AEPD (Spain) - EXP202302270
From GDPRhub
| AEPD - EXP202302270 | |
|---|---|
 | |
| Authority: | AEPD (Spain) |
| Jurisdiction: | Spain |
| Relevant Law: | Article 5(1)(e) GDPR Article 6(1)(b) GDPR |
| Type: | Complaint |
| Outcome: | Upheld |
| Started: | 16.01.2023 |
| Decided: | 05.06.2025 |
| Published: | 18.08.2025 |
| Fine: | 200,000 EUR |
| Parties: | CAIXABANK S.A. |
| National Case Number/Name: | EXP202302270 |
| European Case Law Identifier: | n/a |
| Appeal: | Unknown |
| Original Language(s): | Spanish Spanish |
| Original Source: | AEPD (decision) (in ES) AEPD (dismissed internal appeal) (in ES) |
| Initial Contributor: | ap |
The DPA fined a bank €200,000 for retaining personal data of a former client for almost 16 years, in violation of the principle of storage limitation.
English Summary
Facts
A data subject filed a complaint with the DPA against CAIXABANK S.A. (a bank, the controller) on 16 January 2023. According to the data subject, the controller contacted them to inform them of changes to their privacy policy, and that they would receive further correspondence requesting consent to send them personalised advertising. This was done despite the fact that the data subject was not a client. The data subject requested access to their personal data and asked the controller how it obtained their data. The data subject then learned that the controller had obtained the data from a previous mortgage contract they had with the bank, who had continued to process this data.
The DPA initially dismissed the complaint on the grounds that the data subject was a client, as their data was in the controller’s database. The data subject filed an internal appeal, arguing that they were no longer a client, and that their contract with the controller had terminated in 2008. The DPA upheld the appeal on 20 March 2024, and began sanctioning proceedings on 7 June 2024.
The controller argued that it did not violate the principle of storage limitation, as the contract with the data subject allowed the controller to retain the data until 2030. Therefore, processing the data was lawful under Article 6(1)(b) GDPR.
Holding
The DPA found a violation of Article 5(1)(e) GDPR. The data subject terminated their mortgage contract with the controller in 2008, meaning the controller had retained their data for almost 16 years. The DPA considered that the controller had stored the data for an excessive period, and therefore violated the principle of storage limitation.
The DPA fined the controller €200,000. The DPA considered it a serious violation, due to the long storage period as well as the four previous fines the DPA had imposed on the controller for other GDPR violations.
Comment
The controller filed an internal appeal on 9 July 2025. The DPA dismissed the appeal on the basis that the deadline to file the appeal had already passed.
In its decision, the DPA did not comment on purpose limitation regarding the controller processing the data in the contract for marketing purposes.
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Spanish original. Please refer to the Spanish original for more details.
1/29
File No.: EXP202302270
SANCTIONING PROCEDURE RESOLUTION
From the procedure initiated by the Spanish Data Protection Agency and based on the following
BACKGROUND
FIRST: A.A.A. (hereinafter, the complainant) filed a complaint with the Spanish Data Protection Agency on January 16, 2023. The complaint is directed against CAIXABANK, S.A. with NIF A08663619 (hereinafter,
CAIXABANK). The grounds for the complaint are as follows:
The complainant states that they received a postal communication at their address from
CAIXABANK (of which they are not a customer) regarding an update to its Privacy Policy, informing them of the existence of certain processing operations to be carried out, together
with other Group companies, with the aim of offering products and services that are as
personalized as possible, provided they have the customer's consent. Therefore, they will contact the complainant shortly.
The communication also adds the following: "Until we contact you to ask about your preferences, we would like to continue informing you
about everything we can offer you; therefore, based on the legitimate interest provided for in data protection regulations, we will send you communications
about products and services similar to those you have contracted with CaixaBank, based on a basic commercial profile that we will create with your data. Below,
you can find detailed information about this processing."
The entity in question then provides a telephone number and a web link to contact if you are not interested in receiving such communications or if you refuse to be profiled.
After receiving this communication, and since you are not a CAIXABANK customer, on November 9, 2022, you requested access to your personal data being processed,
indicating that you are not a customer of said entity and wish to know how and when your data was obtained. You received a response on November 11, 2022, requesting correction of the request, specifically stating the following: "In order to
manage and respond to this request, it is necessary, in accordance with data protection regulations, that you send us a valid document proving your identity."
On November 20, 2022, the complainant reiterated his request, stating
that the requirement to provide a copy of his ID is excessive, but received a response,
on November 23, 2022, to the same effect.
Along with the complaint, he submitted a copy of the postal communication received regarding the
update of the Privacy Policy and data processing, dated October 9,
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 2/29
2022, as well as a copy of the access requests and the responses received.
SECOND: In accordance with Article 65.4 of Organic Law 3/2018, of December 5, on the Protection of Personal Data and the Guarantee of Digital Rights (hereinafter LOPDGDD), this complaint was forwarded to CAIXABANK so that it could analyze it and inform this Agency within one month of the actions taken to comply with the requirements set forth in the data protection regulations. The response submitted by CAIXABANK states the following:
- that the complaining party is a customer of the entity, as they appear in CAIXABANK's database as one of the two holders of a mortgage guarantee contract signed on February 24, 2005.
- a response to the complaining party's right of access has been provided by means of a communication sent to the postal address listed in CAIXABANK's systems.
THIRD: On April 16, 2023, in accordance with Article 65 of the LOPDGDD (Spanish Law on the Protection of Personal Data), the claim filed by the complainant was admitted for processing.
FOURTH: On May 23, 2023, the Agency Director issued a resolution to close the proceedings.
The reasons for the decision to close the proceedings were that the complainant was a client of the entity, as he was listed in the entity's database as one of the two holders of a mortgage guarantee contract. This resolution was notified to the complainant on May 23, 2023.
FIFTH: On June 22, 2023, the complainant filed an appeal against the resolution to dismiss the proceedings dated May 23, 2023, stating that they were no longer a client of the entity, as the mortgage guarantee contract had been canceled on February 29, 2008, through a deed of payment and cancellation of mortgage executed before a notary.
SIXTH: On February 9, 2024, a communication was sent to CAIXABANK, granting it a hearing on its appeal for reconsideration. This communication was received by
CAIXABANK on February 12, 2024.
SEVENTH: On February 26, 2024, this Agency received a written response from CAIXABANK, which stated, among other things, that the mortgage guarantee contract had been canceled on the indicated date, but that
once the transaction had been signed by the canceling center, the branch had not entered the cancellation request into the terminal.
Furthermore, they indicated that they had proceeded to cancel the mortgage loan internally in their systems, and had notified the claimant of this in a
communication dated February 26, 2024.
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 3/29
EIGHTH: On March 20, 2024, the Director of the Spanish Data Protection Agency granted the optional appeal for reconsideration filed by the claimant.
NINTH: According to the report compiled by the AXESOR tool, CAIXABANK is a large company established in 1980, with a turnover of ***AMOUNT.1 euros in 2023.
TENTH: On June 7, 2024, the Director of the Spanish Data Protection Agency agreed to initiate sanctioning proceedings against CAIXABANK, in accordance with the provisions of Articles 63 and 64 of Law 39/2015, of October 1, on the Common Administrative Procedure of Public Administrations (hereinafter, LPACAP), for the alleged violation of Article 5.1.e) of the GDPR, classified in Article 83.5.a) of the GDPR.
ELEVENTH: On June 17, 2024, CAIXABANK submitted a written request
to be provided with a copy of the file.
TWELFTH: On June 19, 2024, the investigating body of the
procedure agreed that a copy of the file be sent to CAIXABANK.
This agreement was notified to CAIXABANK on June 20, 2024, as
recorded in the acknowledgment of receipt included in the file.
THIRTEENTH: On June 19, 2024, CAIXABANK submitted a written request
to an extension of the deadline for submitting arguments.
FOURTEENTH: On June 20, 2024, the investigating body of the procedure agreed to the requested extension of the deadline up to a maximum of 5 days, in accordance with the provisions of Article 32.1 of the LPACAP.
The aforementioned agreement was notified to CAIXABANK on June 21, 2024, as recorded in the acknowledgment of receipt in the file.
FIFTEENTH: After notification of the aforementioned initiation agreement in accordance with the rules established in Law 39/2015, of October 1, on the Common Administrative Procedure of Public Administrations (hereinafter, LPACAP), the respondent submitted a written statement of allegations in which, in summary, it stated:
1. Opposition to the initiation agreement. No Violation
CAIXABANK believes it has not violated the principle of
limitation of the data retention period, as provided for in Article 5.1.e) of the GDPR,
to the extent that the complaining party signed a mortgage-secured financing agreement on February 24, 2005, together with another data subject.
According to CAIXABANK, it is a consensual and bilateral financing agreement
whereby the parties sign a mortgage-secured credit agreement or credit agreement, and is a more flexible option than a mortgage loan.
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 4/29
This credit agreement establishes a maximum limit on the capital available to the debtor, within which the debtor may draw down partially or fully until the end of the agreed term.
CAIXABANK has provided documentation showing that the maturity date agreed in the contract with the claimant was February 28, 2030.
CAIXABANK adds that, in this same act, the debtor proceeded to establish a mortgage to secure the obligations arising from the credit agreement.
This is a legal transaction distinct from the Credit Agreement, insofar as CAIXABANK can enter into a credit agreement with its customers without any collateral, since the establishment of additional collateral is linked to the applicant's solvency.
Thus, the cancellation of the granted security interest requires a notarial deed in which the creditor consents to the cancellation, as set forth in Article 82 of the Mortgage Law, according to which:
"Registrations or preventive annotations made by virtue of a public deed shall not be canceled except by a judgment against which no appeal in cassation is pending, or by another deed or authentic document in which the person in whose favor the registration or annotation was made consents to the cancellation (...)"
Therefore, CAIXABANK states that it gave its consent to the extinction of the security interest on February 29, 2008, but said cancellation of the mortgage did not entail the cancellation of the credit agreement, which would be in force until February 28, 2030. Therefore, they would be two independent legal transactions, with no legal effects arising from the cancellation. mortgage loan at the time leading up to the loan agreement.
Therefore, it wishes to state that its actions do not constitute a violation of Article 5.1.e) GDPR because the processing of the complainant's data was legitimized by
the validity of the contractual relationship arising from the loan agreement signed with
CAIXABANK.
CAIXABANK states that the complainant was recorded in its systems as the holder
of a mortgage loan agreement, granted on February 24,
2005, formalized before a Notary Public.
In this sense, according to CAIXABANK, the loan agreement is a financing agreement, specifically a mortgage loan agreement formalized before a Notary Public.
It states that the credit agreement is regulated by Articles 175.7 and 323 of the Commercial Code, Article 153 of the Mortgage Law, and also states that it has been defined by the Supreme Court in several of its rulings (Supreme Court decisions of June 11, 1999, and June 27, 1989) as "a contract by which the bank is obliged, within the agreed limit and through a commission received by the customer, to make sums of money available to the customer, as required, or to perform other services that allow the customer to obtain them." Regarding its nature, it adds that "it is the legal financing instrument granted as a current account credit agreement, since the grantor, obliged to have sums of money available to the borrower within the agreed limits, will only effectively have the right to demand repayment if the other party to the agreement has used the credit with cash withdrawals." (Supreme Court of Justice of October 25, 2005).
According to this, the Credit Agreement establishes a maximum limit of capital available to the debtor, within which the debtor may draw on it, partially or totally, using all or only part of the capital granted.
CAIXABANK also presents the distinction between:
- a mortgage loan, in which, once the entire principal has been repaid, the financing transaction is concluded, and
- a credit agreement, in which new withdrawals can be made from the amount made available to the debtor, once the debtor has repaid or amortized the amounts drawn down until the end of the agreed contractual term. In other words, amounts that had been previously repaid or amortized can be redrawn.
It insists that the final maturity date of the loan is February 28, 2030, so that, at the date of the claim filed, the credit agreement was in force, allowing the holders of the agreement to make new withdrawals from the amount made available in the credit account.
Therefore, it considers that the credit agreement was in force and that the processing of the data carried out by CAIXABANK on the claimant's behalf was lawful.
At this point, CAIXABANK states that the financial credit agreement may be granted with or without a mortgage guarantee, and that this possibility is related to the solvency of the applicant, but that it has no intrinsic link to the credit agreement itself, as they are independent legal transactions. This is expressly stated in Article 179 of the Mortgage Regulations, which establishes:
"Even if the mortgage loan has been extinguished by payment, the corresponding registration will not be cancelled except by virtue of a public deed in which the creditor gives his or her consent to the cancellation (...)".
Thus, the claimant requested cancellation of the mortgage after the amount initially provided had been
returned, as can be seen in the resulting cancellation deed, which reads:
"GIVES:
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 6/29
That I issue a receipt for the amount of (...), consequently canceling the mortgage that
affects the described property, with respect to the related loan, and consents to this
cancellation being recorded in the Property Registry."
From this reading, it can be deduced that there is no indication, mention, or reference to the
cancellation or termination of the Credit Account, thereby proving that they are
independent legal transactions.
Consequently, to the extent that the creation of the credit agreement, the maturity of the credit agreement in 2030, and the creation of a mortgage as a guarantee of the independent legal transaction, the cancellation of which has no legal effect on the cancellation or termination of the credit agreement, the data of the complainant remained in CAIXABANK's systems legitimately and necessary for the execution of the contractual relationship arising from the formalized credit agreement.
CAIXABANK adds that, following the filing of the Appeal for Reconsideration by the complainant, they interpreted the complainant's intention to terminate the contractual relationship with CAIXABANK, thereby waiving the right to make new arrangements until the scheduled maturity date, thus terminating the credit agreement and thereby deleting the credit data and the complainant's data from its systems.
Therefore, it adds that the processing of the complaining party's personal data is considered lawful, based on the contractual performance that was in force, and thus complies with the provisions of Article 6.1.b) of the GDPR. Therefore, it requests that this sanctioning procedure be closed.
SIXTEENTH: On February 20, 2025, a resolution proposal was made, proposing that the Presidency of the Spanish Data Protection Agency sanction CAIXABANK, S.A., with NIF A08663619, for a violation of Article 5.1.e) of the GDPR, classified as Article 83.5.a) of the GDPR, with a fine of two hundred thousand euros (€200,000).
SEVENTEENTH: On February 27, 2025, this Agency received a letter from CAIXABANK requesting an extension of the deadline granted to submit objections. This request was granted on February 28, 2025, and the requested extension was granted up to a maximum of 5 days, in accordance with the provisions of Article 32.1 of the LPACAP.
The aforementioned agreement was notified to CAIXABANK on March 3, 2025, as
recorded in the acknowledgment of receipt in the file.
EIGHTEENTH: After notification of the aforementioned proposed resolution in accordance with the rules
established in Law 39/2015, the respondent submitted a written statement of objections in
which, in summary, it stated:
1. Preliminary. Summary of the relevant background information and the reasons for opposing the proposed resolution.
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 7/29
The complainant had signed a credit agreement with another account holder on February 24, 2005.
According to CAIXABANK, it is a consensual and bilateral financing agreement,
through which the financial institution undertakes, for a fixed period and for a maximum amount, to make a sum of money available to the other party, with the power
for the other party to:
i) use said amount at will, in whole or in part,
ii) also repay the amount drawn at will,
iii) redistribute, in whole or in part, the amount made available.
All of this is in accordance with the agreements and conditions established between the parties in
the document signed before a notary public.
CAIXABANK indicates that, according to the aforementioned notarial deed, the claimant has already made an initial withdrawal, exercising its right to withdraw the amount agreed upon in the credit agreement.
Furthermore, it states that the amount withdrawn was repaid on February 29, 2008, and that payment of this amount was accepted and acknowledged by CAIXABANK on that same date before a notary.
It adds that, in the same deed of payment, CAIXABANK appears to consent to the cancellation of the mortgage established to guarantee the monetary obligation assumed, that is, the first withdrawal from the credit account granted.
CAIXABANK continues to state that, in accordance with the credit agreement, once the amount subject to the first drawdown was repaid, the borrowed party (in this case, the claimant) once again had access to the sum of money covered by the credit, up to the maximum amount, and for the established period, which is February 28, 2030.
That is, the credit agreement remains in force regardless of the cancellation of the mortgage guarantee granted, with data processing being legitimate for the purpose of contractual execution.
Therefore, CAIXABANK believes that, in this case, the element of typicality does not apply, and that it did not incur any typical acts, insofar as the credit agreement signed with the claimant was in force when it received the communication that gave rise to this sanctioning procedure.
Therefore, it requests the dismissal of this sanctioning procedure, or, alternatively,
that the sanction be reduced in accordance with the principle of proportionality.
First. No violation has occurred.
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 8/29
A. According to the AEPD, the contract signed on February 24, 2005, is not a
loan contract.
CAIXABANK indicates that, in its written submission to the initiation agreement, it had
explained the difference between a loan and a guarantee contract.
Likewise, this article provides an excerpt from a publication that the Bank of Spain has published on its website's Bank Customer Portal regarding these two concepts, which is as follows:
“Mortgage Loan or Credit
Although the purpose of both is to obtain financing, there are important differences.
While with a loan, the money is provided from the outset, with a credit, a sum of money is granted that can be used according to certain
conditions.
In a loan, the bank provides a fixed amount of capital that you agree to
repay in periodic installments over a previously agreed-upon period. This way,
both parties are clear about the total cost of the transaction, the amount of
interest to be paid, and the term of the debt.
When it comes to a mortgage loan, your bank establishes the maximum limit it is willing to lend, which you may or may not use in full for a
determined or indefinite period.
(…)”
CAIXABANK It goes on to state that the proposed resolution "concludes that the deed (is not a mortgage-secured credit agreement) but rather a mortgage loan (...)"
CAIXABANK now mentions that the terminology does not affect the nature of the contract, as established in articles 1285 and 1286 of the Civil Code, and that the legal nature of the contract cannot be derived from a single word, phrase, or clause in isolation from the others, but rather from the organic whole that constitutes the contract.
Therefore, it is understood that:
- the claimant signed a mortgage-backed financing agreement on February 25, 2005.
- this is a consensual and bilateral financing agreement, whereby the parties signed a mortgage-backed credit account agreement or credit account agreement, which is a more flexible option than a mortgage loan, allowing access to the borrowed capital according to the debtor's needs at any given time.
- the credit account agreement establishes a maximum limit of capital available to the borrower (claimant), within which the borrower may draw on it in part or in full until the end of the agreed-upon time period.
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 9/29
- that the agreed-upon deadline was February 28, 2030.
- the credit account contract signed with the complainant was in effect on the
date of the complaint filed, so the processing of the data by CAIXABANK was lawful.
B. According to the AEPD, the credit contract was canceled by virtue of the deed of payment
and cancellation of mortgage granted on February 29, 2008.
CAIXABANK makes this statement on the basis that the complainant had
signed a credit account contract with the aforementioned characteristics.
At a later date, within the agreed contractual term, the claimant
proceeds to return the amount subject to the first drawdown, as
set forth in the deed dated February 29, 2008, and, therefore, in said deed,
CAIXABANK consents to the termination of the
real security interest, once the amount drawn down has been returned. However,
CAIXABANK insists that this does not constitute the automatic termination or expiration
of the Credit Account Agreement, which continues to have legal effect until
the agreed date, since that is its legal nature.
Therefore, it insists that, on the date of the claim, the Credit Account Agreement was in force and continued to have its legal effects typical of a credit account agreement, and that the cancellation deed would only have the following legal effects:
- The acknowledgment of payment implies that the claimant, as holder of the Credit Agreement, had the power to make new or no payments until the maturity date.
- The cancellation of the collateral implies that the debtors are liable for the obligations contracted with all of their assets, present and future, but without affecting any specific asset.
Finally, CAIXABANK mentions that the fact that the entity terminated the contractual relationship, terminated the Credit Agreement, and thereby deleted the claimant's data from its systems, would be irrelevant for the purposes of determining CAIXABANK's liability in this proceeding, and does not imply that it was acknowledging its liability. Thus,
CAIXABANK could only be liable for acts that constitute the offense, thus the element of criminality does not apply in this case.
It insists that the data was kept in the systems because it was necessary for the
maintenance of the contractual relationships it had with CAIXABANK,
derived from the Credit Account Agreement that expired on February 28, 2030.
Second. Violation of the principle of proportionality.
CAIXABANK understands that the indicated sanction is contrary to the principle of proportionality, and cites Article 29.3 of Law 40/2015, which establishes:
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 10/29
“3. In the regulatory determination of the sanctioning regime, as well as in the imposition
of sanctions by Public Administrations, due consideration must be given to the
suitability and necessity of the sanction to be imposed and its appropriateness to the seriousness of the act constituting the infraction (…)”
In this regard, it cites the ruling of the Administrative Litigation Division of the
National Court of November 18, 2022, which establishes:
“According to reiterated jurisprudence of the Supreme Court, such as the Ruling of April 12, 2012 - Appeal No. 5.149/2009, among others, that there must be a proper balance between the seriousness of the act constituting the infraction and the sanction applied, as provided in Article 29.3 of Law 40/2015, of October 1.
This principle cannot be evaded from judicial review, since the margin of appreciation granted to the Administration in imposing sanctions within the legally established limits must be developed by weighing, in all cases, the concurrent circumstances, in order to achieve the necessary and proper proportion between the alleged acts and the liability required, given that any sanction must be determined in accordance with the seriousness of the infraction committed and according to a criterion of proportionality in relation to the circumstances of the act. Therefore, proportionality constitutes a normative principle imposed on the Administration and which reduces the scope of its sanctioning powers.
In this regard, it understands that:
i) in relation to the circumstance relating to the nature, severity, and duration of the infringement, it makes the following statements:
- Regarding the number of affected parties, it understands that this scenario would only affect
a single person, and that it is not a habitual or repeated occurrence, as there are no prior complaints from other interested parties regarding the data processing that CAIXABANK carries out in connection with the management of its mortgage guarantee contracts.
- Damages suffered by the complainant. CAIXABANK understands that the damages
and losses would have been minimal, as the complainant's data would not have been processed
for other purposes that could be considered to have a more detrimental impact on
the complainant, such as those for which consent is required.
CAIXABANK adds that this Agency has not taken into account that, following the appeal for reconsideration, the right to erasure was immediately honored, which meant that no processing of the complainant's personal data was carried out.
ii) Regarding the previously committed violations, CAIXABANK wishes
to state that, in the proceedings referred to, Article 5.1.e) of the GDPR is not being
charged and, therefore, the sanction is disproportionate, as there are no previous violations related to the same infringing act.
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 11/29
For all these reasons, they request that the present sanctioning proceedings be dismissed,
or, alternatively, that the sanction be reduced in accordance with the principle of proportionality.
From the actions taken in this proceeding and the documentation in the file, the following have been established:
PROVEN FACTS
FIRST: It is clear that the complainant took out a mortgage loan, together with his or her spouse, with LA CAIXA (currently CAIXABANK) on February 24, 2005, according to the notarial deed of that date.
SECOND: It is established that, pursuant to said notarial document dated February 24, 2005, a mortgage-secured loan transaction was formalized, such that a credit account was opened for the claimant and his or her spouse. The same notarial deed established a mortgage in favor of CAIXABANK for the claimant's real estate, described in said notarial deed, as a guarantee for payment to CAIXABANK of the balance resulting from the liquidation of the interest account. The notarial deed stated the following:
"I identify you by presenting your identification documents, and you have, in my opinion, the legal capacity necessary for this MORTGAGE-SURED LOAN deed (...)."
The notarial deed continues:
“Third. - That both parties formalize this credit transaction with a mortgage guarantee, in accordance with the following clauses:
(…)
In the FIFTH AGREEMENT. Expenses borne by the accredited party, it is noted:
“The ACCREDITED PARTY assumes payment of the appraisal costs of the mortgaged property, all other expenses and taxes arising from this deed, the acts and contracts formalized herein, and their registration in the Property Registry, and those arising from any grants required for this document and its cancellation to have access to the Property Registry,
including those caused by letters of full or partial payment of the credits, and those arising from the management of the corresponding deeds for their registration in the aforementioned Registry (…)”
In the SEVENTH AGREEMENT. Credit Account, It states:
"Only the following items may be charged to the credit account:
(…)
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 12/29
"la Caixa", as of the date of early or final maturity of the credit, whether in whole or in part, will liquidate the account according to its books. "la Caixa" will notify the CREDITED PARTY of the extract of said liquidation by any
means permitted by law, without prejudice to doing so through judicial or notarial means, in the
cases where the law so prescribes, and the maturity of the credit will be deemed to have occurred on the date to which the liquidation refers.
"la Caixa" (…)
The balance due from the liquidation of the credit account will be certified by "la Caixa" for the purposes of exercising any type of enforcement action within its jurisdiction, especially those relating to the mortgaged property."
The EIGHTH AGREEMENT of the notarial deed reads:
"Mortgage Establishment.
As security for payment to "la Caixa" of the balance resulting from the liquidation of the credit account, up to the amount of (…) without prejudice to the joint and unlimited liability of the borrowers, a mortgage is established in favor of "la Caixa" on the property described above. (…)”
In the NINTH AGREEMENT. Extension of the guarantee, it is noted
(…)
“The CREDITED PARTY [or, “the non-debtor mortgagor”] grants “la Caixa” the right and express mandate to collect compensation for loss or compulsory expropriation directly from the insurance company or the Government, to apply them, to the full or partial extinction of the credit and the obligations arising therefrom. “la Caixa” will deliver to the
mortgagor any excess compensation, if any.”
THIRD: It is established that, on February 29, 2008, a Letter of Payment and Cancellation of the Mortgage requested by the claimant was granted by notarial deed.
FOURTH: According to said notarial deed of February 29, 2008, on February 24, 2005, and in accordance with a deed authorized before a Notary, LA CAIXA opened a credit account in favor of the claimant and his/her spouse, leaving an urban property to be responsible for the corresponding liabilities (credit limit, accrued ordinary interest, late payment interest, and the amount established for costs and expenses).
FIFTH: It is established that, in the notarial deed of February 29, 2008, the commercial entity LA CAIXA was reimbursed for the principal for which the property was liable, plus accrued interest, and therefore a letter of payment was granted for the property. Agreed upon amount, canceling the mortgage affecting the property, according to said notarial deed, which shows:
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 13/29
(…) representative powers to execute this deed of PAYMENT LETTER AND MORTGAGE CANCELLATION.
I IDENTIFY you by showing your aforementioned identification document, and you have, in my opinion, the necessary legal capacity to execute this deed of PAYMENT LETTER AND MORTGAGE CANCELLATION, and to this end, according to the person involved,
EXPOSES:
I. – That by deed authorized on February 24, 2005, by the notary (…) opened a credit account in favor of (…)
And by virtue of the related deed, the following property became liable for the following liabilities:
URBAN. – PROPERTY located at (…)
HAS BEEN LIABLE FOR:
Up to ***AMOUNT.2 as a credit limit, up to (…)
II). – That the Commercial Entity “LA CAIXA (…)” has been reimbursed for the principal for which the property is liable, plus accrued interest. And for the record,
the appearing party, according to the parties involved,
GIVES:
That she gives a payment receipt for the amount of ***AMOUNT.2, consequently canceling the
mortgage affecting the described property, with respect to the related loan, and consents
that this cancellation be recorded in the Property Registry.
PAYMENT METHOD. – By means of various deposits into the account into which the payments were direct debited
(…)
It is hereby stated that this cancellation deed has been requested by (…)”
SIXTH: It is noted that, on October 9, 2022, CAIXABANK sent a communication to the complainant informing them of the entity's privacy policy.
SEVENTH: It is noted that on April 12, 2023, CAIXABANK informed the complainant that the data it maintains relates to an open mortgage, which was established on February 24, 2005. This document included, among other things:
"Product: Open mortgage
Granted: ***AMOUNT.2
Date of establishment: 02/24/2005."
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 14/29
EIGHTH: It is recorded that, on February 26, 2024, CAIXABANK notified the
claimant that it had canceled the mortgage loan, such that there were no longer any valid contractual relationships in its systems, and CAIXABANK did not process any personal data.
NINTH: It is recorded that CAIXABANK notified this Agency, on February 26, 2024, that the person who appeared before a notary to execute the deed of cancellation and payment letter dated February 29, 2008, did not complete the process in the entity's internal systems.
TENTH: It is noted that the complainant's data has remained in the entity's systems until February 26, 2024.
ELEVENTH: It is noted that, in the privacy policy that CAIXABANK sent to the complainant in its communications, it is stated, in the section referring to the data retention period, among other matters, that, with regard to the retention of authorizations for processing based on consent, "If you cancel all your contracts for products and services with the companies of the CAIXABANK group, but do not revoke the consents you have given us, we will automatically render them null and void as soon as you cease to be a customer."
LEGAL BASIS
I
Jurisdiction
In accordance with the powers granted to each supervisory authority by Article 58.2 of Regulation (EU) 2016/679 (the General Data Protection Regulation, hereinafter GDPR) and as established in Articles 47, 48.1, 64.2, and 68.1 of Organic Law 3/2018, of December 5, on the Protection of Personal Data and the Guarantee of Digital Rights (hereinafter LOPDGDD), the President of the Spanish Data Protection Agency is competent to initiate and resolve this procedure.
Likewise, Article 63.2 of the LOPDGDD establishes that: "The procedures processed by the Spanish Data Protection Agency shall be governed by the provisions of Regulation (EU) 2016/679, by this Organic Law, by the regulatory provisions issued in its development and, insofar as they do not contradict them, in a subsidiary manner, by the general rules on administrative procedures."
II
Preliminary Questions
In the present case, in accordance with the provisions of Articles 4.1 and 4.2 of the GDPR, personal data processing is established, since CAIXABANK collects and stores, among others, the following personal data of natural persons: first and last name, date of birth, ID number, among other processing data.
CAIXABANK carries out this activity in its capacity as data controller, as it determines the purposes and means of such activity, pursuant to Article 4.7 of the GDPR.
III
Response to the allegations raised regarding the initiation agreement
In response to the allegations presented by the respondent entity, the following should be noted:
1. Opposition to the initiation agreement. No infringement.
CAIXABANK makes this statement based on the fact that the complainant had entered into a mortgage-secured credit agreement, and that these were two independent legal transactions, each of which should be cancelled individually.
However, the deed of incorporation of said legal transaction states that it is a mortgage loan, established, as previously stated, on February 24, 2005.
Thus, the notarial deed states:
"I identify you by presenting your identification documents, and you have, in my opinion, the legal capacity necessary for this MORTGAGE-SURED LOAN deed (...)" (Emphasis added).
The notarial deed continues:
“Third. - That both parties formalize this mortgage-secured loan transaction, pursuant to the following clauses:
(…)
In the FIFTH AGREEMENT. Expenses borne by the accredited party, it is noted:
“The ACCREDITED PARTY assumes payment of the appraisal costs of the mortgaged property, all other expenses and taxes arising from this deed, the acts and contracts formalized herein, and its registration in the Property Registry, and those arising from any grants required for this document and its cancellation to be accessible to the Property Registry, including those caused by letters of full or partial payment of the credits, and those arising from the management of the corresponding deeds for their registration in the aforementioned Registry (…)”
In the SEVENTH AGREEMENT. Credit Account, it is stated:
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 16/29
“Only the following items may be charged to the credit account:
(…)
"la Caixa", as of the date of early or final maturity of the credit, whether in whole or in part, will liquidate the account according to its books. "la Caixa" will notify the CREDITED PARTY of the extract of said liquidation by any means permitted by law, without prejudice to doing so through judicial or notarial means, in the cases where the law so prescribes, and the maturity of the credit will be deemed to have occurred on the date to which the liquidation refers.
(…)
The liquidation balance of the credit account will be certified by a certificate from
"la Caixa" for the purposes of exercising any type of enforcement action within its jurisdiction, especially those relating to the mortgaged property.”
The EIGHTH AGREEMENT of the notarial deed states:
“Establishment of a mortgage.
As security for payment to “la Caixa” of the balance resulting from the liquidation of the interest account, up to the amount of (…) without prejudice to the joint and unlimited liability
of the borrowers, a mortgage is established in favor of la Caixa on the property
described above. (…)”
In the NINTH AGREEMENT. Scope of the guarantee, it is noted
(…)
“The CREDITED PARTY [or, "the non-debtor mortgagor"] grants "la Caixa" the right and express mandate to collect compensation for damages or compulsory expropriation directly from the insurance company or the
Government, to apply them, to the extent applicable, to the total or partial extinction of the credit and the obligations arising therefrom. "la Caixa" will deliver to the mortgagor any excess compensation, if any."
On the other hand, the file contains the notarial deed of "LETTER OF PAYMENT AND CANCELLATION OF MORTGAGE," dated February 29, 2008, where you can read:
(...) representative powers for the execution of this deed of LETTER OF PAYMENT AND CANCELLATION OF MORTGAGE.
I IDENTIFY you by showing your aforementioned identification document, and you have, in my opinion, the necessary legal capacity to execute this deed of LETTER OF PAYMENT AND CANCELLATION OF MORTGAGE and, to this end, according to the intervenor,
EXPOSES:
I. – That by deed authorized on February 24, 2005, by the notary (...) opened a credit account in favor of (...)
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 17/29
And by virtue of the related deed, Responding for the liabilities
that will be stated, the following property:
URBAN. – HOUSING located at (…)
HAS BEEN LIABLE FOR:
Up to ***AMOUNT.2 as a credit limit, up to (…)
II). – That the Commercial Entity “LA CAIXA (…)” has been reimbursed for the principal for which the property is liable, plus accrued interest. And for the record,
the appearing party, according to the parties involved,
GIVES:
That she gives a payment receipt for the amount of ***AMOUNT.2, consequently canceling the
mortgage affecting the described property, with respect to the related loan, and consents
that this cancellation be recorded in the Property Registry.
PAYMENT METHOD. – By means of various deposits into the account into which the payments were
directly debited
(…)
It is hereby stated that this cancellation deed has been requested by (…)”
On April 12, 2023, CAIXABANK sent the complainant a response to a request for access to the personal data that CAIXABANK held on the complainant. The response reads, among other things:
“Product: Open mortgage
Granted: ***AMOUNT.2
Date of incorporation: 02/24/2005.”
From all this documentation, it is concluded that the contract that the complainant had with CAIXABANK was a mortgage loan contract,
established in the same notarial deed.
Thus, the mortgage guarantee, as constituted in this case, is a property right of an accessory nature that has been established on a real estate property to ensure compliance with the principal obligation, or loan, which was
for ***AMOUNT.2.
To guarantee repayment of the loan, the claimant presents their property
as collateral for the loan obtained, so that, if they default,
CAIXABANK has the right to foreclose on the mortgage and sell the property to
recover the money borrowed.
In the case at hand, CAIXABANK has stated that the reason the claimant's data remained in its systems was because, with the creation
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 18/29
of the mortgage-secured loan, they were actually creating
two separate legal transactions: on the one hand, a loan agreement, and, on the other, a mortgage guarantee.
As already stated, a reading of the notarial documents clearly concludes that, in fact, a mortgage-secured loan was established. In the event that the claimant was unable to repay the loan, the property could be foreclosed on, as stipulated in the ninth agreement.
Furthermore, in the cancellation deed dated February 29, 2008, it can also be read that a payment note was issued for the amount of ***AMOUNT.2 and that, therefore, the mortgage affecting the property described in relation to the related loan was canceled.
That is, a payment note was issued upon repayment of the borrowed amounts.
Therefore, the security interest in the property was canceled, as it was no longer necessary since all the borrowed amounts had been repaid.
Furthermore, when CAIXABANK responded to the complainant's request for access in April 2023, CAIXABANK stated that the only product the complainant had was an "open mortgage."
However, on February 26, 2024, CAIXABANK submitted a response to this Agency, having been informed of the filing of the appeal for reconsideration by the claimant, which expressly states:
“(…)
On the indicated date (…) Claimant was listed as a customer in the CAIXABANK systems as the holder of a mortgage loan, which is why it had received the communication referred to in the previous point.
(…)
On February 12, 2024, the Agency sent CaixaBank a new notification
regarding the file of (…) Claimant, informing the interested party of the hearing on the optional appeal for reconsideration. In this letter, CAIXABANK is informed that
(…) Claimant has filed an optional appeal for reconsideration, alleging that
he is not a customer of the Entity, since the mortgage-secured contract that was listed
in the systems CAIXABANK, signed on February 24, 2005, had been canceled
on February 29, 2008, by means of a deed of payment and cancellation of the mortgage granted before the notary of (...).
V. That CAIXABANK's internal regulations, mandatory for all employees, detail the currently valid process for canceling mortgage guarantees, which is completely centralized and establishes that, once a contract with a mortgage guarantee has been financially canceled, the mortgage can be canceled by a notary at the customer's request. In such a case, CAIXABANK will be required to execute a deed of cancellation, which must be registered in the property registry.
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 19/29
The signing of notarial cancellations is centralized in certain notaries' offices and
is managed by two cancellation centers that are automatically assigned to the cancellation requests made by the branches.
These cancellation centers act as representatives of CAIXABANK and centralize
the cancellation process, from the receipt of the documentation sent by the branch to the settlement of the provision of funds to the client, if applicable, or
to the signing of the deed, if there is no provision of funds.
Once the transaction has been signed by the cancellation center, the branch must enter the
cancellation request on the terminal (with or without provision) through the "Registration Cancellation Request" application.
VI. That, upon receiving this last document described in the previous paragraph, without the
documentation attached by (...) the claimant, CAIXABANK has proceeded to
locate the documentation associated with the mortgage loan at issue in the
claim. It is attached as Annex I.
We have been able to verify that the Bank's employee appeared
in person before the notary to execute the cancellation deed and payment letter
referred to by (...) the Claimant, but that said employee did not
complete the process in the Bank's internal systems.
The centralized mortgage loan cancellation system described in the
previous section V, implemented after the events that are the subject of this
claim (2008), is designed to streamline the process of
notarial cancellation of mortgage loans and their timely registration,
as well as to prevent incidents in the procedure by minimizing the intervention
of branch staff in the process."
Likewise, among the documentation you provided on February 26, 2024, in the response to the appeal for reconsideration filed by the complainant, is a letter dated February 12, 2024, sent to the complainant, which reads:
“(…)
We inform you that, after analyzing the information you provided in said letter,
we have located the documentation associated with the mortgage loan you refer to
in your letter, canceling it in our systems. Therefore, we confirm
that currently there are no current contractual relationships in our systems
under your ownership, and that CaixaBank is not processing your
personal data. We attach to this letter our response to your right of access.
(…)”
Therefore, in accordance with the foregoing, the claim presented by CAIXABANK must be rejected insofar as it cannot be understood that the complainant requested a loan on the one hand and a mortgage guarantee on the other.
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 20/29
IV
Response to the allegations regarding the proposed resolution of the sanctioning procedure
In relation to the allegations presented in relation to the proposed resolution of this sanctioning procedure, the following are answered in the order presented by CAIXABANK.
First. Non-existence of infringement.
In this claim, CAIXABANK sets out the differences between a loan contract and a credit contract, and then states that the proposed resolution stated that the legal transaction that led to the opening of this sanctioning procedure was a contract. of a mortgage-secured loan, and conclude by pointing out that the terminology does not affect the legal nature of the contract.
The first thing to keep in mind is that the reason for the opening of this sanctioning procedure is the fact that the complainant had received a communication updating the Privacy Policy, informing them of the existence of certain processing operations to be carried out, together with other group companies, and with the aim of offering products and services that are as personalized as possible. They also informed them that they would contact the complainant shortly to see if they consented to said processing, and not whether the contract they had signed was a loan or credit secured by a mortgage.
The explanation provided in the proposal aimed to determine whether there was, in fact, a legal basis legitimizing the processing based on the existence of a valid contract (Article 6.1.b) of the GDPR). Regarding this possibility, we refer to the provisions of legal grounds III of Response
to the allegations raised regarding the initial agreement.
On the other hand, CAIXABANK itself, when submitting its written allegations, states in
paragraph A, "according to the AEPD, the contract signed on February 24, 2005, is not a loan contract."
However, and as also stated in the proposed resolution, the
communication sent to the complainant on February 26, 2024, stated:
"(...)
We are contacting you in response to your appeal for reconsideration
filed with the Spanish Data Protection Agency on June 21, 2023, against the resolution issued by said agency closing your claim (...)
We inform you that, after analyzing the information you provided in said letter,
we have located the documentation associated with the mortgage loan referred to in your letter, canceling it in our systems. Therefore, we confirm that there are currently no current contractual relationships in our systems.
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 21/29
owned by you, and that CaixaBank is not processing your personal data. We attach our response to your right of access to this document.
(…)”
Furthermore, on February 26, 2024, and after submitting to CAIXABANK the filing of the Appeal for Reconsideration against the resolution to dismiss the proceedings,
the entity submitted a document stating:
“(…)
In this document, CaixaBank is informed that the complainant has filed
an optional appeal for reconsideration alleging that it is not a customer of the entity, since
the mortgage-secured contract recorded in CaixaBank's systems
signed on February 24, 2005, had been canceled on February 29, 2008,
through a deed of payment and cancellation of mortgage executed before a
notary (…).
V. That CaixaBank's internal regulations, mandatory for all
employees, detail the currently applicable process for canceling mortgage guarantees,
which is completely centralized and establishes that: Once a mortgage-backed contract has been financially cancelled, the mortgage can be cancelled at the customer's request.
(…)
These cancellation centers act as representatives of CaixaBank and centralize the cancellation process, from the receipt of the documentation sent by the branch to the settlement of the provision of funds to the customer, if applicable, or until the signing of the deed, if there is no provision of funds.
Once the transaction has been signed by the cancellation center, the branch must enter the cancellation request on the terminal (with or without provision) through the "Registration Cancellation Request" application.
VI. That, upon receipt of this last document described in the previous section, without the documentation attached by the claimant, CaixaBank has proceeded to locate the documentation associated with the mortgage loan at issue in the claim. (…)
We have been able to verify that the entity's employee appeared
in person before the notary to execute the cancellation deed and payment letter
referred to by the complainant, but that said person did not complete the
process in the entity's internal systems.
(…)
VII. Finally, please note that the aforementioned internal process has been carried out.
A screenshot is provided showing the internal cancellation of the mortgage loan in our systems.
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 22/29
Therefore, in this case, despite the different names used to refer to the legal transaction that linked the complainant to CAIXABANK (mortgage loan, open mortgage, mortgage-secured loan), it is clear that the legal transaction that linked the complainant to CAIXABANK had been cancelled, and that, as the entity explained in its letter dated February 26, 2024, the person employed by the entity appeared to execute the cancellation deed and payment letter referred to by the complainant, but said person did not complete the process in the entity's internal systems.
Furthermore, when on April 12, 2023, CAIXABANK sent the complainant the response to its request for access, It clearly states
"product: open mortgage" "D.Constit. 02/24/2005" and, according to the "mortgage payment and cancellation letter" dated February 29, 2008, issued before a notary,
said mortgage had already been cancelled.
Furthermore, what CAIXABANK stated in its written allegations is not true when it states that the mortgage guarantee was established to secure only the first drawdown of the loan, so that upon payment of this drawdown, the mortgage could be cancelled without terminating the credit account contract.
The truth is that the established mortgage guaranteed payment of the balance resulting from the liquidation of the interest account.
Therefore, in accordance with the foregoing, this allegation cannot be taken into account.
Second. Violation of the principle of proportionality.
CAIXABANK points out that the penalty is disproportionate and cites Article 29.3 of Law 40/2015 and a ruling by the National Court of November 18, 2022.
Regarding the breach of the principle of proportionality, it is necessary to state that the GDPR expressly provides for the possibility of gradation, by establishing fines that can be adjusted based on a series of effective, proportionate, and dissuasive circumstances in each individual case.
(Articles 83.1 and 83.2 of the GDPR), these being general conditions for the imposition of administrative fines that have been analyzed by this Agency, to which must be added the gradation criteria provided for in the LOPDGDD.
It should be noted that the agreed administrative fine will be effective because it will lead
the company to implement technical and organizational measures that guarantee the rights and freedoms of data subjects, taking into account the criticality of the processing.
It is also proportional to the identified violation, particularly its severity, the
circle of individuals affected, the risks incurred, and the company's financial situation.
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 23/29
Finally, it is dissuasive. A deterrent fine is one that has a genuine deterrent effect. In this regard, the judgment of the CJEU of 13 June 2013,
Versalis Spa v Commission, C-511/11, ECLI:EU:C:2013:386, states:
“94. With regard, first of all, to the reference to the aforementioned Showa Denko v Commission judgment, it should be noted that Versalis interprets it incorrectly. Indeed, the Court of Justice, in stating in paragraph 23 of that judgment that the deterrent factor is assessed taking into account a multitude of elements and not only the particular situation of the undertaking concerned, was referring to points 53 to 55 of the Opinion presented in that case by Advocate General Geelhoed, who had essentially stated that the deterrent factor may be intended not only to achieve “general deterrence,” defined as an action to discourage all undertakings. "companies, in general, from committing the infringement in question, but also a "specific deterrence," consisting of discouraging the specific defendant
from violating the rules again in the future. Therefore,
the Court of Justice only confirmed, in that judgment, that the Commission was not
required to limit its assessment to factors related
solely to the particular situation of the company in question."
“102. According to settled case law, the objective of the deterrent multiplier factor and, in this context, of the size and overall resources of the undertaking in question lies in the desired impact on the undertaking in question, since the penalty must not be insignificant, especially in relation to the undertaking's financial standing (to this effect, see, in particular, Case C-413/08 P Lafarge v Commission [2010] ECR I-5361, paragraph 104, and the order of 7 February 2012 in Total and Elf Aquitaine v Commission [2012] ECR, paragraph 82).”
The ruling of May 11, 2006, issued in cassation appeal 7133/2003 establishes that: "It must also be taken into account that one of the criteria governing the application of this principle of the administrative sanctioning regime (a criterion included under the heading of "principle of proportionality" in section 2 of Article 131 of the aforementioned Law 30/1992) is that the imposition of financial penalties should not imply that the commission of the classified offenses is more beneficial to the offender than compliance with the violated rules."
Also important is the jurisprudence resulting from the Judgment of the Third Chamber of the Supreme Court, issued on May 27, 2003 (rec. 3725/1999), which states: Proportionality, pertaining specifically to the scope of sanctions, constitutes one of the principles governing administrative sanctioning law and represents an instrument for controlling the exercise of the sanctioning power by the Administration, even within the limits that, in principle, the applicable law establishes for such exercise. It certainly represents a concept that is difficult to determine a priori, but it tends to adapt the sanction, by establishing its specific gradation within the indicated possible margins, to the seriousness of the act constituting the offense, both in terms of unlawfulness and culpability, weighing the overall objective and subjective circumstances that comprise the punishable fact—and, in particular, as stated in Article 131.3 of the LRJ and PAC, the intentionality or repetition, the nature of the damage caused, and the recurrence of the offense. (Supreme Court Judgments of July 19, 1996, February 2, 1998, and December 20,
1999, among many others).
In accordance with the above, it should not be forgotten that CaixaBank has a turnover of ***AMOUNT.1 euros in 2023, as stated in the ninth paragraph, and this was previously taken into account when determining the amount of the fine.
Furthermore, in accordance with Article 83.5 of the GDPR, violations of Article 5 of the GDPR may be sanctioned with an administrative fine of 20,000,000 euros, or, in the case of a company, with an amount equivalent to a maximum of 4% of the total annual turnover of the previous financial year. The amount imposed in this sanctioning procedure is within the range provided for in said article, which is low.
In turn, CAIXABANK makes the following statements regarding the circumstances taken into account to determine the amount of the fine:
i) Regarding the circumstance relating to the nature, severity, and duration of the violation, it states that only one person is affected, and that the processing is not a habitual or repeated occurrence, as there are no prior complaints from other data subjects regarding the data processing that CaixaBank carries out in connection with the management of mortgage guarantee contracts. Furthermore, it
understands that the damages would be minimal, and that the complainant's data would not have been processed for other purposes that could be considered harmful.
However, this Agency has already determined that the violation attributed to
CAIXABANK is having retained the complainant's data for a period of almost 16 years, a situation that has nothing to do with the legal transaction that was entered into with CAIXABANK.
On the other hand, CAIXABANK states that the damages caused to the complainant would be minimal, and that they would not have been processed for a purpose that
could be considered to have a more detrimental impact, such as purposes
for which consent is required.
However, this Agency disagrees with this statement, since it should not be forgotten that this sanctioning procedure is motivated by the fact that the entity
sent a letter to the complainant on October 9, 2022, that is, 14
years, 7 months, and 9 days after the cancellation of the mortgage-secured loan agreement, specifically requesting their consent to process their data together
with other companies in the CAIXABANK group, and informing them that they would
contact A.A.A. to inform them of everything they could offer.
Therefore, this claim cannot be taken into account.
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 25/29
ii) Regarding the aggravating factor relating to previously committed violations,
CAIXABANK states that, in the proceedings referred to, Article 5.1.e) of the GDPR is not being imputed and, therefore, the sanction is disproportionate, as there are no prior violations to the same infringement.
However, section e) of Article 83.2 of the GDPR expressly includes "any prior violation committed by the controller." Therefore, all the cases reflected in the initiation agreement and the proposed resolution would be included within the scope of the aggravating factor, taking into account that at no point is it indicated that
such violations must be the same as the case in question. This applies to any violation committed by the responsible entity that has been verified
before the resolution assessing these previous violations is issued.
Therefore, this claim cannot be taken into account.
V
Unfulfilled Obligation
Article 5.1.e) of the GDPR establishes the principles relating to processing:
“1. Personal data shall be:
(…)
e) kept in a form which permits identification of data subjects for no longer than
longer than necessary for the purposes for which the personal data are processed; personal data may be retained for longer periods provided that they are
processed exclusively for archiving purposes in the public interest, scientific or historical research purposes, or statistical purposes, in accordance with Article 89(1),
without prejudice to the implementation of appropriate technical and organizational measures imposed by
this Regulation to protect the rights and freedoms of the data subject ("retention period limitation");
Recital 39 of the GDPR establishes that “(…) Personal data must be adequate, relevant, and limited to what is necessary for the purposes for which they are processed. This requires, in particular, ensuring that their retention period is limited to a strict minimum. Personal data should only be processed if the purpose of the processing cannot reasonably be achieved by other means. To ensure that personal data are not retained longer than necessary, the data controller must establish deadlines for their deletion or periodic review. (…)”
In the case at hand, the complainant states that in November 2022, they received a communication at their home address by mail informing them of an update to their Privacy Policy and of the existence of certain processing operations to be carried out, together with other group companies, for the purpose of offering personalized products and services, and always with the customer's consent.
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 26/29
The complainant exercised their right of access on November 9, 2022, in order to learn what personal data CAIXABANK was processing, indicating that they are not a customer of the bank.
By granting access to said personal data, the complainant learned that the data being processed was a result of having entered into a mortgage guarantee agreement with CAIXABANK.
The complainant The complainant stated that the contract had been canceled on
February 29, 2008, by means of a deed of payment and cancellation of mortgage executed before a Notary Public.
In the hearing of the appeal for reconsideration filed by the complainant, CAIXABANK claims that it has located the notarial deed of payment and cancellation of mortgage, verifying that the procedure was not completed in the internal systems, and that the contract therefore remained active. It also states that this procedure has already been executed, and the mortgage loan has been canceled in the systems, confirming that no further processing of the complainant's data is being carried out.
Therefore, almost 16 years had elapsed from the date of cancellation of the mortgage contract until the sending of this communication. This action by CAIXABANK constitutes a violation of Article 5.1.e) of the GDPR.
Therefore, it is considered that the known facts constitute an infringement,
attributable to CAIXABANK, for violation of Article 5.1.e of the GDPR.
IV
Classification and qualification of the infringement of Article 5.1.e of the GDPR
The known facts could constitute an infringement, attributable to CAIXABANK, classified in Article 83.5 of the GDPR, under the heading "General conditions for the imposition of administrative fines," which provides:
"Infringements of the following provisions shall be punished, in accordance with
paragraph 2, with administrative fines of a maximum of EUR 20,000,000 or,
in the case of a company, an amount equivalent to a maximum of 4% of the total global annual turnover of the preceding financial year, whichever is higher:
a) the basic principles for processing, including the conditions for consent
under Articles 5, 6, 7, and 9; (…)”
For the purposes of the statute of limitations for violations, the alleged violation is subject to a three-year statute of limitations, in accordance with Article 72 of the LOPDGDD (Organic Law on Personal Data Protection), which classifies the following conduct as very serious:
“1. Pursuant to the provisions of Article 83.5 of Regulation (EU) 2016/679, violations that involve
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 27/29
a substantial violation of the articles mentioned therein and, in particular, the
following are considered very serious and will be subject to a three-year statute of limitations:
a) The processing of personal data in violation of the principles and guarantees
established in Article 5 of Regulation (EU) 2016/679. (…)”
V
Penalty for violation of Article 5.1.e) of the GDPR
For the purposes of deciding on the imposition of an administrative fine and its amount, it is considered appropriate to grade the sanction to be imposed according to the following criteria established in Article 83.2 of the GDPR:
- The nature, severity, and duration of the violation, taking into account the nature,
scope, or purpose of the processing operation in question, as well as the number
of data subjects affected and the level of damages they have suffered
(paragraph a): for having kept the complaining party's personal data for longer than necessary for the purposes of the processing, having been kept from February 29, 2008, to February 23, 2024, for almost 16 years.
- Any previous violation committed by the controller or processor
(paragraph e): It is noted that on October 19, In 2023, a resolution was issued in
procedure No. EXP202302279, for a violation of Article 6.1 of the GDPR.
It is noted that on October 26, 2023, a resolution was issued in procedure No.
EXP202206311, for a violation of Articles 5.1.f), 25, and 32 of the GDPR. It is noted that on
May 22, 2023, a resolution was issued in procedure No. EXP202306258,
for a violation of Article 32 of the GDPR.
Furthermore, it is considered appropriate to grade the sanction to be imposed according to the
following criteria established in section 2 of Article 76 "Sanctions and corrective measures" of the LOPDGDD:
- The connection between the offender's activity and the processing of personal data (Section b): CAIXABANK is accustomed to the processing of personal data, to the extent that the entity requires the personal data of its customers to conduct its business.
The balance of the circumstances contemplated in Article 83.2 of the GDPR and Article 76.2 of the LOPDGDD, with respect to the infringement committed by violating the provisions of Article 5.1.e) of the GDPR, allows for the imposition of a fine of €200,000.
Therefore, in accordance with applicable legislation and having assessed the criteria for graduating the sanctions whose existence has been proven, the Presidency of the Spanish Data Protection Agency RESOLVES:
FIRST: TO IMPOSE on CAIXABANK, S.A., with NIF A08663619, for an infringement of Article 5.1.e) of the GDPR, classified in Article 83.5.a) of the GDPR, a fine of
200,000 euros (two hundred thousand euros).
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 28/29
SECOND: NOTIFY this resolution to CAIXABANK, S.A.
THIRD: This resolution will become enforceable once the deadline for filing the
optional appeal for reconsideration expires (one month from the day following notification of this resolution) without the interested party having exercised this right.
The sanctioned party is advised that they must pay the imposed sanction once this resolution becomes enforceable, in accordance with the provisions of Article 98.1.b)
of Law 39/2015, of October 1, on the Common Administrative Procedure of Public Administrations (hereinafter LPACAP), within the voluntary payment period
established in Article 68 of the General Regulations of Collection, approved by Royal Decree 939/2005, of July 29, in relation to Article 62 of Law 58/2003, of December 17, by depositing the fine, indicating the NIF of the sanctioned party and the procedure number shown in the heading of this document, into the restricted account IBAN: ES00-0000-0000-0000-0000-0000, opened in the name of the Spanish Data Protection Agency at the banking entity CAIXABANK, S.A.
Otherwise, collection will be carried out during the enforcement period.
Once the notification is received and enforced, if the enforcement date is between the 1st and 15th of each month, both inclusive, the deadline to make the voluntary payment will be until the 20th of the following month or the next business day after. It is
between the 16th and the last day of each month, inclusive. The payment deadline
will be until the 5th of the second following month or the next business month after.
In accordance with Article 50 of the LOPDGDD (Organic Law on the Protection of Personal Data), this
Resolution will be made public once it has been notified to the interested parties.
Against this resolution, which ends the administrative process pursuant to art. 48.6 of the LOPDGDD, and in accordance with the provisions of Article 123 of the LPACAP, interested parties may optionally file an appeal for reconsideration before the President of the Spanish Data Protection Agency within one month from the day following notification of this resolution, or directly file an administrative appeal before the Administrative Litigation Division of the National Court, in accordance with the provisions of Article 25 and Section 5 of the Fourth Additional Provision of Law 29/1998, of July 13, regulating the Administrative Litigation Jurisdiction, within two months from the day following notification of this decision, as provided for in Article 46.1 of the aforementioned Law.
Finally, it is noted that pursuant to the provisions of Art. 90.3 a) of the LPACAP (Spanish Data Protection Act), a final administrative decision may be provisionally suspended if the interested party expresses their intention to file an administrative appeal.
If this is the case, the interested party must formally notify this fact in writing to the Spanish Data Protection Agency, submitting it through the Agency's Electronic Registry [https://sedeaepd.gob.es/sede-electronica-
web/], or through one of the other registries provided for in Article 16.4 of the aforementioned Law 39/2015, of October 1. They must also forward to the Agency the
documentation proving the effective filing of the administrative appeal. If the Agency does not become aware of the filing of the administrative appeal within two months from the day following notification of this resolution, it will terminate the provisional suspension.
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 29/29
938-100325
Lorenzo Cotino Hueso
President of the Spanish Data Protection Agency
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es
