AEPD (Spain) - EXP202500113

Facts }}}} The DPA fined a bank €500,000 after it lost a customer’s documents sent through a courier. The authority held that the bank failed to ensure adequate security and proper supervision of its processor under [[Article 32 GDPR|Article 32 GDPR]].The DPA fined a bank €500,000 for losing a customer’s documents when transporting them via a courier. The DPA held that the bank failed to ensure adequate security and proper supervision of its processor under [[Article 32 GDPR]]. == English Summary ==== English Summary == The controller did not receive the documentation. Between 2 and 16 February 2023, the data subject contacted the controller several times. The controller informed them that the documentation had not arrived and that inquiries with different courier companies were ongoing. Dynamic had not reported any incident during the contractual relationship, which complicated the controller’s investigation. The controller later confirmed the loss of the documentation and acknowledge