# Banco Bilbao Vizcaya Argentaria, S.A.: Insufficient technical and organisational measures to ensure information security

- Type: Enforcement
- Source: Spanish Data Protection Authority (aepd)
- Date: 2021-08-25
- Original: https://www.enforcementtracker.com/ETid-819
- Canonical: https://overview.legal/posts/46934
- Topics: Security, Access Controls, Privacy by Design & Default, Processing Agreement, Insurance, Law Enforcement, Personal Data, Identification, Supervisory Authorities

## Summary

The Spanish DPA (AEPD) has imposed a fine on Banco Bilbao Vizcaya Argentaria, S.A.. The reason for this had been a complaint from a person relating to a lack of authentication. Accordingly, only the ID number had to be given as identification when providing information by telephone. This could allow any person to call, provide an ID number, and thus receive the information associated with the ID number without any verification that the caller is actually the ID holder. The DPA considered this to

## Full text

The Spanish DPA (AEPD) has imposed a fine on Banco Bilbao Vizcaya Argentaria, S.A.. The reason for this had been a complaint from a person relating to a lack of authentication. Accordingly, only the ID number had to be given as identification when providing information by telephone. This could allow any person to call, provide an ID number, and thus receive the information associated with the ID number without any verification that the caller is actually the ID holder. The DPA considered this to be a failure to implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk posed to the data subjects. The original fine of EUR 200,000 was reduced to EUR 120,000 due to voluntary payment and acknowledgement of guilt.

GDPR Articles: Art. 32 GDPR
Industry: Finance, Insurance and Consulting

---
Generated by overview.legal · https://overview.legal/posts/46934 · 2026-08-22