations regarding personal data and, more specifically, the requirement that only the personal data strictly necessary to achieve the intended purpose of the processing be processed.

In this case, CAIXABANK obtained from the heirs—among whom the claimant—the notarized deed of partition, adjudication, and acceptance of inheritance (hereinafter, the “deed of acceptance of inheritance”), for the purpose of processing the estate (…), as set forth in its internal instructions for any procedures arising from the death of a CAIXABANK customer, which is disproportionate, since the design of this procedure has not been in accordance with data protection regulations and has resulted in CAIXABANK has accessed private information about the decedent and his or her heirs that was not necessary for the intended processing. Thus, the requirement for a deed of acceptance of inheritance is set forth in the “Guide for Managing CaixaBank Products and Services in the Processing of an Inheritance” issued by CAIXABANK, which states that, to accept the inheritance, one must “submit the public deed of acceptance of the inheritance. […] There is a faster and simpler process for probate cases considered simple and involving small amounts.

Once the process has begun, you will be informed whether it applies to your specific case” (p. 64 of the case file). In this regard, it should be noted that, both in the information regarding inheritances on the Bank of Spain’s website and in that institution’s “2022 Complaints Report” (p. 562 of the file), specifically in the section titled “Division and Allocation of Assets,” the following is stated: “The partition of the estate can be carried out in two ways: • Through a will. When the deceased expressly indicates in the will to whom the various inherited assets are to be awarded. Therefore, in order for credit institutions to carry out the corresponding allocation, they will have to analyze the contents of the will. • Through a contractual partition. When the distribution of the estate and the allocation of the assets are carried out by agreement among the heirs themselves. A mutual partition agreement may be formalized either before a notary or in a private document.

Financial institutions, therefore, cannot require that this partition be carried out by means of a notarial document (…)” and this Report adds: “Consequently, this Department has considered it contrary to good practices for financial institutions to require that the acceptance and partition of the inheritance be formalized in a public document, even in cases where real property is included in the inheritance.” (…). Consequently, the requirement of a deed of acceptance, division, and distribution of the estate as stipulated by CAIXABANK, without additionally informing the data subjects of the possibility of submitting a private document limited to the factual circumstances necessary for the processing of the probate, constitutes a violation of data protection regulations. It should be noted that CAIXABANK’s actions reflect a systematic practice established by the institution for the management of all probate matters, as is evident from its own “Guide for Managing CaixaBank Products and Services in the Administration of an Estate.”

This guide generally stipulates the requirement to submit a public deed of acceptance, partition, and distribution of the estate for the processing of any matter related to the death of the customer. This general provision reflects the nature of the practice, which constitutes a violation of Article 25 of the GDPR cited above. In conclusion, it is considered that the established facts constitute an infraction attributable to the respondent, for violation of Article 25 of the GDPR, as reproduced above. In the decision to initiate these disciplinary proceedings, it was considered (initially and without prejudice to the outcome of the investigation) that the facts could constitute a violation of Article 5.1.c) of the GDPR (principle of data minimisation for personal data). 28001 - Madrid 6 sedeagpd.gob.es 27/46 However, once the investigation was concluded and in light of all the documentation in the case file at this procedural stage of the proposed resolution, it is considered that the facts constitute a violation of Article 25 of the GDPR (principle of data protection by design), as substantiated in this section.

applies Art. 5, Art. 25

The reclassification of the facts at the time of the proposed resolution is widely supported by case law. The courts have ruled that it cannot be required that, from the outset of the proceedings, the information regarding the charges be absolutely complete and exhaustive from the outset of the proceedings; in this regard, the Constitutional Court has ruled in its Judgement 129/2006, of April 24, which determines that “Indeed, it follows from the constitutional case law on this issue it follows, on the one hand, that the right to know the charges does not imply that at the initial stage of the proceedings there is an obligation to specify the facts and the corresponding legal classification; rather, the charges are gradually clarified as the proceedings unfold (see, inter alia, Constitutional Court Ruling 41/1998, dated February 24, Legal Ground 15). On the other hand, for the purposes of considering the right to a defense safeguarded, it is sufficient that the defendant has had the opportunity to defend himself against the charge in full from the moment he becomes fully aware of it (SSTC 41/1998, dated February 24, Legal Rationale 27; 87/2001, dated April 2, Legal Rationale 3).

In the same vein, Constitutional Court Ruling 116/2007, dated March 21, establishes that “With regard to the first issue, this Court has reiterated that the right to be informed of the charges implies the need to make known to the person subject to proceedings the charges brought against them in an explicit manner and in terms that are not entirely vague or indeterminate, for the purpose of enabling the exercise of the right to a defense, since one can hardly defend oneself against something when one does not know what specific facts are alleged against them (see, among others, Constitutional Court Ruling 299/2006, dated October 23, Legal Ground 2). Likewise, it has been emphasized that this right, as it applies in the context of administrative sanctions, does not imply that at the initial stage of disciplinary proceedings there is an obligation to specify the facts and the corresponding legal classification in absolute terms; rather, the charge may be gradually clarified as course of the proceedings, provided that the accused is given “the opportunity to defend themselves fully against the charge from the moment they are fully aware of it” (see, among others, Constitutional Court Ruling 129/2006, dated April 24, Legal Grounds 7).”

The Supreme Administrative Court ruling of October 29, 2024, Case No. 1824/2021, in examining Article 64.2.b) of Law 39/2015, of October 1, on the Common Administrative Procedure of Public Administrations, which regulates the decision to initiate proceedings, establishes the definite possibility that a formal charge of an infraction may be included in the proposed resolution, even if it had not been expressly charged in the decision to initiate proceedings, since the aforementioned article provides for this possibility by expressly stating “… without prejudice to the results of the investigation.” It adds that the provision “is supplemented by the provisions of Article 89.3 of said law, which states that ‘In the proposed decision, the facts deemed proven and their exact legal classification shall be set forth with supporting reasoning; the violation that, if any, they constitute, the person or persons responsible, and the penalty proposed; it shall include an assessment of the evidence presented, particularly that which constitutes the basic grounds for the decision, as well as any provisional measures that may have been adopted…”. 28001 - Madrid 6 sedeagpd.gob.es 28/46 It should be noted that regarding the proposed resolution, the Third Chamber of the Supreme Court (see Supreme Court Ruling of November 16, 2021) has been developing consolidated body of case law, in which, after analyzing Constitutional Court Ruling No. 29/1989, it states that “the right to be informed of the charges—which, as a fundamental right, is guaranteed by Article 24.2 of the Constitution—is normally satisfied in the administrative disciplinary proceedings through notification of the proposed decision, since it is this notification that contains a precise statement regarding the liability attributed to the individual, comprising, at a minimum, the definition of the offending conduct found to have occurred, its classification under a specific offense, and the punitive consequence attached to it in the case at hand.”

applies Art. 89 , Law 39/2015 Art. 64, Constitution Art. 24

The first of the rights that Article 53.2 of the LPACAP recognizes for the alleged offender in disciplinary proceedings is the right to be notified of the facts alleged against them, the violations that such facts may constitute, and the penalties that, if applicable, may be imposed on them. The Constitutional Court has clarified that “the essential content of the constitutional right to be informed of the charges relates to the acts considered punishable that are attributed to the accused” (STC 95/1995). Thus, in its Judgement 145/1993, the Constitutional Court (T.C.) notes that informing the alleged offender of the legal classification and the potential penalty to be imposed does not form part of the essential content of the right to be informed of the charges. So important is the disclosure of the facts constituting the administrative offense that the T.C. has declared that the requirements of Article 24.2 of the Spanish Constitution (CE) are fundamentally satisfied by the mere notification of the alleged facts, so that the accused may defend themselves against them (STC 2/1987 and 190/1987).

applies Art. 53 , Constitution Art. 24

In this vein, the Supreme Court, in its Judgement of March 3, 2004, states that “the primary purpose of the notice of initiation is to inform the party of the facts alleged against them and not of the legal classification, which will be addressed in the proposed resolution.” (Emphasis added by the AEPD). In the Supreme Court ruling of March 12, 2016 (appeal 312/2014), Second Legal Ground, it responds in the following terms to the plaintiff’s argument “that the proposed resolution altered the legal classification with respect to the opening agreement”: “In light of the issues raised by the plaintiff, it is appropriate to reflect the and case law regarding the scope of the right of those subject to sanctions to be informed of the charges during the course of the administrative sanctioning proceedings and the limits that the sanctioning body must respect in the exercise of its sanctioning authority in order to safeguard the right to a defense.

The guiding principles of the criminal justice system apply, with certain nuances, to administrative sanction law, given that both are manifestations of the State’s punitive legal system, as reflected in the Constitution, the consistent case law of our Supreme Court, and the doctrine of the Constitutional Court (in this regard, Supreme Court Judgements 28001 - Madrid 6 sedeagpd.gob.es 29/46 of April 28, 2014—appeal No. 364/2013—and of April 9, 2014 —appeal No. 212/2013—, among others)” [...] For its part, the Supreme Court has also established that one of the guarantees applicable to administrative disciplinary proceedings arising from the right to a defense recognized in Article 24 of the Constitution is the right to be informed of the charges in order to be able to defend oneself adequately, as set forth in the Supreme Court’s judgement of November 3, 2003 —Appeal No. 4,896/2000—, the doctrine of which is reiterated in the judgments of that Court dated May 21, 2014—Appeal No. 492/2013—and October 30, 2013—Appeal No. 2,184/2012—in the following terms: “Well then, from the doctrine of the Constitutional Court and the case law of this Chamber, the following principles must be highlighted: a) [...]

applies Constitution Art. 24

With regard to the application of the guarantees under Article 24 of the Spanish Constitution to administrative penalty proceedings [...], a well-established constitutional doctrine has gradually been developed in numerous rulings, in which the following are cited as applicable—without claiming to be exhaustive—the right to a defense, which prohibits any lack of legal representation; the right to be informed of the charges, with the inescapable consequence that the of the alleged facts; the right to the presumption of innocence, [...] b) Among the guarantees applicable to administrative disciplinary proceedings is certainly the right to be informed of the charges in order to defend oneself adequately; and such information includes the facts attributed, their legal characterization, and the proposed sanction. However, the strict correlation between the charges and the decision refers to the facts and not so much to the legal characterization, in that, provided the facts forming the basis of the charges remain unchanged, the proposed resolution and, ultimately, the sanctioning decision may use a different basis for conviction, subject to two limitations: the impossibility of including in said procedural resolution a legal classification of greater severity than that reflected in the notice of charges addressed to the person subject to the disciplinary proceeding, and the impossibility of applying in the resolution a legal classification different from the one communicated if there is heterogeneity in the protected legal interests or if the violation ultimately found to have occurred incorporates an element of the offense that does not correspond to the one that was notified and regarding which the party subject to the sanction has not consequently had the opportunity to defend themselves.

applies Constitution Art. 24

And there is no variation in the facts between the statement of charges, the proposed resolution, and the disciplinary decision when, even if the terms used are not exactly the same, they are similar, and what exists is a different technical-legal assessment of those facts (see SSTC 98/1989 and 145/1993).” (Underlining added by the AEPD) The National Court, Administrative Litigation Chamber, has maintained the same position following the entry into force of the LPACAP. To that end, we refer to the National Court ruling of February 7, 2020 (appeal No. 915/2018), in which the AEPD’s decision that was being challenged was issued while the aforementioned Law 39/2015 was in force. C/ Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es 30/46 V Classification of the violation of Article 25 of the GDPR and determination for purposes of the statute of limitations Based on the available evidence, it is considered that the known facts constitute an infringement, attributable to the respondent, for violation of the Principle of data protection by design set forth in Article 25 of the GDPR.

applies Art. 25

The aforementioned violation of Article 25 of the GDPR constitutes the offense defined in Article 83(4)(a) of the GDPR, which, under the heading “General Conditions for the Imposition of Administrative Fines,” provides: “Infractions of the following provisions shall be penalized, in accordance with paragraph 2, with administrative fines of up to 10,000,000 EUR or, in the case of an enterprise, an amount equivalent to up to 2% of the total annual global turnover for the preceding fiscal year, whichever is higher: a) the obligations of the controller and the processor pursuant to articles 8, 11, 25 through 39, 42, and 43;” For the purposes of the statute of limitations on violations, article 73, “Violations Considered Serious,” of the LOPDGDD, which states: “Pursuant to Recital 83(4) of Regulation (EU) 2016/679, infractions involving a substantial breach of the articles mentioned therein and, in particular, the following (…) d) Failure to adopt the technical and organizational measures necessary appropriate for the effective implementation of the principles of data protection by design, as well as the failure to incorporate the necessary safeguards into the processing, in accordance with the requirements of Article 25 of Regulation (EU) 2016/679.”

applies Art. 83(4)(a), Art. 8, Art. 11, Art. 25 , LOPDGDD Art. 73

VI Proposed Sanction In order to determine the administrative fine to be imposed, the provisions of Articles 83(1) and 83(2) of the GDPR must be observed, which state: “1. Each supervisory authority shall ensure that the administrative fines imposed pursuant to this article for the infringements of this Regulation referred to in paragraphs 4, 9, and 6 are, in each individual case, effective, proportionate, and dissuasive. 2. Administrative fines shall be imposed, depending on the circumstances of each individual case, in addition to or in lieu of the measures referred to in Article 58(2)(a) through (h) and (j). When deciding whether to impose an administrative fine and its amount in each individual case, due consideration shall be given to: (a) the nature, gravity, and duration of the violation, taking into account the nature, scope, or purpose of the processing operation in question, as well as 28001 - Madrid 6 sedeagpd.gob.es 31/46 as well as the number of data subjects affected and the extent of the harm they have suffered; b) whether the violation was intentional or due to negligence; c) any measures taken by the controller or processor to mitigate the harm suffered by the data subjects; d) the degree of responsibility of the controller or processor, taking into account the technical or organizational measures they have implemented pursuant to Articles 25 and 32; e) any previous violations committed by the controller or processor; f) the degree of cooperation with the supervisory authority to remedy the violation and mitigate its potential adverse effects; g) the categories of personal data affected by the breach; h) how the supervisory authority became aware of the breach, in particular whether the controller or processor reported the breach and, if so, to what extent; i) where the measures referred to in Article 58(2) have previously been ordered against the controller or processor concerned in relation to the same matter, compliance with those measures; j) adherence to codes of conduct pursuant to Article 40 or to certification mechanisms approved in accordance with Article 42; and k) any other aggravating or mitigating factors applicable to the circumstances of the case, such as the financial benefits obtained or the losses avoided, directly or indirectly, through the violation.”

applies Art. 58(2), Art. 58(2)(a), Art. 83(1), Art. 83(2), Art. 25, Art. 32, Art. 40, Art. 42

For its part, article 76, “Sanctions and Corrective Measures,” of the LOPDGDD provides as follows: “1. The sanctions provided for in paragraphs 4, 5, and 6 of article 83 of the Regulation (EU) 2016/679 shall be applied taking into account the criteria for determining the level of the sanction set forth in paragraph 2 of the aforementioned article. 2. In accordance with the provisions of Article 83(2)(k) of Regulation (EU) 2016/679, the following may also be taken into account: a) The ongoing nature of the violation. b) The connection between the violator’s activity and the processing of personal data. c) The profits obtained as a result of the violation. d) The possibility that the data subject’s conduct may have contributed to the commission of the violation. e) The existence of a merger by absorption occurring after the commission of the violation, which cannot be attributed to the absorbing entity. f) The impact on the rights of minors. g) Having a data protection officer, where not mandatory. h) The voluntary submission by the controller or processor to alternative dispute resolution mechanisms, in cases where disputes exist between them and any data subject.”

applies Art. 83(2)(k), Art. 83 , LOPDGDD Art. 76

In the present case, in recital, the seriousness of the possible violation is taken into account, as is the impact it has on those affected, 28001 - Madrid 6 sedeagpd.gob.es 32/46 a fine should be imposed, in addition to the adoption of measures, if appropriate. The proposed penalty must now be quantified, taking into account that the fine imposed must be, in each individual case, effective, proportionate, and deterrent, in accordance with Recital 83(1) of the GDPR. To ensure compliance with these principles, it is preliminarily determined that CAIXABANK’s total annual turnover was 1,310,563,000 euros, based on the most recent financial year available (2010), as obtained via the website www.axesor.es. In accordance with the provisions cited above, for the purpose of determining the final amount of the penalty to be imposed in this case for the violation of Article 25 of the GDPR for which CAIXABANK is held responsible—as defined in Article 83(4)(a) of the GDPR—the the following circumstances are taken into consideration: • The nature, severity, and duration of the infringement, taking into account the nature, scope, or purpose of the processing operation in question, as well as the number of data subjects affected and the extent of the damages they have suffered (Article 83(2)(a) of the GDPR): The violation of the aforementioned provision refers to a basic principle, namely that of privacy by design and by default.

applies Art. 83(2)(a), Art. 83(4)(a), Art. 25

Furthermore, although it is known that the violation affected the personal data concerning the complainant and two other data subjects, those potentially affected may include individuals associated with the probate cases that CAIXABANK may have processed since the internal instructions that are the subject of this proceeding took effect. However, it is possible that other affected individuals may have made use of other avenues provided for in the aforementioned Guide. • Intent/Negligence in the Violation (Article 83(2)(b) of the GDPR): The sanctioned conduct is considered intentional, insofar as CAIXABANK’s collection of personal data occurred in accordance with the provisions of its “Guide for Managing CaixaBank Products and Services in the Processing of an Inheritance • The categories of data affected by the infringement (Article 83(2)(g) of the GDPR): CAIXABANK has had access to personal data of a financial and asset-related nature contained in the document awarding the inheritance, pertaining to the decedent and his or her heirs.

applies Art. 83(2)(b), Art. 83(2)(g)

Section 3.6 of Guidelines 04/2022, concerning the calculation of administrative penalties under the GDPR, issued by the EDPB, it states (unofficial translation): “Categories of data affected 58. Regarding the requirement to take into account the categories of data personal data concerned [Article 83(2)(g) of the GDPR], the GDPR clearly highlights the types of data that deserve special protection and, therefore, a stricter response with regard to fines. This refers, at a minimum, to the types of data referred to in Articles 9 and 10 of the GDPR and to data outside the scope of these articles whose disclosure causes immediate harm to the data subject 26 (for example, 28001 - Madrid 6 sedeagpd.gob.es 33/46 location data, data on private communications, national identification numbers, or financial data, such as transaction summaries or credit card numbers).” 2. Furthermore, the following aggravating factor is considered: •The activity of the entity alleged to be in violation is linked to the processing of personal data belonging to both customers and third parties.

applies Art. 83(2)(g), Art. 9, Art. 10

In the activity of the entity against which the complaint is filed, the processing of personal data; therefore, given its purpose and volume of business, the significance of the conduct that is the subject of this complaint is undeniable (Article 76.2.b of the LOPDGDD in conjunction with Article 83.2.k). A review of the circumstances set forth in Article 83(2) of the GDPR and Article 76(2) of the LOPDGDD, with respect to the violation committed by breaching the provisions of Article 25 of the GDPR, justifies proposing an administrative fine of 500,000.00 euros. VII Breach of Obligation. Information to Be Provided When Personal Data Is Obtained from the Data Subject Article 13 of the GDPR sets forth the information that must be provided when personal data is obtained from the data subject, pursuant to which: “1. Where personal data relating to a data subject are obtained from the data subject, the controller shall, at the time the data are obtained, provide the data subject with all the information set forth below: a) the identity and contact details of the controller and, where applicable, of its representative; b) the contact details of the data protection officer, if any; c) the purposes of the processing for which the personal data are intended and the legal basis for the processing; d) where the processing is based on Article 6(1)(f), the of the controller or a third party; e) the recipients or categories of recipients of the personal data, if case; f) where applicable, the controller’s intention to transfer personal data to a third country or international organisation and the existence or absence of a Commission adequacy decision, or, in the case of transfers referred to in Articles 46 or 47 or the second paragraph of Article 49(1), a reference to the appropriate or suitable safeguards and to the means of obtaining a copy of them or the place where they have been made available. 2.

applies Art. 6(1)(f), Art. 49(1), Art. 83(2), Art. 13, Art. 25, Art. 46, Art. 47 , LOPDGDD Art. 76, LOPDGDD Art. 83, LOPDGDD Art. 76(2)

In addition to the information referred to in paragraph 1, the controller shall provide the data subject, at the time the personal data are collected, with the following information necessary to ensure fair and transparent data processing: 28001 - Madrid 6 sedeagpd.gob.es 34/46 a) the period for which the personal data will be stored or, where this is not possible, the criteria used to determine that period; b) the existence of the right to request from the controller access to the personal data concerning the data subject, and to have it rectified or erased, or to restrict its processing, or to object to the processing, as well as the right to data portability; c) where the processing is based on Article 6(1)(a) or Article 9(2)(a), the existence of the right to withdraw consent at any time, without this affecting the lawfulness of processing based on consent prior to its withdrawal; d) the right to lodge a complaint with a supervisory authority; e) whether the provision of personal data is a legal or contractual requirement, or a necessary requirement to enter into a contract, and whether the data subject is obliged to provide the personal data and is informed of the possible consequences of failing to provide such data; f) the existence of automated decision-making, including profiling, as referred to in Article 22(1) and (4), and, at least in such cases, meaningful information regarding the logic involved, as well as the significance and the anticipated consequences of such processing for the data subject. 3.

applies Art. 6(1)(a), Art. 9(2)(a), Art. 22(1), Art. 22(4)

Where the controller intends to further process personal data for a purpose other than that for which they were collected, it shall provide the data subject, prior to such further processing, with information regarding that other purpose and any additional relevant information pursuant to paragraph 2. The provisions of paragraphs 1, 2, and 3 shall not apply where and to the extent that the data subject already has the information." According to Recital 39 of the GDPR: “…The principle of transparency requires that all information and communication relating to the processing of such data be easily accessible and easy to understand, and that plain and clear language be used.” (emphasis added) For its part, Recital 60 of the GDPR states that: “(…) The principles of fair and transparent processing require that the data subject be informed of the existence of the processing operation and its purpose.

The controller must provide the data subject with any additional information necessary to ensure fair and transparent processing, taking into account the specific circumstances and context in which the personal data are processed (…)”. Furthermore, Recital 61 of the GDPR continues: “Data subjects must be provided with information regarding the processing of their personal data at the time it is collected from them or, if collected from another source, within a reasonable period of time, depending on the circumstances of the case. If the personal data may lawfully be disclosed to another recipient, the data subject must be informed at the time the data is first disclosed to the recipient 28001 - Madrid 6 sedeagpd.gob.es 35/46 time. The controller who intends to process the data for a purpose other than that for which it was collected must provide the data subject, prior to such further processing, with information regarding that other purpose and any other necessary information.

When the source of the personal data cannot be disclosed to the data subject because multiple sources were used, general information must be provided.” In the present case, based on the proceedings conducted by this Agency, it has been determined that there is evidence that CAIXABANK has not provided the complainant with the information required by Article 13 of the GDPR. In its response to the for information issued by this Agency, CAIXABANK maintains that section 6.2 of its Privacy Policy contains information on data processing related to probate estates, and that there is a specific data collection document that sets forth the information obligations imposed by Article 13 of the GDPR, and it submits a document titled “Annex IV.” However, no reference to “data relating to estates or contractual arrangements mortis causa” has been found in CAIXABANK’s Privacy Policy. With regard to section 6.2 (pages 1210–1230 of the file), to which CAIXABANK refers in its response to this Agency’s request for information, this section Regarding section 6.2 (pages 1210–1230 of the case file), to which CAIXABANK refers in its response to this Agency’s request for information, this section only includes information regarding processing necessary for the fulfillment of contractual relationships.

applies Art. 13

More specifically, it limits its scope to “contracts that you request or to which you are a party, or to implement, if you request it, precontractual measures, as established in Art. 6.1.b) of the Regulation General Data Protection Regulation (GDPR).” This definition of its content cannot in any case be understood as being readily accessible and easy to understand for the complaining party, who would likely interpret that information regarding probate proceedings or “mortis causa” contractual transactions is included under “contracts or pre-contractual measures,” even though the heirs are not parties to any type of contract with CAIXABANK. It should be added that the mere existence of a CAIXABANK privacy policy published on its website is not an adequate means of complying with the obligation under Article 13 of the GDPR if the complainant did not complete the procedure online and was not provided in any way with the link to the webpage where the Privacy Policy is posted.

applies Art. 6, Art. 13

In this regard, the Art 29 Working Party (hereinafter, WP 29), an independent EU advisory body on data protection and privacy, established pursuant to the provisions of the aforementioned article of Directive 95/46/EC concerning the protection of natural persons with regard to the processing of personal data and on the free movement of such data—currently replaced by the European Data Protection Supervisor (hereinafter, EDPB), whose opinions on the interpretation of Directive 95/46/EC may be considered valid, in its WP260 Guidelines on Transparency under Regulation (EU) 2016/679, adopted on November 29, 2017, and last revised and adopted on April 11, 2018, states that: “19. It is essential that the method or methods chosen to provide the information be appropriate to the particular circumstances, that is, the manner in which the controller and the data subject interact or the manner in 28001 - Madrid 6 sedeagpd.gob.es 36/46 the data subject’s information is collected.

For example, providing the information solely in written electronic format—such as in an online privacy statement or notice—may not be appropriate or feasible when a device that captures personal data does not have a screen (e.g., IoT devices / smart devices) to access the website or display such written information. In such cases, appropriate alternative means should be considered, for example, providing the privacy statement/notice in printed instruction manuals or providing the website URL (i.e., the specific page on the website) where the online privacy statement/notice can be found in the printed instructions or on the packaging.” (emphasis added). Furthermore, CAIXABANK has not provided either the “Annex IV” form or any other document signed by the complainant, stating that the complainant was provided with sufficient or accessible information regarding the elements contained in Article 13 of the GDPR prior to the processing.

applies Art. 13

As the complainant states in the complaint: “We were not provided with any document evidencing the request, delivery, and receipt of this documentation.” Consequently, CAIXABANK has not provided the complainant with the information regarding the elements set forth in Article 13 of the GDPR, with respect to the personal data being processed for the administration of the estate. Therefore, based on the evidence currently available in this proposed resolution of the disciplinary proceeding, it is considered that the known facts constitute an infringement attributable to CAIXABANK, due to a violation of Article 13 of the GDPR, as transcribed above. VIII Classification of the Infringement of Article 13 of the GDPR and Assessment for the Purposes of the Statute of Limitations Article 83(5) of the GDPR classifies a violation of the following article, which shall be penalized, in accordance with paragraph 2, with administrative fines of up to 20,000,000 EUR or, in the case of an enterprise, an amount equivalent to up to 4% of the total annual of the preceding financial year, whichever is higher: “b) the data subject rights under Articles 12 through 22;” For its part, Article 71 of the LOPDGDD, titled “Infractions,” states that: “Acts and conduct referred to in paragraphs 4, 5, and 6 of Article 83 of Regulation (EU) 2016/679, as well as those that are contrary to this Organic Law, constitute violations.”

applies Art. 83(5), Art. 13, Art. 83 , LOPDGDD Art. 12, LOPDGDD Art. 71

For the sole purpose of the statute of limitations, article 73 of the LOPDGDD establishes the following: 28001 - Madrid 6 sedeagpd.gob.es 37/46 “Pursuant to Recital 83(4) of Regulation (EU) 2016/679, infractions that constitute a substantial breach of the articles mentioned therein, and in particular the following: h) Failure to comply with the obligation to designate a representative of the controller or processor not established in the territory of the European Union, as provided for in Article 27 of Regulation (EU) 2016/679.” IX Proposed Penalty In order to determine the administrative fine to be imposed, the provisions of Articles 83(1) and 83(2) of the GDPR must be observed, which state: “1. Each supervisory authority shall ensure that the administrative fines imposed pursuant to this article for the infringements of this Regulation referred to in paragraphs 4, 9, and 6 are, in each individual case, effective, proportionate, and dissuasive. 2.

applies Art. 83(1), Art. 83(2), Art. 27 , LOPDGDD Art. 73

Administrative fines shall be imposed, depending on the circumstances of each individual case, in addition to or in lieu of the measures referred to in Article 58(2)(a) through (h) and (j). When deciding whether to impose an administrative fine and its amount in each individual case, due consideration shall be given to: (a) the nature, gravity, and duration of the violation, taking into account the nature, scope, or purpose of the processing operation in question, as well as the number of data subjects affected and the extent of the damage and harm they have suffered; b) whether the infringement was intentional or due to negligence; c) any measures taken by the controller or processor to mitigate the harm suffered by the data subjects; d) the degree of responsibility of the controller or processor, taking into account the technical or organizational measures they have implemented pursuant to articles 25 and 32; e) any previous violations committed by the controller or processor; f) the degree of cooperation with the supervisory authority to remedy the violation and mitigate its potential adverse effects; g) the categories of personal data affected by the breach; h) how the supervisory authority became aware of the breach, in particular whether the controller or processor notified the supervisory authority of the breach and, if so, to what extent; i) where measures referred to in Article 58(2) have previously been ordered against the controller or processor concerned in relation to the same matter, compliance with those measures; j) adherence to codes of conduct pursuant to Article 40 or to certification mechanisms approved in accordance with Article 42; and k) any other aggravating or mitigating factors applicable to the circumstances of the case, such as financial gains obtained or losses avoided, directly or indirectly, through the violation.” 28001 - Madrid 6 sedeagpd.gob.es 38/46 For its part, Article 76, “Penalties and Corrective Measures,” of the LOPDGDD provides: “1.

applies Art. 58(2), Art. 58(2)(a), Art. 25, Art. 32, Art. 40, Art. 42 , LOPDGDD Art. 76

The sanctions provided for in paragraphs 4, 5, and 6 of Article 83 of Regulation (EU) 2016/679 shall be applied taking into account the criteria for determining the severity set forth in paragraph 2 of that article. 2. In accordance with the provisions of Article 83(2)(k) of Regulation (EU) 2016/679, the following may also be taken into account: a) The continuing nature of the violation. b) The connection between the infringer’s activities and the processing of personal data. c) The benefits obtained as a result of the commission of the violation. d) The possibility that the data subject’s conduct may have contributed to the commission of the violation. e) The existence of a merger by absorption occurring after the commission of the infringement, which cannot be attributed to the absorbing entity. f) The impact on the rights of minors. g) Having a data protection officer, even when not required by law. h) The voluntary submission by the controller or processor to alternative dispute resolution mechanisms, in cases where there are disputes between them and any data subject.”

applies Art. 83(2)(k), Art. 83

In the present case, with regard to the seriousness of the possible violation, with particular attention to the consequences it causes for those affected, a fine should be imposed, in addition to the adoption of measures, if appropriate. The proposed penalty must now be quantified, taking into account that the fine imposed must, in each individual case, be effective, proportionate, and deterrent, in accordance with Recital 83(1) of the GDPR. To ensure these principles, it is first noted that CAIXABANK’s total annual revenue was 1,310,563,000 euros, according to the most recent financial year available (2010), obtained by accessing the website www.axesor.es. First, the category of the infringement committed is taken into account, which falls under the highest level of Article 83 of the GDPR; the regulation imposes the most severe penalty under paragraph 5, punishing the conduct with a maximum fine of 20 million euros or, in the case of an enterprise, a fine amounting to up to 4% of its annual turnover.

applies Art. 83

According to the aforementioned provision, when establishing the maximum applicable amount, the higher of the two limits set by the regulation must be chosen. In accordance with the provisions cited above, for the purpose of determining the final amount of the penalty to be imposed in this case for the violation of Article 13 of the GDPR for which for which CAIXABANK is held liable, as defined in Article 83(5)(b) of the GDPR, the following circumstances are taken into consideration: 28001 - Madrid 6 sedeagpd.gob.es 39/46 • The nature, gravity, and duration of the infringement, taking into account the nature, scope, or purpose of the processing operation in question, as well as the number of data subjects affected and the extent of the damages they have suffered (Article 83(2)(a) of the GDPR): In this specific case, it is established that the failure to provide information occurred in this specific case regarding the processing of the probate proceedings initiated by the complainant.

applies Art. 83(2)(a), Art. 83(5)(b), Art. 13

This lack of information therefore had a limited impact on the complainant and two other heirs. The categories of personal data affected by the violation (Article 83(2)(g) of the GDPR): The processing for which a lack of information has been established involved the processing of financial and asset-related personal data contained in the document awarding the inheritance, pertaining to the decedent and his heirs, without providing information regarding the matters set forth in Article 13 of the GDPR. 2. Furthermore, the following aggravating factor is considered: •The activity of the entity alleged to have committed the violation is linked to the processing of personal data of both customers and third parties. In the activity of the entity against which the complaint is filed, the processing of personal data is essential; therefore, given its purpose and volume of business, the significance of the conduct that is the subject of this complaint is undeniable (Article 76.2.b of the LOPDGDD in conjunction with Article 83.2.k).

applies Art. 83(2)(g), Art. 13 , LOPDGDD Art. 76, LOPDGDD Art. 83

A balancing of the circumstances set forth in Article 83(2) of the GDPR and Article 76(2) of the LOPDGDD, with respect to the violation committed by breaching the provisions of Article 13 of the GDPR, warrants the imposition of an administrative fine of 10,000.00 euros. X Failure to comply. Record of processing activities Article 30 of the GDPR provides as follows: "1. Each controller and, where applicable, its representative shall maintain a record of the processing activities carried out under its responsibility. This record must contain all of the following information: a) the name and contact details of the controller and, where applicable, the joint controller, the controller’s representative, and the data protection officer; b) the purposes of the processing; c) a description of the categories of data subjects and the categories of personal data; d) the categories of recipients to whom the personal data have been or will be disclosed, including recipients in third parties or international organizations; e) where applicable, data transfers of personal data to a third country or an international organisation, including the identification of such third country or organisation 28001 - Madrid 6 sedeagpd.gob.es 40/46 international organization and, in the case of transfers referred to in Article 49(1), second paragraph, documentation of appropriate safeguards; f) where possible, the time limits for the erasure of the various categories of data; g) where possible, a general description of the technical and organizational security measures referred to in Article 32(1). 2.

applies Art. 32(1), Art. 49(1), Art. 83(2), Art. 13, Art. 30 , LOPDGDD Art. 76(2)

Each processor and, where applicable, the processor’s representative, shall maintain a record of all categories of processing activities carried out on behalf of a controller, containing: a) the name and contact details of the processor or processors and of each controller on whose behalf the processor acts, and, where applicable, of the representative of the controller or the processor, and of the data protection officer; (b) the categories of processing carried out on behalf of each controller; c) where applicable, data transfers of personal data to a third country or international organisation, including the identification of that third country or international organisation and, in the case of transfers referred to in Article 49(1), second paragraph, documentation of appropriate safeguards; d) where possible, a general description of the technical and organizational security measures referred to in Article 30(1). 3.

applies Art. 30(1), Art. 49(1)

The records referred to in paragraphs 1 and 2 shall be kept in writing, including in electronic form. 4. The controller or processor and, where applicable, the representative of the controller or processor shall make the record available to the supervisory authority upon request. 5. The obligations set forth in paragraphs 1 and 2 shall not apply to any enterprise or organization that employs fewer than 250 people, unless the processing it carries out is likely to result in a risk to the rights and freedoms of the data subjects, is not occasional, or involves special categories of personal data as set forth in Article 9(1), or personal data relating to criminal convictions and offenses as referred to in Article 10.” In the present case, as noted in the legal grounds regarding the response to the objections to the opening decision, the arguments put forth by CAIXABANK regarding this violation are accepted, and it is proposed that the case be dismissed.

applies Art. 9(1), Art. 10

XI Corrective Measures If the violation is confirmed, the decision issued may establish the corrective measures that the offending entity must adopt to remedy the breach of personal data protection legislation, in this case Art 25 and Art 13 of the GDPR, in accordance with the provisions of the aforementioned Article 58(2)(d) of the GDPR, pursuant to which each supervisory authority may “order the controller or processor to ensure that processing operations comply with the provisions of 28001 - Madrid 6 sedeagpd.gob.es 41/46 this Regulation, where appropriate, in a specific manner and within a specified time limit…” Thus, the responsible entity may be required to bring its actions into compliance with personal data protection regulations, to the extent set forth in the preceding Legal Grounds. This decision sets forth the alleged violation committed and the facts that could give rise to this possible breach of data protection regulations, from which it is clearly inferred what measures must be adopted, without prejudice to the fact that the specific procedures, mechanisms, or tools for implement them is up to the party subject to the sanction, since it is the controller who has full knowledge of its organization and must decide, based on accountability and a risk-based approach, how to comply with the GDPR and the LOPDGDD.

applies Art. 58(2)(d)

However, in this case, notwithstanding the foregoing, in accordance with the evidence currently available pursuant to the decision to initiate disciplinary proceedings, the resolution to be adopted may require CAIXABANK para que, within a maximum period of 6 months from the date on which the final decision concluding this proceeding becomes enforceable, it adopts the following measures: - Demonstrate that it has taken the necessary measures to ensure compliance with the provisions of Article 25 of the GDPR. - Provide evidence that the information referred to in Article 13 of the GDPR has been made available to data subjects and that information regarding the processing of personal data related to estate administration or contractual management mortis causa has been incorporated into its Privacy Policy. The imposition of these measures is consistent with the sanction consisting of an administrative fine, as provided for in Art. 83(2) of the GDPR.

applies Art. 83(2), Art. 13, Art. 25

Please be advised that failure to comply with any order to adopt measures imposed by this agency in the resolution of this enforcement proceeding may be considered an administrative violation under the provisions of the GDPR, classified as an infringement in Article 83.5 and Article 83.6, and such conduct may lead to the initiation of further administrative sanctioning proceedings. In light of the foregoing, the following is hereby issued: PROPOSED RESOLUTION That the Presidency of the Spanish Data Protection Agency impose sanctions on CAIXABANK, S.A., with Tax ID No. A08663619: - For the violation of Article 25 of the GDPR, as defined in Article 83(5)(a) of the GDPR, with a fine of €500,000 (five hundred thousand euros). 28001 - Madrid 6 sedeagpd.gob.es 42/46 - For the violation of Article 13 of the GDPR, as specified in Article 83(5)(b) of the GDPR, with a fine of €10,000 (ten thousand euros) - That the Presidency of the Spanish Data Protection Agency dismiss the infringement of Article 30 of the GDPR, as specified in Article 83(4)(a) of the GDPR.

applies Art. 83(4)(a), Art. 83(5)(a), Art. 83(5)(b), Art. 13, Art. 25, Art. 30, Art. 83

That the Presidency of the Spanish Data Protection Agency order CAIXABANK, S.A., with Tax ID No. A08663619, pursuant to Article 58.2.d) of the GDPR, within a maximum period of 6 months, to demonstrate that it has complied with the following measures: - Demonstrate that it has adopted the necessary measures to ensure compliance with the provisions of Article 25 of the GDPR. - Demonstrate that the information referred to in Article 13 of the GDPR has been made available to the data subjects and that the information regarding the processing of personal data related to estates or contractual administration mortis causa has been incorporated into its Privacy Policy. Furthermore, in accordance with the provisions of Article 85.2 of the LPACAP, you are hereby informed that you may, at any time prior to the resolution of this proceeding, voluntarily pay the proposed fine, which will result in a 20% reduction in the amount of the penalty.

applies Art. 13, Art. 25, Art. 58, Art. 85

With the application of this reduction, the penalty would be set at 408,000.00 euros, and its payment will entail the termination of the proceedings, without prejudice to the imposition of the corresponding measures. The effectiveness of this reduction is conditional upon the withdrawal or waiver of any administrative action or appeal against the penalty. To this end, if you choose to avail yourself of this reduction, you must submit to the Subdirectorate General for Inspection a written notice expressly stating your withdrawal or waiver of any administrative action or appeal against the penalty. If you choose to make a voluntary payment of the amount specified above, in accordance with the provisions of the aforementioned Article 85.2, you must make the by depositing it into restricted account no. IBAN: ES00-0000-0000-0000- 0000-0000 (BIC/SWIFT Code: CAIXESBBXXX) held in the name of the Spanish Data Protection Agency at the bank CAIXABANK, S.A., indicating in the payment description the reference number of the proceeding that appears in the header of this document and the reason—voluntary payment—for the reduction of the penalty amount.

applies Art. 85

You must also send proof of payment to the Subdirectorate General for Inspection so that the case may be closed. Accordingly, you are hereby notified of the foregoing, and the procedure is set forth so that, within TEN DAYS, you may present any arguments you deem appropriate in your defense and submit the documents and information you consider relevant, in accordance with Article 89.2 of the LPACAP. 926-250625 R.R.R. INSPECTOR/INVESTIGATOR C/ Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es 43/46 APPENDIX Table of Contents for File EXP202403125 (…) >> SECOND: On May 22, 2026, CAIXABANK paid the penalty in the amount of 408,000.00 euros, taking advantage of the reduction provided for in the draft resolution transcribed above. THIRD: The draft resolution transcribed above established the facts constituting an infringement, and it was proposed that the Presidency require the controller to adopt appropriate measures to bring its conduct into compliance with the regulations, in accordance with the provisions of the aforementioned Article 58(2)(d) of the GDPR, pursuant to which each supervisory authority may “order the controller or processor to ensure that processing operations comply with the provisions of this Regulation, where appropriate, in a specific manner and within a specified time limit…”.

applies Art. 58(2)(d), Art. 89

LEGAL GROUNDS I Jurisdiction In accordance with the powers granted by Article 58.2 of Regulation (EU) 2016/679 (General Data Protection Regulation, hereinafter GDPR) grants to each supervisory authority, and in accordance with Articles 47, 48(1), 64(2), and 68(1) of Organic Law 3/2018 of December 5 on the Protection of Personal Data and the Guarantee of Digital Rights (hereinafter LOPDGDD), the Presidency of the Spanish Data Protection Agency has jurisdiction to resolve this proceeding. Likewise, Article 63.2 of the LOPDGDD provides that: “Proceedings handled by the Spanish Data Protection Agency shall be governed by the provisions of Regulation (EU) 2016/679, this Organic Law, the adopted to implement it, and, to the extent they do not contradict them, on a subsidiary basis, by the general rules on administrative proceedings.” II Conclusion of the Proceedings Article 85 of Law 39/2015, of October 1, on the Common Administrative Procedure of Public Administrations (hereinafter LPACAP), under the heading “Termination of Disciplinary Proceedings,” provides as follows: “1.

applies Art. 58 , Law 3/2018 Art. 47, Law 3/2018 Art. 48(1), Law 3/2018 Art. 64(2), Law 3/2018 Art. 68(1), LOPDGDD Art. 63, Law 39/2015 Art. 85

Once disciplinary proceedings have been initiated, if the offender acknowledges liability, the proceedings may be resolved by imposing the appropriate penalty. 28001 - Madrid 6 sedeagpd.gob.es 44/46 2. When the sanction is solely financial in nature, or when it is appropriate to impose a financial sanction and another non-financial sanction but the inappropriateness of the latter has been established, voluntary payment by the alleged offender, at at any time prior to the decision, shall result in the termination of the proceedings, except with respect to the restoration of the altered situation or the determination of compensation for damages caused by the commission of the violation. 3. In both cases, when the penalty is solely financial in nature, the authority competent to resolve the proceeding shall apply reductions of at least 20% of the amount of the proposed penalty, which reductions may be cumulative.

The aforementioned reductions must be specified in the notice of initiation of the proceeding, and their effectiveness shall be conditional upon the withdrawal or waiver of any administrative action or appeal against the penalty. The reduction percentage provided for in this section may be increased by regulation.” III Voluntary Payment In accordance with the provisions of the aforementioned Article 85 of the LPACAP, the notified proposed resolution allowed you to make a voluntary payment of the proposed penalty, which would result in a 20% reduction of its amount. With the application of this reduction, the penalty would be set at 408,000.00 euros, and payment thereof would result in the termination of the proceedings, without prejudice to the imposition of the corresponding measures. Following the aforementioned proposed resolution, and before a decision was issued by this authority, CAIXABANK, on May 22, 2026, proceeded to make the voluntary payment, availing itself of the 20% reduction.

applies Art. 85

In accordance with paragraph 3 of Article 85 of the LPACAP, the effectiveness of the aforementioned reduction is conditional upon the withdrawal or waiver of any administrative action or appeal against the penalty. It should be noted that, in accordance with the provisions of the LPACAP, as well as the Supreme Court’s case law on this matter, the fact that the alleged perpetrator by the alleged perpetrator does not exempt the administration from the obligation to resolve and notify all proceedings, regardless of how they were initiated. Similarly, Article 88 of the aforementioned law establishes that the decision that concludes the proceeding shall rule on all issues raised by the data subjects and any other issues arising therefrom. Therefore, in accordance with applicable law and after evaluating the criteria for determining the severity of sanctions, the Presidency of the Spanish Data Protection Agency RESOLVES: FIRST: TO DECLARE that the violations have been committed and TO CONFIRM the penalties set forth in the operative part of the proposed resolution transcribed in the present resolution. 28001 - Madrid 6 sedeagpd.gob.es 45/46 The sum of the aforementioned amounts totals 510,000.00 euros.

applies Art. 85, Art. 88

Since CAIXABANK, S.A. has made a voluntary payment, although without acknowledging liability, pursuant to Article 85 of the LPCAP, a 20% reduction of the aforementioned total, resulting in a final amount of 408,000.00 euros. The effectiveness of the aforementioned reduction is conditional, in any case, upon the withdrawal or waiver of any administrative action or appeal. SECOND: TO DECLARE the dismissal of the violation of Article 30 of the GDPR, as defined in Article 83.4.a) of the GDPR. THIRD: DECLARE the termination of proceeding EXP202403125, in accordance with the provisions of Article 85 of the LPACAP. FOURTH: TO ORDER CAIXABANK, S.A. to notify the Agency, within 6 months from the date this decision becomes final and enforceable, of the adoption of the measures described in the legal grounds of the proposed decision transcribed in this decision. FIFTH: TO NOTIFY CAIXABANK, S.A. of this decision.

applies Art. 30, Art. 83, Art. 85

SIXTH: In accordance with the provisions of Article 85 of the LPACAP, which makes the reduction due to voluntary payment contingent upon the withdrawal or waiver of any action or appeal through administrative channels, this resolution shall be final in administrative proceedings and fully enforceable as of the date of its notification. In accordance with the provisions of Article 50 of the LOPDGDD, this Resolution shall be made public. Publication shall take place once the resolution has been notified to the data subjects. This resolution, which concludes the administrative proceedings as provided for in Article 114.1.c) of Law 39/2015, of October 1, on the Common Administrative Procedure of Public Administrations, the data subjects may file an administrative-litigious appeal before the Administrative-Litigious Chamber of the National Court, in accordance with the provisions of Article 25 and paragraph 5 of the fourth additional provision of Law 29/1998, of July 13, regulating the Administrative Litigation Jurisdiction, within two months from the day following notification of this decision, as provided for in Article 46.1 of the aforementioned Law.

applies Art. 46, Art. 85 , LOPDGDD Art. 50, Law 39/2015 Art. 114, Law 29/1998 Art. 25

However, in accordance with the provisions of Article 90.3(a) of the LPACAP, the final administrative decision may be provisionally suspended if the data subject expresses their intention to file a contentious-administrative appeal. If this is the case, the data subject must formally notify the Agency of this fact in writing addressed to the Spanish Data Protection Agency, submitting it through the Agency’s Electronic Registry , or through any of the other registries provided for in Article 16.4 of the aforementioned Act C/ Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es 46/46 39/2015, dated October 1. You must also submit to the Agency the documentation proving that the contentious-administrative appeal has been effectively filed. If the Agency is not made aware of the filing of the contentious- administrative appeal within two months from the day following notification of this decision, it will consider the precautionary suspension to have ended. 1331-101025 Lorenzo Cotino Hueso President of the Spanish Data Protection Agency C/ Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es

applies Art. 16, Art. 90