Enforcement · Spanish Data Protection Authority (aepd) EN LLM context A cited markdown file you can paste into your AI assistant (ChatGPT, Claude, a RAG or project knowledge base) to ground it in this document. Contains: this document’s text, its sections with their topics, and the full text of every law provision it applies. Everything links back to its source on overview.legal — legal information, not advice.

CAIXABANK PAYMENTS & CONSUMER EFC, EP, S.A.U.: Insufficient legal basis for data processing

€3,000,000 Fine
CAIXABANK PAYMENTS & CONSUMER EFC, EP, S.A.U.
SPAIN
Art. 6 GDPR
Insurance Marketing Controllers Automated Decision-Making Profiling Direct Marketing Consent Personal Data
Oct 21, 2021 Source

How it connects

Related across sources

Guidance Guidelines 8/2022 on identifying a controller or processor's lead supervisory authority EDPB Guidance EDPB Annual Report 2021 EDPB Guidance Guidelines 04/2021 on Codes of Conduct as tools for transfers EDPB Guidance Guidelines 07/2020 on the concepts of controller and processor in the GDPR EDPB Guidance EDPB Annual Report 2019 EDPB Case Law Google LLC v CNIL CJEU

Full text

The Spanish DPA (AEPD) has imposed a fine of EUR 3,000,000 on CAIXABANK PAYMENTS & CONSUMER EFC, EP, S.A.U.. An individual had filed a complaint against the controller. The reason was that Caixabank had requested information about him from a company although, the latter has not been a customer of Caixabank since 2014 and that he was included in an advertising campaign to offer him a pre-grant credit. Caixabank had used individuals' data to assess their creditworthiness without their consent. This was used to create financial profiles of the data subjects and to advertise certain financial services (e.g. credit cards or loans) to them on this basis. In doing so, the DPA found that the controller had not obtained effective consent from the data subjects. It is true that the data subjects had at one point given consent for their data to be processed by the entire CaixaBank Group. However, the controller had not adequately informed the data subjects about the data processing, including profiling. For example, the controller had only provided data subjects with general information about the various profiling processing operations, so data subjects could not know exactly what the processing they had consented to consisted of.

Industry: Finance, Insurance and Consulting

Original document at the source www.aepd.es

Similar Content