AEPD (Spain) - EXP202404507
From GDPRhub
| AEPD - EXP202404507 | |
|---|---|
 | |
| Authority: | AEPD (Spain) |
| Jurisdiction: | Spain |
| Relevant Law: | Article 5(1)(f) GDPR Article 32 GDPR |
| Type: | Complaint |
| Outcome: | Upheld |
| Started: | 24.02.2025 |
| Decided: | 16.01.2026 |
| Published: | |
| Fine: | 400000 EUR |
| Parties: | UNICAJA BANCO, S.A. |
| National Case Number/Name: | EXP202404507 |
| European Case Law Identifier: | n/a |
| Appeal: | n/a |
| Original Language(s): | Spanish |
| Original Source: | AEPD (in ES) |
| Initial Contributor: | bms |
In addition, the DPA fined a bank €400.000 for allowing numerous of its controller’s staff members to access its CCTV system using a single shared username and password in violation of Article 32 GDPR.
English Summary
Facts
UNICAJA BANCO, S.A. (the controller) is a bank. In 2023, the controller entered into a service provision contract with a private security firm, GRUPO CONTROL EMPRESA DE SEGURIDAD, S.A. (the processor), under which the processor undertook to provide alarm installation and management services for the controller’s offices, buildings and premises, including the operation of alarm control centres and the verification of alarms via video surveillance or CCTV. In that context, the controller operated a video surveillance system connected to a Central Alarm Receiving Centre (CRA) managed by the processor. The CRA staff, composed of ten operators and one coordinator, could access and review recorded CCTV footage, including footage used to verify suspected fraud and identity impersonation cases reported internally by the controller’s Security Department.
A data subject brought a formal complaint with the DPA, prompting it to open an investigation. The controller confirmed that access to the video surveillance system was made through a single shared username and password configured by another contractor responsible for the installation and maintenance of the CCTV system. As a result, the employees assigned to the CRA did not use individual credentials when accessing footage. Although access logs were retained for 90 days, those logs would in any event only show the shared account and the IP address of the terminal used, not the identity of the individual operator who had accessed the images.
The investigation also showed that the contractual framework between the controller and the processor formally required nominal user accounts, role-based access, and traceability. However, the authority concluded that these requirements had not been effectively implemented in practice. The investigation further noted that the controller’s DPIA and internal documentation already identified the need for formal user registration, periodic review of access rights, and logging of user activity, but those controls had not been operationalised in the relevant processing environment.
In addition, the AEPD considered that the controller had not provided operational instructions with little specificity on how stored images were to be accessed, reviewed, or extracted in response to internal requests. The internal CRA protocol mainly regulated alarm handling, incidents and communications, but did not lay down detailed rules governing access to stored footage.
Holding
The DPA held that the controller infringed Article 32 GDPR by failing to implement appropriate technical and organisational measures to ensure the security of the processing of CCTV footage. In particular, the use of a generic shared account for access to surveillance images prevented proper attribution of actions to individual users and undermined access control and traceability in relation to a processing operation involving sensitive security-related footage.
The DPA rejected the controller argument that the failure was attributable solely to its processor. It found that, even if contractual clauses required nominal accounts and role-based permissions, the controller remained responsible for ensuring that those measures were actually implemented and effectively supervised. The DPA also stressed that the audits and controls carried out by the controller had not focused on the most critical issue in this case, namely who could access the footage, under which profile, and with what degree of traceability.
The DPA fined the controller €500,000 in total for the violation of article 32 GDPR. Pursuant to Law 39/2015, a Spanish law concerning administrative proceedings, the DPA informed the controller that it may make a voluntary payment of the proposed fine and waive their right to appeal. This action reduces the imposed fine by 20%. The controller opted to make a voluntary payment and reduced the fine by 20%, paying the reduced sanction amount of €400,000.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Spanish original. Please refer to the Spanish original for more details.
1/55 • File No.: EXP202404507 RESOLUTION OF TERMINATION OF PROCEEDINGS DUE TO VOLUNTARY PAYMENT From the proceedings initiated by the Spanish Data Protection Agency and based on the following: BACKGROUND FIRST: On February 24, 2025, the Spanish Data Protection Agency (AEPD) agreed to initiate sanctioning proceedings against UNICAJA BANCO, S.A.U., with Tax Identification Number (NIF) A93139053. Having been notified of the initiation agreement and after analyzing the allegations presented, on January 16, 2026, the following Proposed Resolution was issued: << File No.: EXP202404507 PROPOSED RESOLUTION OF SANCTIONING PROCEEDINGS From the proceedings initiated by the Spanish Data Protection Agency and based on the following: BACKGROUND FIRST: Complaints to the Spanish Data Protection Agency As a result of a complaint, the Spanish Data Protection Agency has become aware of certain facts that could constitute a possible breach of data protection regulations, attributable to UNICAJA BANCO, S.A.U. with Tax Identification Number (NIF) A93139053 (hereinafter, UNICAJA), in relation to the system established for the processing, analysis, management, and safekeeping of images captured by the video surveillance systems used by UNICAJA as a preventative measure against the commission of crimes. According to the reported facts, UNICAJA had an Alarm Receiving Centre (hereinafter, ARC) staffed by eleven operators who worked for Gestión de Actividades y Servicios Empresariales S.L. (hereinafter, GDA), a service company within the UNICAJA group of companies. In addition to the ARC service, GDA also performed private security functions, despite not being registered on the list of security companies of the Private Security Unit of the National Police Directorate, a requirement for carrying out such functions. According to the complaint, on March 18, 2019, UNICAJA contracted the CRA (Centralized Alarm Receiving) service with the private security company Grupo Control Empresa de Seguridad, S.A. (hereinafter, Grupo Control). The eleven GDA employees were then incorporated into Grupo Control. In addition to their CRA functions, they were responsible for the processing, analysis, management, and safekeeping of images captured by the video surveillance systems. They had unrestricted access to all equipment, software, and materials, regardless of their position, C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeaepd.gob.es 2/55 sharing user profiles and accessing highly sensitive information. SECOND: Agreement to Carry Out Preliminary Investigative Actions As a consequence of the known facts, on March 22, 2024, the Director of the Spanish Data Protection Agency instructed the Deputy Directorate General for Data Inspection (SGID) to initiate the preliminary investigative actions referred to in Article 67 of Organic Law 3/2018, of December 5, on the Protection of Personal Data and Guarantee of Digital Rights (hereinafter, LOPDGDD). THIRD: Preliminary Investigative Actions The Deputy Directorate General for Data Inspection carried out preliminary investigative actions to clarify the facts in question, pursuant to the functions assigned to supervisory authorities in Article 57.1 and the powers granted in Article 58.1 of Regulation (EU) 2016/679 (General Data Protection Regulation, hereinafter GDPR), and in accordance with the provisions of Title VIII of the LOPDGDD (Spanish Organic Law on Data Protection and Digital Rights). The documentation attached to the complaint was examined first, consisting mostly of emails addressed to the CRA (Central Reception Desk), sent primarily by the UNICAJA Security Department, reflecting requests for access to images, and reply emails with the results of the checks carried out on the images from the video surveillance system. The following cases can be cited as examples of these emails: In an email dated March 31, 2023, at 1:57 PM, the Security Department requested a review of images from the Central Receiving Agency (CRA), requesting a report on viewing previously requested images related to a withdrawal allegedly involving identity theft, to determine whether or not it is the customer (a request for custody of the images had been made beforehand). The email indicated the date and time of interactions in the information system for the transaction and attached images of the fronts of the ID cards of both the employee and the customer. In its response, the CRA stated, “Good morning, the security camera footage shows that the person making the withdrawal at the teller window at 8:33 AM is not the same person as the attached ID card. […] the customer hands the teller an ID card.” In an email dated May 11, 2023, the Security Department of UNICAJA forwarded a request to verify images captured on January 31, 2023, indicating that they had to be saved at the request of the police. It is stated that this involves identity theft of a client, and details of the date, time, and branches are provided. Confirmation is requested, if possible, that it was not the client, whose photograph extracted from the ID card is provided. Furthermore, during the investigation, the following information and documentation were requested from UNICAJA, with the following result: POINT 1.A A copy of the contract(s) signed with Grupo C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeaepd.gob.es 3/55 Control for the Video Surveillance System and CRA service. All data protection clauses, including any signed addenda or annexes, have been requested. UNICAJA has provided a copy of the contract formalized on January 1, 2023, which includes, as Annex VII, the Addendum for the Processor of Personal Data responsible for UNICAJA. It also includes Annex VIII with Information Security Requirements. It has been verified that the aforementioned Addendum for the Processor includes, among other stipulations, that the processor will act following the instructions of the controller, that the personal data processed may not be used for any purpose other than the execution of the service, that it will be confidential and will not be published or disclosed to third parties without the prior written authorization of the controller. It also includes references to security measures and the return or destruction of data upon termination of the relationship. They indicate that they wish to highlight that UNICAJA has an approved Internal Procedure for the Approval of Suppliers/Data Processors, in order to verify that they offer sufficient guarantees regarding the protection of personal data, in accordance with the provisions of Article 28.1 of the GDPR. For this purpose, they provide the completed Questionnaire with the aforementioned approval, stating that, based on the responses provided, Grupo Control offers sufficient guarantees with respect to specialized knowledge, reliability, and resources, for the application of technical and organizational measures that comply with the requirements of current data protection regulations, including the security of the processing; that is, it offers sufficient guarantees to act as the entity's Data Processor. It is verified that the aforementioned questionnaire consists of control questions for the Data Processor in order to determine whether it offers sufficient guarantees regarding the protection of personal data. Regarding technical and organizational measures, it is stated: “Is there a control and access policy for the media containing personal data? Yes.” A copy of the previous contract with Grupo Control was requested, and the entity provided a copy of a contract dated February 26, 2019. ITEM 1.B Description of the services contracted with Grupo Control in relation to the video surveillance system. They indicate that the services covered by the contract are outlined in Clause Two, which states: "The purpose of this contract is the provision by Grupo Control, at its own Alarm Receiving Center, of alarm services for the offices, buildings, and premises of Unicaja Banco, including those currently managed from the Alarm Receiving Center operated by Grupo Control and located at ***ADDRESS.1, as well as the new centers that will be directly connected to Grupo Control's Alarm Receiving Center. The service, therefore, C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeaepd.gob.es 4/55 will consist of the reception, verification (non-personal), and, where applicable, transmission of alarm signals related to the security and protection of persons and property to the competent law enforcement agencies, as stipulated in Article 5.1.g) of The Law 5/2014, of April 4, on Private Security. The following are also part of the Service: receiving, monitoring, and notifying the Fire Department of fire signals from connected facilities. It is verified that Clause Two states that, “for greater clarity,” the services expressly included are: “operation of alarm control centers” and “alarm verification by images or CCTV.” They indicate that the Service corresponds to that defined in the Technical Specifications of the tender as "scenario 2," which they attach to the contract as Annex I. In these Specifications, Section 3, concerning Service Requirements, includes the "Video Download." It is verified that the video download is included in Section 3, and it states that "The download of images will be carried out by Unicaja Bank through the specific service contracted for this purpose…". Likewise, Clause Eight, "Systematic," indicates that UNICAJA grants the Company the necessary permissions for the access, processing, and electronic recording of the images. They indicate that the processing of video surveillance is expressly established and regulated in the Addendum for the Data Processor (Clause One). It is verified that in the referred Addendum (Annex VII to the contract), clause one states “Management of Alarm Receiving Center” as the object of processing, and the purpose of processing includes, among others, “Private Security,” “Security and access control to buildings,” and “Video surveillance.” Among the types of personal data listed are “images,” and the categories of data subjects include “clients,” “potential clients,” “employees and equivalent personnel,” as well as “suppliers.” POINT 1.C A copy of the documentation accrediting the company's authorization as a private security company, issued by the competent administrative body of the Ministry of the Interior, has been requested, including the accreditation number and date. A certificate issued by the General Directorate of the Police is attached, stating that Grupo Control is registered in the National Register of Private Security of the Ministry of the Interior under number [number missing in original text]. XXX, since November 27, 1986, and authorized to operate nationwide, among other activities, including the installation and maintenance of security devices, equipment, and systems connected to alarm receiving centers or control or video surveillance centers, and the operation of centers for the connection, reception, verification, and where applicable, response and transmission of alarm signals, as well as the monitoring of any signals from auxiliary devices for the security of persons, movable or immovable property, or compliance with imposed measures, and communication to the competent Security Forces and Agencies in these cases.” ITEM 1.D A copy of the documentation has been requested to verify that the security company has notified the characteristics of the aforementioned installation to the C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeaepd.gob.es 5/55 competent authority in matters of private security. They indicate that the ownership of the video surveillance systems belongs to UNICAJA, with Grupo Control providing the video surveillance service through the Central Monitoring Station (CMS), and that the characteristics of the installation were communicated to the competent authority, through the registration of the contract formalized between UNICAJA and the installation company S&C Automatismos de Seguridad, S.L. (hereinafter Automatismos S&C) dated January 1, 2023. It is verified that the contract was registered with the National Police, on February 15, 2023. ITEM 2.A The list of The individuals from the CRA (Central Alarm Receiving Station) of ***LOCATION.1 who have had access to the image viewing system of the UNICAJA Video Surveillance System from January 2023 to the date of the request, including personnel who left the system during this period. The labor inspection report issued on May 19, 2023, to the CRA service mentioned 11 individuals. They provide a list of 11 individuals (Control Group personnel), of whom 10 are operators, with the category of telephone operators, and one is a shift supervisor (coordinator). Regarding the functions performed, they indicate: - Alarm management according to the protocol defined by the Unicaja Security Department. - Answering telephone calls from the CRA department. - Managing emails from the CRA department account. - Opening the garage access to the building where the CRA is located. Among other duties, they perform the functions of viewing recorded images, as well as checking them, such as those reflected in the Emails of the cases that were attached to the request. The following sections of the Security Services Agreement signed with Grupo Control, dated January 1, 2023, are noteworthy: - Clause Five. - Obligations of Grupo Control “Without prejudice to all the obligations contained in this agreement, the following are specifically established. The organization. Management, control, assurance, remuneration, discipline, and all obligations arising from legislation for an employer with respect to its employees, will correspond to Grupo Control, with respect to its employees assigned to the provision of the service…”. ITEM 2.B Information has been requested regarding whether the CRA employees have or had signed confidentiality agreements. They provided copies of the employment contracts of the 11 employees, verifying that all of them include a confidentiality agreement regarding the data they access, which extends even after the employment relationship has ended (item 2.2 of the contract), among other data protection stipulations. ITEM 2.C Information has been requested regarding whether each person has their own username and password for accessing the Video Surveillance System or if they access it with a generic C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeaepd.gob.es 6/55 username of the System. It has been required to list the user code for each of them and their access profiles. They state that the software supporting the video surveillance system, which is managed by the installation/maintenance company that UNICAJA contracts for the installation of alarms and CCTV, Automatismos S&C, establishes a single username and password, through which access is granted to the personnel designated by Grupo Control, in accordance with the powers conferred by the provider upon each employee. They also state that in Annex VIII of the Service Provision Contract between UNICAJA and Grupo Control, dated January 1, 2023, which they provide, entitled “Information Security Requirements and Technological Risk” (this Annex signed on May 25, 2023), among the security measures established, it is indicated that nominal usernames and passwords must be registered. In Proven Fact Three part of the content of this Annex VIII relating to the Security measures. Furthermore, regarding this matter, it is important to highlight the information provided on the security policy in the offer submitted by Grupo Control for the contract: “Security Objectives and Principles The main objective of Grupo Control's Information Security Policy is to protect the information handled by the company from the various stakeholders, as well as the information systems that support the products and services provided to clients... Security management will be based on the protection of information, taking into account the following security dimensions: Availability. Information must be available when needed. Integrity. Information must be accurate, truthful, and remain unaltered. Confidentiality. Access to information must be granted only by authorized personnel. Authenticity. Information must remain authentic at both the source and destination. Traceability. It must be possible to know who accessed the information and when, and the operations performed on it.” No instructions were given to Automatismos S&C, the company that configured the generic user, regarding security measures, specifically concerning policies for logical access control to the images (user policy and its configuration) in the provided 2023 contract. Therefore, UNICAJA has been asked, in a request for additional information, to provide previous contracts with Automatismos S&C and information on the existence of instructions given to that entity regarding specific security measures for users and their configuration. They have been asked to provide copies of these, if applicable. They have provided contracts prior to the one mentioned, one from January 2018 and another from June 2021. UNICAJA representatives indicated some instructions given to Automatismos S&C regarding security measures, which do not include security instructions for logical access to The images. The instructions provided refer to the Operating System, security patches, event management, backups, etc. However, it is verified that the January 2018 contract includes Annex III of C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeaepd.gob.es 7/55 data protection and IT security. There is also an addendum to the contract that modifies the data protection and security regulations with new Annexes III and IV, which are also provided. No clauses are found in the documentation provided from 2021. The following specific clauses are found in the aforementioned ANNEX IV of 2018: “1.4 The Provider will define the appropriate security roles within its systems to ensure that access is strictly necessary. Unicaja Banco reserves the right to periodically audit the users assigned to the provision of the service.” 1.5 Any change in the provision of this service that involves a modification of the users participating in it (addition, removal, and/or modification of permissions), as well as a modification of the information systems involved in this service, must be immediately communicated by the Provider's contact person to the Unicaja Banco contact person. 1.6 The Provider will have a backup system that guarantees the correct recovery of data. 1.7 The Provider agrees to comply with all current legislation applicable to the service it provides to Unicaja Banco, and the bank is exempt from any liability in this regard. 1.8 All Provider employees who will provide services to Unicaja Banco must be familiar with and comply with Unicaja Banco's Information Security Regulations. 1.9 In accordance with Unicaja Banco's security policies, the identification and authentication mechanisms for accessing the Unicaja Banco network must be nominative. Unicaja Banco also subscribes to the General Information Security Regulations with Automatismos S&C, which state: “Identification and access control to information - The identification and authentication systems at Unicaja Banco are based on a username and password, which must be personal and non-transferable. The user is solely responsible for safeguarding the credentials provided and must not share them with third parties.” In summary, UNICAJA, the entity responsible for data processing, contracted with Automatismos S&C for the installation of the systems. This entity configured a single generic user account for the installation, and it is Grupo Control personnel who use this generic user account. There is no record of a contractual relationship between Grupo Control and Automatismos S&C, as both were contracted by UNICAJA. It can be deduced that there has been no communication between these entities, either directly or through UNICAJA, regarding which users should be configured for access to the video surveillance system. There is, however, an incident reporting channel between the two entities, established by UNICAJA, as reflected in the document “Unicaja Banco CRA Standards, Operating Protocols” (a document that will be mentioned later). This document of instructions to Grupo Control regarding alarm management at the CRA mentions, regarding detected system malfunctions, that C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeaepd.gob.es 8/55 Regarding any incidents that may occur on a daily basis with the systems installed and maintained by Automatismos S&C, the following procedure applies: “- Throughout the day, the Central Receiving Agency (CRA) will compile all detected incidents considered non-urgent that must be resolved by the company responsible for maintaining the Bank's security systems (Automatismos S&C). The following day, all these incidents will be sent in a single Word file first thing each morning to the email address [an email address for Automatismos S&C is specified]. - Daily incidents deemed urgent by the CRA will be sent the moment they are detected by the CRA to the mailbox [an email address for Automatismos S&C is specified]. POINT 3. Regarding the specific access referred to in the emails exchanged in each case between the departments and the CRA, concerning the viewing of recorded images and the checks performed on them, information has been requested regarding the CRA users who accessed the images in each case and their roles. They state that the user accessing the system is logged for 90 days, therefore they cannot provide access log information due to the period to which the accesses refer, which is older than 90 days. The access log would, in any case, reflect access by the generic user configured for use by all Grupo Control employees assigned to the UNICAJA CRA, as well as the IP address, which Could identify the equipment in the monitoring room of the Central Monitoring Station (CMS) from which access is obtained? POINT 4.A Information has been requested regarding whether written protocols exist concerning access to images by the CMS and UNICAJA, as well as image requests, image retention, and checks on images by the CMS, State Security Forces, Judicial Authorities, and UNICAJA employees. A copy of the protocols, if applicable, is requested. UNICAJA representatives have stated that the protocol is included as Annex VI to the contract, which has already been submitted, and that it contains the CMS regulations of UNICAJA. It is verified that the document is titled “Unicaja Bank CMS Regulations, Operating Protocols.” It is confirmed that it is an operating protocol with instructions on how to proceed in response to alarm signals, including the checks to be carried out with the video surveillance system in case of an alarm, and fault management. of communications, fires, etc., but the document does not specify any instructions or information regarding how to proceed with requests for access to stored images. POINT 4.B A copy of the internal regulations, circulars, and instructions addressed to Grupo Control and its staff (from the CRA of Unicaja) regarding the protection of personal data has been requested, specifically regarding the viewing of images and the response to possible requests to view or extract images from the Video Surveillance System by employees of C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeaepd.gob.es 9/55 UNICAJA, as well as proof of the dates on which these were made known to the employees of Grupo Control. The UNICAJA representatives refer to the contractual documents with Grupo Control, already provided (contract and annexes). It is verified that neither the contract, Neither Annex VII, consisting of the Addendum on the Data Controller, nor Annex VIII, on Information Security Requirements, contains specific instructions on viewing images or on how to proceed or respond to possible requests to view or extract images from the Video Surveillance System. ITEM 4.C Information has been requested regarding whether there are instructions concerning the customer and employee data that must be provided to the CRA for image viewing checks. In this regard, the entity's representatives stated the following: “The reviews requested by the Internal Audit area, which require knowledge of the content of the security cameras, are always associated with a fraud case or investigation, whether internal or external, and with investigative actions.” For this reason, and given that Internal Audit's requests to view images are always made in an internal/private/restricted setting, the Security Department is responsible for viewing them based on the information Internal Audit wishes to obtain (who provides the relevant information that prompted the investigation and the information they need to obtain or verify as a result of the Security Department's viewing of the images). The need to conduct thorough investigations (due to their relevance in fraud detection and prevention) requires that these requests be accompanied by the relevant data to allow for proper image viewing. ITEM 4.D Regarding whether UNICAJA personnel (such as internal auditors) are granted access to the images in any case. How is authorization issued and for what purposes is viewing permitted? They state that only the entity's Security Department is granted access to the images. ITEM 5. Regarding whether access to the images in the video surveillance system is recorded, and the data retention period for said record. They reply that access to the system's images is recorded for 90 days. The image retention period is 15 days. ITEM 6.A. Regarding whether data protection audits have been carried out on the entity Grupo Control. The latest report has been requested. Affirmative. They report that they have not carried out any audits due to the recent date of formalization of the contract. However, they state that, in the interest of proactive action and the principle of accountability, both parties have formalized a commitment to carry out a data protection audit in this regard, providing a copy of Annex IX to the contract, which reflects this commitment and expressly states: “The scope of the audit will cover, at a minimum, verification of Grupo Control's compliance with its data protection obligations and, in particular, those related to the following areas: a) security measures.” C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeaepd.gob.es 10/55 Specifically, the application of measures to control access to the images captured by video surveillance systems. The possibility of conducting audits is provided for in section 11 of Annex VII, "Regarding the service provision regime with access to personal data under the responsibility of Unicaja Banco": "11. Audits. Unicaja Banco, in compliance with its control capacity, may conduct its own reviews to verify compliance with the policies and security measures required in this agreement for the protection of personal data." They state that they have carried out checks and found no incidents related to video surveillance and compliance with private security regulations, specifically during 2022 and 2023. They indicate that the following general and specific checks were performed by verifying evidence and reviewing individual cases: - Review of the RAT (Regulations for the Use of Video Surveillance) and Impact Assessment of Video Surveillance processing with the Security Department. - Verification of compliance with the duty to provide information in areas under video surveillance, in order to check the correct installation of video surveillance signs and their content. - Verification of compliance with the requirements of the private security regulations, in order to verify that the following requirements have been met: (i) Deletion of images within 15 days of recording. (ii) Sampling of requirements for making images available to competent authorities and bodies, and retention periods for said images prior to their delivery. ITEM 6.B. Regarding the existence of audits of the access log to the Video Surveillance System for the purpose of identifying possible unauthorized access, and a copy of these audits if applicable. They state that no such audits exist, indicating that if, as a result of the data that has not yet been collected, additional information were obtained that would justify a potential audit, it would be carried out immediately. ITEM 7. Regarding the existence of consultations made to the Data Protection Office (OPD) or the UNICAJA Data Protection Officer (DPO), or reports issued by them, regarding data protection aspects of images from the Video Surveillance System. A copy of the documents if applicable. They responded by providing details of three reports on Data Protection aspects of video surveillance system images: C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeaepd.gob.es 11/55 1. First, following the approval of the GDPR, the Human Resources Department consulted the Legal Department and the Data Protection Office regarding the use of images recorded by UNICAJA. They provide a copy of the email sent by the Data Protection Office on August 1, 2018, which states the following: "Thus, access to the images may be granted for the sole purpose of, in the event of detecting the commission of criminal acts, making them available to the judicial authorities and law enforcement agencies..." 2. Subsequently, the Human Resources Department requested further information on the previous inquiry regarding the possibility of using the images in work-related matters. They provide a copy of the email sent by the Data Protection Officer of UNICAJA on October 26, 2018. 3. Furthermore, a new inquiry was made regarding the retention periods for recordings in cases of disciplinary proceedings and subsequent judicial proceedings, as well as regarding the individuals who have access to the images. They provide a copy of the email sent by the Data Protection Office on April 24, 2019. ITEM 8. Regarding whether the processing activity of video surveillance is recorded in UNICAJA's Record of Processing Activities (RPA). If so, a copy of the record of this processing activity. They provide a copy of the RPA where the video surveillance activity is recorded. ITEM 9. Regarding the performance of a Risk Analysis (RA) and Data Protection Impact Assessment (DPIA) of the video surveillance processing. They provide a copy of a previous study to analyze and assess whether the video surveillance processing involves circumstances and situations that require a Privacy Impact Analysis (PIA), concluding that it does. They also provide a copy of the completed PIA, with assessments of inherent risk and residual risk once mitigation measures have been applied. Among the measures or controls to be implemented are the following regarding access control: - 6.6.2.1 of ISO 27701. User registration and deregistration: A formal user registration and deregistration process must be implemented to allow for the assignment of access rights. - 6.6.2.5 of ISO 27701. Asset owners must periodically review user access rights. - 6.6.2.5 of ISO 27701. Information access restrictions: Access to information and application system functions must be restricted in accordance with the Access Control Policy. - ISO 27701-6.9.4.1. Event logs of user activities, exceptions, violations, and information security events must be generated, maintained, and regularly reviewed. In light of these measures, although they have been considered in the analysis, it is evident that C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeaepd.gob.es 12/55 they have not been implemented, as a single user has been configured with generic access to the video surveillance system, continuously, for all employees of the CRA. FOURTH: UNICAJA's Turnover According to the "2023 Annual Report," published at https://www.unicajabanco.com/es/inversores-y-accionistas/informacion-economico- financiera/cuentas-anuales-auditadas, in 2023, UNICAJA's turnover was €1,775,548 thousand, as stated in the official record included in the file, dated February 20, 2025. FIFTH: Agreement to Initiate Disciplinary Proceedings On February 24, 2025, the Deputy Director General of Data Inspection, in accordance with Article 16 of Law 34/2015, initiated disciplinary proceedings against UNICAJA. 48.2 LOPDGDD, due to the vacancy in the positions of President and Deputy President, agreed to initiate disciplinary proceedings against the respondent, in accordance with the provisions of Articles 63 and 64 of Law 39/2015, of October 1, on the Common Administrative Procedure of Public Administrations (hereinafter, LPACAP), for the alleged infringement of Article 32 of the GDPR, as defined in Article 83.4 of the GDPR. In said opening agreement, it was determined that the penalty that could be imposed for the alleged infringement, without prejudice to the outcome of the investigation, would be €3,500,000 (three million five hundred thousand euros). It was also noted that the infringement, if confirmed, could lead to the imposition of measures, in accordance with the provisions of Article 58.2 of the GDPR. The initiation agreement was sent, in accordance with the rules established in the LPACAP, by electronic notification, and was received on February 25, 2025, as evidenced by the certificate on file. SIXTH: Extension of Deadline In response to the request for an extension of the deadline granted for submitting allegations, as well as a copy of the file, on March 5, 2025, it was agreed to extend the deadline for submitting allegations to a maximum of five days, to be counted from the day following the end of the initial period for submitting allegations. On the same date that this document was issued, an encrypted physical medium (CD or USB drive) containing the complete copy of the requested administrative file was sent to the respondent via courier, since the requested copy exceeded the maximum size allowed in the Notific@ system. On the same date, another document was sent separately via the aforementioned Notific@ platform, providing the access code to the documentation included on the physical media. SEVENTH: Objections to the Commencement Agreement C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeaepd.gob.es 13/55 The aforementioned commencement agreement having been notified in accordance with the regulations established in the LPACAP, on March 18, 2025, the respondent submitted a statement of objections, which, in summary, stated the following: PRELIMINARY FIRST - Factual issues that must be taken into account in relation to the proceedings. It states, on the one hand, that the ownership of the video surveillance systems would belong to UNICAJA and that Grupo Control would provide the video surveillance service through the CRA of Grupo Control; The contractual documentation stipulates that the processor will act according to the instructions of the controller, that the personal data processed may not be used for any purpose other than the execution of the service, that it will be confidential and will not be published or disclosed to third parties without the prior written authorization of the controller, and that the security measures to be adopted include the obligation to register user accounts and passwords, defining security roles or user profiles to guarantee that each user has only the permissions strictly necessary for the provision of the service. The section on security measures for service accounts clearly includes the requirement for user accounts to be named according to UNICAJA's naming policy. On the other hand, UNICAJA refers to the labor dispute that arose from the contract formalized with Grupo Control in 2019, when it was decided that this entity would be subrogated as the employer of the workers who carried out the operation of the CRA and image viewing through a service company of the UNICAJA group, called Gestión de Actividades y Servicios Empresariales S.L. (“GDA”). The GDA workforce consisted of eleven operators, among whom was the current complainant. FIRST. UNICAJA has not breached its obligations under Article 32 of the GDPR. 1.1 Lack of evidence of the absence of adequate measures. UNICAJA alleges that the Spanish Data Protection Agency (AEPD) is attributing to UNICAJA a lack of measures that should be adopted by the staff of Grupo Control. It asserts that it has implemented the necessary measures, and therefore UNICAJA has not breached its obligations under Article 32 of the GDPR. 1.2 Error in the AEPD's assessment of the lack of instructions. Regarding the alleged lack of instructions on the processing of images, UNICAJA asserts that it provided documentation on protocols and instructions in response to the information request and that it has documented clear and precise instructions on the processing of images and that, at all times, it provided instructions to the data processor regarding data processing. 1.3 Lack of proof of UNICAJA's culpability and error in assigning responsibility. It argues that the obligation to establish technical and organizational measures appropriate to the risk falls equally on the controller and the processor and, therefore, in data processing operations where there is a processor, it is necessary to attribute the infringement to the individual who actually committed the act, whether the controller or the processor. C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeaepd.gob.es 14/55 In any case, it understands that the obligation derived from art. Article 32 of the GDPR is an obligation of means, not of result, as referenced by the Supreme Court in its judgment of February 5, 2022. It states that UNICAJA provided clear and precise instructions regarding the processing of video surveillance images and the creation of named user accounts. In this regard, it considers that the Spanish Data Protection Agency (AEPD) cannot impute an infringement to UNICAJA simply because Grupo Control staff did not implement named user accounts, as this would transform the obligation under Article 32 of the GDPR into an obligation of result, which it is not. It indicates that UNICAJA has also established monitoring and control measures for data processors to ensure that the data processing they carry out has the appropriate technical and organizational security measures and that this control is not limited to contractual documentation, but also includes specific checks to detect potential risks or areas for improvement that reveal data protection non-compliance on the part of its suppliers (for example, the Specific Controls on Personal Data Protection for the recent years 2023 and 2024). These checks indicate that the level of compliance with data protection regulations, including security measures, is reviewed by randomly selected UNICAJA suppliers. In addition to these routine controls applicable to all suppliers, with regard to Grupo Control, prior to the start of the sanctioning procedure, UNICAJA had already conducted a specific ad-hoc audit with an external auditor to ensure compliance and identify any potential deficiencies or areas for improvement. For this reason, it believes that UNICAJA cannot be held responsible for a lack of oversight of its suppliers in general or of Grupo Control in particular. In its opinion, UNICAJA cannot be held liable for negligence or lack of oversight. Furthermore, it believes that data controllers cannot be held responsible for the actions of data processors when they act outside the instructions given by the controller. It argues that this issue has recently been analyzed by the CJEU, which determined that the actions of data processors cannot give rise to liability for the data controller when the processor: (i) has used the data for its own purposes; (ii) processed them in a manner incompatible with the processing methods determined by the controller; or (iii) processed them in a manner that could not reasonably be considered to have given the controller's consent. In this case, it is understood that Grupo Control, the data processor, did not comply with the data processing instructions issued by UNICAJA, and therefore UNICAJA cannot be held responsible for this action. It states that UNICAJA had clearly established the obligation that users' data C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeaepd.gob.es 15/55 must be identified by name, and that the flagrant breach of this obligation is “incompatible with the framework or methods of processing as determined by the controller.” It states that UNICAJA also has an internal reporting channel that includes service providers, a reporting channel that was known to Grupo Control staff and could have been used by Grupo Control employees to report any incidents, including deficiencies in the implemented security measures. In other words, it's not just that Grupo Control disregarded UNICAJA's instructions, but that the employees deliberately concealed the existence of said non-compliance. It argues that UNICAJA cannot be blamed for a lack of control by the data processor when it is precisely the processor—through its employees—who, for spurious and personal reasons, actively covered up these events, despite being able to address them as was their contractual and legal obligation. SECOND. Lack of grounds for the disciplinary proceedings. UNICAJA has initiated procedures to address any areas for improvement as soon as they became aware of them, having commissioned an external audit of Grupo Control in September 2024 and implemented all necessary measures to carry out these improvements through the new system ***SYSTEM.1. This ensures the effective implementation of its Security Protocol, which expressly states, among other things, that users must register with their own passwords. UNICAJA believes this inevitably leads to the elimination of the subject of the proceedings, an alleged infringement of Article 32 of the GDPR, since with the improvement of the video surveillance access control system, UNICAJA complies with all GDPR requirements, and especially with those that the Spanish Data Protection Agency (AEPD) criticizes in the Initiation Agreement. THIRD. Lack of justification in the classification of the infringement. It alleges that, in the Initiation Agreement, the Spanish Data Protection Agency (AEPD) decided to classify the facts subject to the sanctioning procedure under the type of offense set forth in Article 73.f) of the Spanish Data Protection Act (LOPDGDD), but provides no justification as to how the facts fall under that type, which is not applicable to the facts allegedly attributed to UNICAJA and cannot be justified. According to UNICAJA, the lack of justification on this point is essential since, in relation to the infringements of Article 32 of the GDPR, the LOPDGDD includes various types in its Article 73. FOURTH. Lack of proportionality of the imposed sanction. It considers that, taking into account the facts of this case, the imposition of a financial penalty is entirely disproportionate and is especially disproportionate in the amount of €3,500,000. The Spanish Data Protection Agency (AEPD) considers that the following circumstances compel it to appropriately adjust the sanction and reduce its amount: C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeaepd.gob.es 16/55 • UNICAJA has implemented a comprehensive set of robust technical and organizational security measures in accordance with data protection regulations. These measures specifically include: the use of named users for access to information systems and specific instructions for handling video surveillance images. • UNICAJA's culpability or intent has been proven to be nonexistent, as it was the responsibility of Grupo Control's personnel to comply with the instructions issued by UNICAJA regarding data processing and to adopt the security measures that UNICAJA had expressly requested in writing in their contractual agreements. And, in any case, there would be shared culpability insofar as Grupo Control and its employees could and should have reported any breaches of the security measures to which they were bound, but failed to do so, thus concealing said breaches. • The alleged lack of security measures is limited to a single infraction: the data processor, Grupo Control, had not implemented named user accounts for access to the information systems. It does not refer to a generalized lack of security measures. • Requests to view images are minimal and are limited solely to cases where an event is identified that requires investigating fraudulent or criminal conduct. Only the images corresponding to that event are reviewed, no others. • No harm or damage suffered by any of the interested parties is proven. • UNICAJA derives no economic benefit from data processing. On the contrary, the purpose of processing video surveillance images is to preserve the security of people, property, and facilities, as well as to prevent fraud and investigate crimes, in many cases in the client's own interest. This processing is lawful and legitimate, based on a public interest recognized by law, as acknowledged by the Spanish Data Protection Agency (AEPD) in its Guide on the use of video cameras for security and other purposes. • Before the initiation of the sanctioning procedure, UNICAJA had already voluntarily begun implementing measures to strengthen security and mitigate any negative effects. The alleged infractions would have already been resolved with the implementation of these measures. Furthermore, it argues that the Spanish Data Protection Agency (AEPD) is overlooking the fact that in this case, it is more appropriate to order the adoption of a corrective measure, which, moreover, has already been voluntarily adopted by UNICAJA. Therefore, it believes that the proper course of action is to close the proceedings without imposing any sanction. It asserts that the AEPD has assessed an erroneous and significantly higher turnover than UNICAJA's actual turnover. In UNICAJA's 2023 Annual Accounts, included in the file, the turnover for 2023 is presented in thousands of euros, and shows a figure of 1,775,548 thousand euros. However, it indicates that the Spanish Data Protection Agency (AEPD) in its C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeaepd.gob.es 17/55 Initial Agreement has erroneously considered UNICAJA's turnover for 2023 to be €1,775,548 million. Therefore, it believes that UNICAJA should rectify the error and significantly reduce the penalty in accordance with its actual turnover, which is considerably lower than that considered by the AEPD. Finally, it points out that most of the facts stated in the initial agreement have expired, as the statute of limitations for serious infringements is two years. Thus, it asserts that all events prior to February 25, 2023 (the date of notification of the Commencement Agreement) would have expired and cannot be considered by the Spanish Data Protection Agency (AEPD), as the two-year statute of limitations established by the Spanish Data Protection Act (LOPDGDD) has elapsed. It considers this important because the AEPD refers to events that are very old and focuses particularly on events between December 2021 and February 2022, all of which are time-barred. Consequently, it argues that the penalty must be reduced proportionally, only taking into account the non-time-barred events from the AEPD's reference period, between February 2023 and May 2023, and therefore should be significantly reduced. In light of the foregoing, it requests that the Spanish Data Protection Agency (AEPD) order the dismissal of the sanctioning procedure without imposing any penalty for the alleged infringements attributed to UNICAJA, or alternatively, appropriately reduce the amount of the proposed penalty. It also requests the opening of a 30-day evidentiary period so that the relevant facts of interest in this procedure can be established. EIGHTH: Evidentiary Period Due to the procedural instructions, it was agreed to open an evidentiary period, and the claims filed and their documentation, the documents obtained and generated during the admission phases for processing and the preliminary investigative actions that form part of the file are considered reproduced for evidentiary purposes; and the allegations against the decision to initiate the sanctioning procedure submitted by UNICAJA and the accompanying documentation are considered submitted. Furthermore, in response to UNICAJA's request, the entity was granted a period of ten business days to provide the following information and/or documentation: 1. The instructions that UNICAJA gives to Grupo Control regarding data processing and the security measures to be implemented, as referred to in Allegation Second of its statement of allegations at the beginning of the aforementioned sanctioning procedure. 2. The security measures that UNICAJA has implemented, as referred to in Allegation First of its statement of allegations at the beginning of the aforementioned sanctioning procedure. 3. The context of the labor dispute and the complaint filed by the CGT union with the Spanish Data Protection Agency (AEPD), as well as the inspection procedure carried out by the police at UNICAJA, referred to in the First and Second Preliminary Allegations of its statement of allegations at the beginning of the sanctioning procedure. C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeaepd.gob.es 18/55 reference. On January 5, 2026, UNICAJA responded to the request for evidence, providing the following documentation: 1. Regarding section 1 above, they again submitted the service contracts for the Alarm Receiving Center signed with Grupo Control on February 26, 2019, and January 1, 2023, the amendment (May 30, 2024), and the addendum modifying the audit terms (May 14, 2024) of the latter contract; as well as the Image Processing Protocol dated May 21, 2018. According to the company, this documentation demonstrates that it has implemented specific protocols for processing video surveillance images and provides concrete instructions on the security measures to be implemented by Grupo Control, expressly and in writing, in legally binding documents, from the moment the supplier is contracted, instructing said entity that the users of the applications must be identified by name. Therefore, it believes that the Spanish Data Protection Agency's (AEPD) assertion regarding the lack of instructions is manifestly unfounded. The following points are noteworthy in the content of these documents: Amended novation, specifying the procedures and levels required for access to and extraction of images by UNICAJA, and updating Annexes VII (data protection) and VIII (information security measures and technological risk). Details of the stipulations in these documents, relevant to the present proceedings, are outlined in Findings of Fact Two and Three. 2. Regarding the security measures referred to in section 2 of the agreed evidence, UNICAJA provides the following documents: Document No. 2-1 Control Group User Management Procedure. Document No. 2-2 Remote Access Security Measures for Suppliers. User Guide. Document No. 2-3 Preliminary Impact Assessment of Video Surveillance Data Protection (BIPP). Document No. 2-4 BIPP of Video surveillance. Document No. 2-5 Security Management Software Report ***SYSTEM.2. Document No. 2-6 Security Management Software Brochure ***SYSTEM.2. Document No. 2-7 Internal Data Protection Audit 2023. Document No. 2-8 Correspondence with the Data Protection Office regarding supplier approval (Control Group). Document No. 2-9 Supplier Approval Questionnaire (Control Group). Document No. 2-10 Control Group Audit 2024. Document No. 2-11 2024 Control Group Audit Recommendations. Document No. 2-12 Control Group Audit 2025. In this regard, it states: “Unicaja has implemented security measures appropriate to the risks.” of the processing of data related to video surveillance in accordance with a data protection impact assessment (Document No. 2-3) carried out C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeaepd.gob.es 19/55 data protection impact assessment (Document No. 2-3) carried out based on data protection regulations. Furthermore, both Unicaja (Document No. 2-2) and Grupo Control (Document No. 2-1) have specific security measures for user management and logical access to the applications used in relation to the processing of video surveillance data (see information on ***SISTEMA.2, the security management software currently used by Unicaja, Documents No. 2-5 and 2-6). Additionally, Unicaja has mechanisms for continuous review and control of the effectiveness of the security measures. These controls are established at a general level for all suppliers (Document No. 2-7) as specific to some suppliers. In addition, Unicaja has a supplier approval process in which the Unicaja Data Protection Office participates, which does not limit itself to fulfilling a mere formality, but rather analyzes and reviews data protection issues (Document No. 2-8). The latest version of the Grupo Control approval questionnaire is provided (Document No. 2-9). Specifically and without limitation, as a demonstration of Unicaja's ongoing commitment to data protection and information security, within the context of the ongoing supplier review program, Grupo Control underwent an audit in 2024—prior to the Commencement Agreement—to ensure effective compliance with Unicaja's instructions and the imposed security measures in order to identify potential deficiencies or areas for improvement (Document No. 2-10). In fact, as a result Following that audit, Unicaja initiated procedures to address elements that might present areas for continuous improvement and updating, as it routinely does with its suppliers (Document No. 2-11), made specific recommendations to Grupo Control, and has followed up to confirm that, to date, Grupo Control has implemented those recommendations (Document No. 2-12). The documentation provided at this point demonstrates that Unicaja, not only prior to the events analyzed, but also continuously and to this day, has implemented robust security measures and supplier review mechanisms that exceed the required standards and diligence and aim for the continuous improvement and review of its systems. From the content of the documentation provided, the following is noteworthy: a) Grupo Control User Management Procedure This document defines the procedures for creating, deleting, identifying, authenticating, and logically controlling user access to Grupo Control's information systems throughout its entire scope of operation. It also specifies user roles and responsibilities, as well as privilege management. Regarding access control, it states: “All personal identifiers of the company… must be standardized to enable the unique and reliable identification of users.” The creation of a user identifier must be authorized by their supervisor, in accordance with the company's internal rules and procedures. The use of group identifiers will not be permitted, except when strictly necessary for operational reasons. This circumstance must be duly justified and formally approved, applying the appropriate security controls. C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeaepd.gob.es 20/55 Anonymous user identifiers and default identifiers will always be disabled. Access controls must be applied at all levels of the architecture and topology of the Information Systems of Grupo Control Empresa de Seguridad S.A.U. This includes: networks, platforms or operating systems, databases, and applications. The attributes of each of them must reflect some form of identification and authentication, access authorization, verification of information resources, and recording and monitoring of activities. b) Internal Data Protection Audit 2023 Among the issues subject to control was the verification of compliance with the requirements of the private security regulations, specifically the deletion of images within 15 days of recording and a sampling of the provision of images to competent authorities and bodies. In addition, a random review of contracts with suppliers was conducted to verify that they comply with personal data protection regulations. No incidents were detected in relation to these issues. c) Audit of Grupo Control in September 2024, detailed in Finding Six. d) In December 2025, a "Final Analysis of Recommendations Issued in the Alarm Receiving Center Data Audit" was carried out, the results of which are detailed in Seventh Proven Fact. 3. In relation to the issues referred to in section 3 of the agreed evidence, UNICAJA submits the following documents: (…) NINTH: Annex of procedural documentation A list of documents contained in the proceedings is attached as an annex. From the actions carried out in these proceedings and the documentation contained in the file, the following have been proven: PROVEN FACTS FIRST: On January 1, 2023, UNICAJA and Grupo Control entered into a service agreement, the content and annexes of which are hereby incorporated by reference for evidentiary purposes. Under this agreement, Grupo Control undertakes to provide “the services of concession and management of alarms for the offices, buildings, and premises of Unicaja Banco.” As indicated in Clause Two, the services expressly included are “the operation of alarm monitoring centers” and “the verification of alarms by images or CCTV.” The service definition included in the Technical Specifications for the tender includes the following: C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeaepd.gob.es 21/55 Service Requirements for “Video Download”: “The download of images will be carried out by Unicaja Banco through the specific service contracted for this purpose…”. Regarding this matter, Clause Eight of the contract states: “Unicaja Banco hereby grants the Company the necessary permissions for access, processing, and electronic recording of the images generated as a result of alarms from its installation, as well as for the necessary system supervision and maintenance operations.” SECOND: Annex VII of the contract, mentioned in the First Proven Fact, corresponds to the Commission Addendum and outlines the service provision regime with access to personal data under the responsibility of UNICAJA. Other stipulations state that “the processor will act following the instructions of the controller, that the personal data processed may not be used for any purpose other than the execution of the service, that it will be confidential and will not be published or disclosed to third parties without the prior written authorization of the controller.” Section 6 of this Annex VII is dedicated to “Security Measures Regarding Personal Data Protection,” stating: “The Data Processor undertakes to comply with the organizational, technical, physical, and administrative security measures appropriate to guarantee a level of security adequate to the risk that may arise from the processing… These security measures are detailed in the Annex on Information Security Requirements…”. This same Annex details the personal data to which the Data Processor may have access (including “images”) and the categories of data subjects (“clients,” “potential clients,” “employees and equivalent personnel,” as well as “suppliers”). It also contemplates the possibility of conducting audits “Regarding the regime for providing services with access to personal data under the responsibility of Unicaja Banco”: “11. Audits. Unicaja Banco, in accordance with its control capabilities, may conduct its own reviews to verify compliance with the policies and security measures required in this agreement for the protection of personal data.” THIRD: Annex VIII of the contract mentioned in the First Proven Fact, signed on May 25, 2023, details the “Information Security and Technological Risk Requirements” (“Security Protocol”). This document imposes security and confidentiality measures for Grupo Control. Among these measures, it expressly states that users and passwords must be registered and that the provider is obligated to define, for each application or information asset that could contain UNICAJA information, the security roles or user profiles in such a way as to guarantee the strictly necessary permissions for each user to provide the service. Section 3 of this document stipulates: “3. General Security Measures These measures are based on the premise that the Supplier, for the purposes of this contract, will have direct or indirect access to Unicaja's information system. C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeaepd.gob.es 22/55 Bank. The term "information system" refers to any asset that provides services to Unicaja Bank or stores its proprietary information, regardless of the final location of the solution (internal service or cloud-based) or whether the provision of the service is outsourced to a third party… If access is granted to a file-sharing tool, and with regard to the confidentiality of authenticators and access credentials, the Supplier's employees and those to whom the Supplier delegates or subcontracts agree to: • Safeguard the assigned credentials and ensure that they are not accessible to unauthorized persons. • Do not use the same access authenticators for Unicaja Banco systems on external systems, and do not use the same authenticator on two or more systems with independent authentication… 3.5.2. Application Security Measures The Provider agrees that all applications that store or process information belonging to Unicaja Banco will comply with the following security measures: - Prior to providing the service, the Provider will define, for each application or information asset that could contain Unicaja Banco information, the security roles or user profiles to guarantee that each user has the permissions strictly necessary for providing the service. - The Provider must be able to obtain a list of users with access privileges to the systems that process Unicaja Banco information. In compliance with Unicaja Banco's traceability requirements, all users accessing a system containing Unicaja Banco information must be registered users, and sharing user accounts among the Provider's employees or those to whom the Provider may delegate this responsibility is not permitted. - Unicaja Banco reserves the right to periodically audit the roles and users assigned to the provision of the service, focusing exclusively on the areas where Unicaja Banco documentation and systems used exclusively for the service are located… - When the Provider manages a tool exclusively for Unicaja Banco, any change that involves a modification of the system users (addition, removal, and/or modification of permissions) must be communicated without undue delay by the Provider to the Unicaja Banco Contact Person… Obligations in the Unicaja Banco information system Security measures regarding Unicaja Banco platform users The Provider agrees to use these users individually for each employee providing the service. Users may not be shared between two employees of the group unless the account is designated as a “Service Account,” which must be duly requested by the Provider from Unicaja Banco. Unicaja Banco reserves the right to periodically audit the roles and users assigned to the provision of the service. This audit process will be carried out without prior notice, as only the systems owned by the entity will be audited. FOURTH: The CRA staff employed by Grupo Control with access to the system C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeaepd.gob.es 23/55 The UNICAJA Video Surveillance System image viewing system is comprised of 10 operators (telephone operator category) and a shift supervisor (coordinator). The AEPD inspection services asked UNICAJA whether each of these individuals has their own username and password to access the Video Surveillance System or if they access it with a generic System username. In response to this request for information, UNICAJA stated that the software supporting the video surveillance system establishes a single username and password, through which access is granted to the personnel designated by Grupo Control, according to the permissions that the provider assigns to each employee. It was also reported that access is recorded for 90 days and that the access log reflects, in all cases, access by the generic user account configured for use by all Grupo Control employees assigned to the UNICAJA Central Receiving Station (CRA), as well as the IP address, which could identify the computer in the CRA room from which access is made. FIFTH: UNICAJA stated that it carried out controls during 2022 and 2023, without detecting any incidents related to video surveillance and compliance with private security regulations. Regarding the existence of audits of the video surveillance system access log to identify possible unjustified access, UNICAJA stated that no such audits were recorded. During the trial phase, UNICAJA provided documentation related to an internal data protection audit conducted in 2023. Among the issues reviewed was the verification of compliance with the requirements of the private security regulations, specifically the deletion of images within 15 days of recording and a sampling of the provision of images to competent authorities and bodies. Additionally, a random review of contracts with suppliers was conducted to verify their compliance with personal data protection regulations. However, there is no record of any controls over access to images captured by video surveillance systems and the application of the necessary security measures regarding profile segmentation and access traceability. SIXTH: During the trial phase, UNICAJA provided documentation related to an audit conducted on Grupo Control in September 2024 by an external entity. In its summary of conclusions, the scope is defined, and the following conclusions and recommendations are specified, among others: “Scope: . An assessment has been carried out on the application of measures to control access to images captured by video surveillance systems. . The methods of preservation, timeframes, and means for the effective destruction of images have been reviewed, and evidence that allows for verification of the blocking and deletion of images has been identified and reviewed. . Information has been requested and the qualifications of personnel with access to the images have been thoroughly reviewed. C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeaepd.gob.es 24/55 . The procedures for implementing the follow-up to Unicaja's instructions regarding the processing of personal data have been reviewed.” “Conclusions Following the audit, the following strengths were identified: - Security Measures: The Security Policy provided by Grupo Control establishes the information security objectives and principles that the company is committed to, as well as guidelines for risk analysis within the framework of the information security system. Furthermore, it was observed that technical measures are applied regarding the segmentation of profiles with access to the Central Receiving Area (CRA) and the Grupo Control network, and physical access control measures are in place for the CRA and the Data Processing Center (DPC). - Image Retention: It was verified that the permanent deletion of CCTV images complies with the retention period stipulated by applicable regulations. - Qualification of Personnel with Access to Images: Grupo Control has defined two types of operators with access to images, so that the video surveillance work (viewing live CCTV images) is carried out by security guards certified by the Ministry of the Interior. - Implementation of Instructions Issued by Unicaja: The established protocol It adequately regulates the actions of Unicaja and Grupo Control within the framework of the CRA. However, the following findings have been identified: - Grupo Control has a single generic user account for access to all recorders in the company's video surveillance system. - Although in practice there are two separate profiles for accessing CCTV images, Grupo Control does not have a procedure that formalizes the access control model for the images by the different operators. - It has been identified that Grupo Control does not maintain a record of the communications exchanged with Unicaja. “Main Recommendations A total of 3 recommendations are issued, 2 of medium risk and 1 of low risk: - Update the technical access control measures for the video recorders so that it is feasible to develop a trace and record of the user accessing the video recorders (medium risk). - Document the application of the physical and logical segmentation measures defined for access by the two types of operator profiles to the video surveillance system images. That is, video surveillance by authorized security guards and video verification by unauthorized operators (medium risk). - Formalize and maintain a record of the communications exchanged between Grupo Control and Unicaja, so that these communications can be traced (low risk).” The corresponding report, regarding the security measures and qualifications of personnel with access to images, states: “It has been verified that: - The Security Policy provided by Grupo Control adequately establishes the information security objectives and principles that the aforementioned C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeaepd.gob.es 25/55 company commits to complying with, as well as guidelines for risk analysis within the framework of the information security system… - In addition to the above, according to the information provided, it is observed that Grupo Control applies appropriate technical measures regarding the segmentation of profiles with access to the Central Receiving Station (CRA) and the Grupo Control network… - Finally, regarding the technical measures for accessing the recorders of the video surveillance system, it is observed that Grupo Control has a single user who accesses all the company's recorders. Furthermore, it is identified that this user is a generic user, meaning that they could hindering the maintenance of a record and tracking of individuals accessing the system through said user account. However, according to the information provided by Grupo Control and the Proposal for securing the image access system of the video surveillance system, submitted to the Technological Risks Committee on June 21, 2024, it is observed that Unicaja is currently updating the access control system for the recorders so that it is centralized through an application that records and tracks the accessing user. “5.2 Domain 3 – Qualification of personnel with access to the images. (…) Despite the above, according to the information provided verbally by Grupo Control, the company does not have a procedure regulating access to the images by the various operators.” SEVENTH: In relation to the audit described in Finding Six, in December 2025, a “Final Analysis of Recommendations Issued in the Alarm Receiving Center Data Audit” was conducted, with the following result: a) Regarding the implementation of a system to strengthen access control to the video recorders: “(…) It has been verified that recurring sessions were held for the implementation of the project, reaching a weekly frequency during the solution definition and deployment phase (second half of 2025).” “Conclusions Following confirmation of the latest progress in the implementation project for the solution ***SYSTEM.1, which has enabled the centralized administration and viewing of camera elements and access control readers in rooms, we have confirmed that, with the production launch complete, as of November 2025, 8,885 cameras are connected to the system, with 736 units (8.28%) remaining to be connected… In this context, we consider the risk identified in the finding to be mitigated to an adequate level… and will be monitored within the context of the Physical Security Audit planned for the 2026 audit plan of the Technology and Security Risk Audit Department.” b) Regarding the formalization of a procedure that outlines the controls applied to the different types of Grupo Control operators with access to images, the following is indicated: C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeaepd.gob.es 26/55 “Based on the above, the following documents have been generated: (…) Procedure for Managing Additions, Deletions, Identification, Authentication, and Logical Access Control This establishes the corporate guidelines regarding user management, specifically regarding: Additions, Deletions, Identification, Authentication, and Logical Access Control for users of Information Systems… It establishes the principle of segmentation, specifying that access is segmented according to the roles and responsibilities of each user within the alarm receiving center… …the following segmentation process is established: Access Recorder Images: - Authorized Users: Users with permission to review and download images from customer recorders must be authorized by their supervisor and the Security Manager. These users have access to the image viewing and download functions necessary for incident investigation and resolution. - Access Control: Specific access controls are implemented to ensure that only authorized users can access these functions. This includes authentication using unique credentials and monitoring of user activities. “Conclusion It is verified that Grupo Control formalized, in its session of May 19, the “Physical Access Control Regulations” and the “Procedure for Managing Additions, Deletions, Identification, Authentication, and Logical Access Control.” It can be validated that these regulations cover the requirements of the finding by enabling the application of the physical and logical segmentation measures defined for access by the two types of operator profiles to the images of the video surveillance systems (video surveillance by authorized security guards and video verification by unauthorized operators).” LEGAL BASIS I Jurisdiction In accordance with the powers granted to each supervisory authority by Article 58.2 of Regulation (EU) 2016/679 (General Data Protection Regulation, hereinafter GDPR) and as established in Articles 47, 48.1, 64.2 and 68.1 of Organic Law 3/2018, of December 5, on the Protection of Personal Data and Guarantee of Digital Rights (hereinafter LOPDGDD), the Presidency of the Spanish Data Protection Agency is competent to resolve this procedure. Likewise, Article 63.2 of the LOPDGDD (Organic Law on the Protection of Personal Data and Guarantee of Digital Rights) stipulates that: "The procedures processed by the Spanish Data Protection Agency shall be governed by the provisions of Regulation (EU) 2016/679, by this Organic Law, by the implementing regulations issued thereunder, and, insofar as they do not contradict them, subsidiarily, by the general rules on administrative procedures." C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeaepd.gob.es 27/55 II Preliminary Issues The physical image of a person, according to Article 4.1 of the GDPR, is personal data and its protection is governed by said Regulation, which defines personal data as: “any information relating to an identified or identifiable natural person (“data subject”); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.” It is therefore pertinent to analyze whether the processing of personal data (images of natural persons) carried out through the reported video surveillance system is in accordance with the provisions of the GDPR. Article 22 of the LOPDGDD (Spanish Data Protection Act) establishes that natural or legal persons, public or private, may process images through camera or video camera systems for the purpose of preserving the security of persons and property, as well as their facilities. Article 4.2 of the GDPR defines "processing" as: "any operation or set of operations performed on personal data or sets of personal data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction." (Note: The last sentence appears to be incomplete and possibly refers to a different context.) Article 4.7 of the GDPR defines the "controller" as: "the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of processing are determined by Union or Member State law, the controller or the specific criteria for its appointment may be laid down by Union or Member State law." Article 4.8 of the GDPR defines the "processor" as: "the natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller." In this case, UNICAJA owns the video surveillance systems, and GRUPO CONTROL provides the video surveillance service through the CRA (Central Monitoring Station). In this regard, UNICAJA holds the status of “data controller,” as it is the entity that determines the purposes and means of the processing (Article 4, paragraph 7 GDPR), entrusting the security company, as the data processor, with the provision of the video surveillance service. C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeaepd.gob.es 28/55 During the investigation, UNICAJA provided a copy of the contract formalized on January 1, 2023, Annex VII of which contains the Addendum for the Processor of Personal Data under the responsibility of UNICAJA. It also includes Annex VIII with Information Security Requirements. The aforementioned Addendum to the Processing Agreement stipulates, among other things, that the processor will act following the instructions of the controller, that the personal data processed may not be used for any purpose other than the execution of the service, that it will be confidential and will not be published or disclosed to third parties without the prior written authorization of the controller. It also includes references to security measures and the return or destruction of the data upon termination of the relationship. For the proper provision of this service, as defined in the formalized contractual documentation, the processor must access personal data. For its part, the defendant will have all the established obligations, respecting in all cases the current regulations on the protection of personal data. Among these obligations is the requirement that personal data be processed in such a way as to guarantee adequate security, through the application of appropriate technical and organizational measures. III Objections to the Commencement Agreement Regarding the preliminary considerations made by UNICAJA concerning factual circumstances that, in its opinion, should be taken into account, the following should be noted: First, it points out that the contractual documentation stipulates that the data processor will act following instructions from the data controller, including the security measures to be adopted, such as the obligation to register users and named passwords, defining security roles or user profiles in a way that guarantees the strictly necessary permissions for each user to provide the service. The section on security measures for service accounts clearly includes the requirement for named users following UNICAJA's naming policy. All of this is duly documented in the Established Facts. Furthermore, it should be noted that this document contains no ruling on matters outside the scope of the Spanish Data Protection Agency's (AEPD) authority, such as the labor dispute mentioned in the proceedings, which are unrelated to the subject matter of the procedure, which is limited to the lack of security measures identified. FIRST. UNICAJA has not breached the obligations of Article 32 GDPR. As a starting point, it clarifies that the obligation to establish security measures set forth in Article 32 GDPR: (a) is an obligation that applies equally to both the C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeaepd.gob.es 29/55 controller and the processor, and (b) is an obligation of means, not of result. Likewise, it understands that the breach of this obligation consists of the failure to adopt measures appropriate to the risk, so in order to prove the existence of a breach it is necessary to prove the absence of measures and the suitability of said measures to the risk. It argues that the Spanish Data Protection Agency (AEPD) is attributing to UNICAJA a lack of measures that should be adopted by Grupo Control staff, and concludes that no blame can be legally attributed to UNICAJA when the employees, including the complainant, instead of reporting it or at least requesting within their organization that it be reviewed in accordance with their contractual and employment obligations, maintained their covert noncompliance and only proceeded to report UNICAJA. Therefore, it asserts that the AEPD has not been able to demonstrate in the file that UNICAJA has breached its obligations under Article 32 of the GDPR, since the establishment of the measure to which the AEPD refers is a legal and contractual obligation directly enforceable against the data processor. Therefore, it considers that UNICAJA cannot be held liable when—despite UNICAJA having implemented appropriate measures, including post-contract control measures with Grupo Control—there was a clear intention to conceal the breach of its contractual and legal obligations. It should be noted first that, although Article 32 of the GDPR establishes an obligation considered by case law as an obligation of means, the proven facts demonstrate a complete lack of effective implementation of the security measures committed to and required by the regulations. Furthermore, it should be clarified that, within the framework of the contractual relationship between both parties, UNICAJA owns the video surveillance systems, and Grupo Control provides the video surveillance service through Grupo Control's Central Monitoring Station. This contract includes an Addendum to the Processing Agreement, Annex VII, concerning the service provision regime involving access to personal data under the responsibility of UNICAJA (“Addendum to the Processing Agreement”), which stipulates, among other things, that the processor will act following the instructions of the controller, that the personal data processed may not be used for any purpose other than the execution of the service, that it will be confidential and will not be published or disclosed to third parties without the prior written authorization of the controller.” Annex VIII of the Contract signed by Grupo Control on May 25, 2023, the Information Security and Technological Risk Requirements (“Security Protocol”), also imposes confidentiality measures on Grupo Control and explicitly states that these apply to all Grupo Control employees. Among the security measures established in this Protocol, it is expressly stated that named usernames and passwords must be registered and that the provider must define, for each application or information asset that could house UNICAJA information, the security roles or user profiles that guarantee the strictly necessary permissions for each user to provide the service. In the section on security measures for service accounts, the requirement that there be named users, following UNICAJA's naming policy, is clearly included. C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeaepd.gob.es 30/55 However, the investigation has confirmed, and there is no dispute about this, as UNICAJA has admitted it, that all Grupo Control employees accessed the images from UNICAJA's video surveillance system using a single generic username. The investigation confirms the absence of the minimum technical and organizational measures required by the contract itself and by the proper management of sensitive data risks mandated by the regulations. The lack of traceability inherent to the generic user is, in itself, an inadequate measure for the risk, directly contravening Article 32 of the GDPR. This is directly related to the principle of proactive responsibility of the data controller, as set forth in Article 5.2 of the GDPR, which states that “the controller shall be responsible for compliance with paragraph 1 and be able to demonstrate such compliance (“proactive responsibility”).” This means that the controller must guarantee the effective application of the processing principles both when determining the means of processing and during the processing itself, whether they carry out the processing of personal data directly or entrust it to a data processor to do so on their behalf (for the purposes of data protection regulations, this is the same), through the implementation of a series of technical and organizational measures of all kinds, which must be subject to periodic review and updating. This implies that the controller assumes their own responsibility for directing, reviewing, and coordinating the processing, including that carried out by the data processor providing services to them. In the case at hand, the contract established the nominal measures, but the data controller, UNICAJA, did not supervise or verify their implementation. The investigation demonstrates that the actual configuration differed from the contractual one. Furthermore, the lack of traceability (access logs are only kept for 90 days) prevents the data controller from auditing unauthorized access after the fact. UNICAJA is the data controller and ultimately responsible for ensuring that the data is processed securely. Delegating execution does not exempt UNICAJA from the responsibility of verifying compliance. The failure to implement effective logical access controls is ultimately UNICAJA's responsibility. The CJEU, in its judgment of 14 December 2023, Case C-340/21 (VB), has declared that the burden of proof regarding compliance with the obligations arising from Articles 5(1)(f) and 32 of the GDPR lies with the controller, pursuant to the principle set out in Article 5(2) of the GDPR and further developed in Article 24 thereof: “49 In this regard, it should be recalled, first of all, that Article 5(2) of the GDPR establishes a principle of accountability whereby the controller is responsible for compliance with the principles relating to the processing of personal data set out in paragraph 1 of that Article and stipulates that the controller must be able to demonstrate that the processing complies with those principles. 50 In particular, the controller must, in accordance with the principles of integrity and confidentiality of personal data established in C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeaepd.gob.es 31/55 Article 5(1)(f) of said Regulation requires the controller to ensure that this data is processed in a manner that ensures appropriate security of the personal data, including protection against unauthorized or unlawful processing and against accidental loss, destruction, or damage, by implementing appropriate technical and organizational measures, and must be able to demonstrate compliance with the aforementioned principles. 51 It should also be noted that both Article 24(1) of the GDPR, in conjunction with Recital 74 thereof, and Article 32(1) of the same Regulation require the controller, for all processing of personal data carried out by itself or on its behalf, to implement appropriate technical and organizational measures to ensure and be able to demonstrate that the processing is in accordance with the Regulation. 52 It is clear from the wording of Articles 5(2), 24(1), and 32(1) of the GDPR that the burden of proof that personal data are processed in a manner that ensures adequate security, within the meaning of Articles 5(1)(f) and 32 of that Regulation, lies with the controller in question [see, by analogy, the judgments of 4 May 2023, Bundesrepublik Deutschland (Judicial Electronic Mailbox), C-60/22, EU:C:2023:373, paragraphs 52 and 53, and of 4 July 2023, Meta Platforms and Others (General Terms of Service of a Social Network), C-252/21, EU:C:2023:537, paragraph 95]. As has been pointed out throughout the sanctioning procedure, the culpability stems directly from gross negligence in failing to ensure the effective implementation of the agreed-upon security measures and to exercise due diligence in supervising the data processor. UNICAJA was aware, through its own Data Protection Impact Assessment (DPIA), that risks existed that required specific logical access control measures, but a generic system was implemented that continuously compromised traceability. The infringement is not based on an impossible "obligation of result," but rather on the failure to comply with the obligations of reasonable and agreed-upon means which, had they been implemented, would have guaranteed a level of security appropriate to the risk, as required by Article 32 of the GDPR. Consequently, the allegations must be dismissed. SECOND. Lack of subject matter for the sanctioning procedure. UNICAJA indicates that it has initiated procedures to address those elements that may present areas for improvement and considers that this inevitably leads to the disappearance of the object of the procedure. However, this circumstance does not preclude the possibility that we are dealing with a completed infraction at the time of the opening of the sanctioning procedure and for the entire period of duration of the irregular situation. THIRD. Lack of justification in the classification of the infringement. It is alleged that, in the Initiation Agreement, the Spanish Data Protection Agency (AEPD) decides to classify the facts subject to the sanctioning procedure under the type set forth in Article 73.f) of the Spanish Data Protection Act (LOPDGDD), but provides no C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeaepd.gob.es 32/55 justification as to how the facts fall under that type, since that type is not applicable to the facts allegedly attributed to UNICAJA and cannot be justified, and that the lack of justification on this point is essential since, in relation to infringements of Article 32 of the GDPR, the LOPDGDD includes various types in Article 73 of the LOPDGDD. C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeaepd.gob.es 32/55 In this regard, it should be noted that the requirement for justification of administrative acts, as indicated by, among others, the Supreme Court ruling of November 19, 2001 (Appeal No. 6690/2000), has its constitutional basis in the principle of legality established by Article 103 of the Spanish Constitution, as well as in the effectiveness of judicial review of the actions of the Administration recognized in Article 106 of the Spanish Constitution. At the legal level, Article 35.1 of Law 39/2015, on the Common Administrative Procedure of Public Administrations, is the provision that specifies the acts that must be justified. ... This requirement, according to established case law, exemplified by the Supreme Court ruling of July 16, 2001 (Appeal No. 92/1994), aims to ensure that the interested party can understand the when, how, and why of the Administration's decision, with the necessary scope to defend their rights and interests. It also allows the courts to access the factual and legal basis necessary to resolve any legal challenge to the administrative act, exercising their power to review and control administrative activity. Therefore, the lack of such justification or its clear insufficiency, insofar as it prevents challenging the act with a serious possibility of criticizing the grounds and criteria on which it is based, constitutes grounds for annulment, as it leaves the interested party defenseless. The motivation for administrative acts, as noted in the Supreme Court ruling of March 29, 2012 (Appeal No. 2940/2010, among others), does not require exhaustive and detailed reasoning. It is sufficient to express the reasons that allow for understanding the essential criteria underlying the decision, "providing interested parties with the necessary knowledge to assess the legal correctness or incorrectness of the act in order to exercise the legal remedies established by law and to adequately articulate their defenses." In the present proceedings, a lack of motivation cannot be found. It is a different matter that the respondent may legitimately disagree with said reasoning, but this does not imply the absence of sufficient motivation in the classification of the infraction. In any case, as stated in Legal Basis V, the violation of Article 32 of the GDPR is classified as an infringement in Article 83.4 of the same Regulation, which, under the heading “General conditions for the imposition of administrative fines,” provides: “Infringements of the following provisions shall be sanctioned, in accordance with paragraph 2, by administrative fines of up to EUR 10,000,000 or, in the case of an undertaking, up to 2% of its total worldwide annual turnover of the preceding financial year, whichever is higher: C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeaepd.gob.es 33/55 a) the obligations of the controller and the processor pursuant to Articles 8, 11, 25 to 39, 42 and 43; (...) Furthermore, the classification of infringements included in the LOPDGDD is established solely for the purpose of determining the statute of limitations. For these mere purposes of the statute of limitations, the conduct defined in Article 83.4 of the GDPR falls under Article 73 of the LOPDGDD, which classifies it as serious with a two-year statute of limitations. Moreover, the factual scenario analyzed coincides exactly with that established in the aforementioned Article 73.f) of the LOPDGDD. Consequently, the allegations must be dismissed. FOURTH. - Lack of proportionality of the imposed sanction. Regarding the amount of the fine, please refer to the information provided in Legal Basis VI, which details the circumstances considered in determining the proposed penalty and addresses the arguments raised by UNICAJA. However, the following clarifications are deemed appropriate in relation to the issues raised by UNICAJA: 1. UNICAJA argues that, given the facts of this case, imposing a financial penalty for the amount determined in the agreement to initiate the proceedings is inappropriate, and that the Spanish Data Protection Agency (AEPD) overlooks the fact that in this case it is more appropriate to order a corrective measure, which UNICAJA has already voluntarily adopted. Therefore, UNICAJA believes that the proper course of action is to close the proceedings without imposing any penalty. Regarding the principle of proportionality, the Supreme Court, Third Chamber, in its judgment of December 16, 2003 (Appeal No. 4996/98), already indicated that this principle requires that "the discretion granted to the Administration for the application of the sanction be exercised by weighing, in all cases, the circumstances involved, in order to achieve due proportionality between the imputed facts and the required liability." This principle of proportionality is not considered to have been violated, and the proposed sanction for the entity is deemed proportionate, based on the proven facts and the circumstances detailed below. Now, in response to the allegations, several points should be noted: First, Article 83.1 of the GDPR establishes that administrative fines for GDPR infringements must be “…effective, proportionate, and dissuasive in each individual case,” and further indicates in paragraph 2 of the aforementioned provision that “Administrative fines shall be imposed according to the circumstances of each individual case, as an additional measure to, or in lieu of, the measures provided for…”. It then establishes certain circumstances to be taken into account. Thus, the calculation of the amount of the fines is at the discretion of the supervisory authority, C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeaepd.gob.es 34/55 subject to the rules provided for in the GDPR. In this context, the GDPR requires, as noted, that the amount of the fine be effective, proportionate, and dissuasive in each case (Article 83(1) GDPR). Furthermore, when setting the amount of the fine, supervisory authorities shall duly take into account a list of circumstances relating to the characteristics of the infringement (its seriousness) or the character of the perpetrator (Article 83(2) GDPR). Finally, the amount of the fine shall not exceed the maximum amounts provided for in Article 83(4), paragraphs 5 and 6 GDPR. Therefore, the determination of the amount of the fine is based on a specific assessment carried out in each case, within the parameters provided for by the GDPR. Furthermore, it should be borne in mind that calculating a fine is not a mere mathematical exercise. The specific circumstances of the case are the determining factors that lead to the final amount, which may vary in each case and for each infraction, up to the legal maximum. As a general and final consideration, it should be noted that the proposed sanction does not violate the principle of proportionality. Thus, it should be recalled that Article 83.4, which defines the infraction of Article 32, establishes limits on the amounts of fines that can be imposed that are far removed from the amount established here. At this point, we should recall the ruling of the CJEU in Case C-683/21. 78 The existence of a sanctions system that allows for the imposition, when the specific circumstances of each case justify it, of an administrative fine pursuant to Article 83 of the GDPR creates an incentive for controllers and processors to comply with the Regulation. With their deterrent effect, administrative fines contribute to strengthening the protection of natural persons with regard to the processing of personal data and are therefore a key element in ensuring respect for the rights of these individuals, in accordance with the purpose of the aforementioned Regulation to ensure a high level of protection of these individuals with regard to the processing of their personal data. ... Furthermore, the recent CJEU judgment of 13 February 2025, in case C-383/23, stipulates that the imposition of a fine requires, in the examination of each particular case, a series of elements provided for in Article 83 of the GDPR, of which the volume of turnover is one element (neither the only nor the determining one), in order to impose a fine that is proportionate, dissuasive and effective and thereby strengthens the protection of natural persons. On this matter, after detailing the content of paragraphs 1 and 2 of Article 83 of the GDPR, it states: 29 Although these elements do not refer to the concept of an undertaking, within the meaning of Articles 101 TFEU and 102 TFEU, the Court of Justice has already held that only a fine that takes into account not only all the elements that characterize the GDPR infringements found, but also, where applicable, the C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeaepd.gob.es 35/55 actual or material economic capacity of its recipient, meets the three requirements set out in Article 83(1) of the GDPR, namely, being effective, proportionate, and dissuasive...”. Furthermore, the CJEU Judgment of 13 June 2013, Versalis Spa v Commission, C-511/11, ECLI:EU:C:2013:386, states: “94. With regard, firstly, to the reference to the Showa Denko v Commission judgment, cited above, it should be noted that Versalis misinterprets it. Indeed, the Court of Justice, in stating in paragraph 23 of that judgment that the deterrent factor is assessed taking into account a multitude of elements and not only the particular situation of the undertaking concerned, was referring to points 53 to 55 of the Opinion delivered in that case by Advocate General Geelhoed, who had essentially stated that the deterrent multiplier can have as its objective not only a ‘general deterrence,’ defined as an action to discourage all undertakings, but also…” general, that they commit the infringement in question, but also a “specific deterrent,” consisting of dissuading the specific defendant from infringing the rules again in the future. Therefore, the Court of Justice, in that judgment, merely confirmed that the Commission was not obliged to limit its assessment to factors related solely to the particular situation of the company in question. “102. According to settled case law, the objective of the deterrent multiplier and the consideration, in this context, of the size and overall resources of the company in question lies in the desired impact on that company, since the penalty must not be insignificant, especially in relation to the company's financial capacity (in this regard, see, in particular, the judgment of 17 June 2010, Lafarge v Commission, C-413/08 P, ECR p. I-5361, paragraph 104, and the order of 7 February 2012, Total and Elf Aquitaine v Commission, C-421/11 P, paragraph 82).” 2. Regarding the absence of any benefit obtained as a result of the infringement, it should be noted that Article 83.2.k) of the GDPR refers to “any other aggravating or mitigating factor applicable to the circumstances of the case, such as financial benefits obtained or losses avoided, directly or indirectly, through the infringement.” And Article 76.2c) of the LOPDGDD states that “2. In accordance with the provisions of Article 83.2.k) of Regulation (EU) 2016/679, the following may also be taken into account: [...] c) The benefits obtained as a consequence of the commission of the infringement.” Both provisions mention the “benefits” obtained as a factor that may be taken into account in determining the severity of the penalty, but not the “absence” of such benefits. Furthermore, in accordance with Article 83.1 of the GDPR, the imposition of fines is governed by the following principles: they must be individualized for each particular case, be effective, proportionate, and dissuasive. The admission that the absence of profits can operate as a mitigating factor is contrary to the spirit of Article 83.1 of the GDPR and to the principles governing the determination of the amount of the fine. If, following the commission of a GDPR infringement, the absence of profits is considered a mitigating factor, the deterrent purpose of the penalty is partially nullified. Accepting the respondent's argument in a case such as the one at hand would entail introducing an artificial reduction in the penalty that should truly be imposed; which results from considering the circumstances C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeaepd.gob.es 36/55 of Article 83.2 GDPR that must be taken into account. The Administrative Chamber of the National Court has warned that the fact that in a specific case not all the elements that constitute a circumstance modifying liability, which by its nature is aggravating, are present, cannot lead to the conclusion that such circumstance is applicable as a mitigating factor. The ruling made by the National Court in its Judgment of May 5, 2021 (Appeal No. 1437/2020) – even though that ruling deals with the circumstance in paragraph (e) of Article 83.2. of the GDPR, the commission of prior infringements—is applicable to the issue at hand, the claim of the respondent that the “absence” of benefits be accepted as a mitigating factor, given that both the GDPR and the LOPDGDD refer only to “benefits obtained.” 3. Regarding the statute of limitations, it should be noted that the Spanish Data Protection Agency (AEPD) has taken as its reference the proven facts based on the contract signed by UNICAJA and Grupo Control on January 1, 2023, and that the infringement for lack of security measures for which the sanction is imposed has not expired. 4. The Administrative Chamber of the National Court has warned that, the fact that in a specific case not all the elements that constitute a circumstance modifying liability, which by its nature is aggravating, are present, cannot lead to the conclusion that such circumstance is applicable as a mitigating factor. The ruling issued by the National Court in its judgment of May 5, 2021 (Appeal No. 1437/2020) – even though that ruling deals with the circumstance of section e) of Article 83.2 of the GDPR, the commission of prior infringements – is applicable to the issues raised by the respondent. IV Breach of Obligation. Security of Processing Article 32 of the GDPR, Security of Processing, establishes the following: “1. Taking into account the state of the art, the costs of implementation, and the nature, scope, context, and purposes of the processing, as well as the risks of varying likelihood and severity for the rights and freedoms of natural persons, the controller and the processor shall implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, which may include, among other things: (a) the pseudonymization and encryption of personal data; (b) the ability to ensure the ongoing confidentiality, integrity, availability, and resilience of processing systems and services; (c) the ability to restore the availability of and access to personal data in a timely manner in the event of a physical or technical incident; (d) a process for regularly testing, assessing, and evaluating the effectiveness of the technical and organizational measures to ensure the security of the processing. 2. When assessing the adequacy of the level of security, the controller shall consider the following: particularly taking into account the risks presented by data processing, especially as a consequence of the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, personal data transmitted, stored, or otherwise processed. 3. Adherence to an approved code of conduct pursuant to Article 40 or to an approved certification mechanism pursuant to Article 42 may serve as evidence of compliance with the requirements laid down in paragraph 1 of this Article. 4. The controller and the processor shall take measures to ensure that any person acting under the authority of the controller or the processor who has access to personal data may only process such data on instructions from the controller, unless required to do so by Union or Member State law. C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeaepd.gob.es 37/55 3. Adherence to a code of conduct approved pursuant to Article 40 or to a certification mechanism approved pursuant to Article 42 may serve as evidence of compliance with the requirements laid down in paragraph 1 of this Article. 4. The controller and the processor shall take measures to ensure that any person acting under the authority of the controller or the processor who has access to personal data may only process such data on instructions from the controller, unless required to do so by Union or Member State law. Thus, this provision mandates the adoption of security measures, which may be technical or organizational in nature and must be appropriate to the risk of the personal data processing carried out. Conversely, this provision would be violated if such measures, appropriate to the risk and generally applicable, were not adopted to guarantee the security of the processing. The documentation included in the proceedings clearly demonstrates the absence of appropriate technical and organizational security measures to guarantee a level of security appropriate to the risk. Annex VIII of the Service Provision Agreement between UNICAJA and Grupo Control, signed on January 1, 2023, indicates, among the security measures established under the heading "Information Security Requirements and Technological Risk," that users and their passwords must be registered. This is stated in section 3.5.2: “3.5.2. Application Security Measures The PROVIDER undertakes that all applications that store or process information belonging to UNICAJA BANCO will comply with the following security measures: - Prior to providing the service, the PROVIDER will have defined, for each application or information asset that could contain UNICAJA BANCO information, the security roles or user profiles, ensuring that each user has the permissions strictly necessary for providing the service. - The PROVIDER must be able to obtain a list of users with access privileges to the systems that process UNICAJA BANCO information. In compliance with UNICAJA BANCO's traceability requirements, every user who accesses a system with UNICAJA BANCO information must be a registered user, and the sharing of user accounts among the PROVIDER's employees or in those where this can be delegated. However, the investigation has revealed that the system was configured with a single generic user account, and that this account was used by Grupo Control personnel. C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeaepd.gob.es 38/55 A list of Grupo Control personnel with access permissions has been provided. This list includes 10 operators (telephone operators) and one supervisor (coordinator) who accessed the image viewing system using this generic user account. UNICAJA, as the data controller, since it determines the purposes and means of processing personal data, pursuant to Article 4.7 of the GDPR, must assume this responsibility. As the data controller, you are responsible for adopting or verifying that the technical and organizational measures that safeguard the security of personal data are effectively adopted, ensuring that they are properly applied, and being able to demonstrate compliance with the GDPR and the LOPDGDD. Although a prior Impact Analysis study was conducted that considered specific security measures regarding logical access control to the images, it is not evident that these measures have been implemented, as a single user with generic access to the video surveillance system is configured continuously for all employees of the CRA. Furthermore, the investigation has revealed that UNICAJA did not review access profiles at the start of the services provided by Grupo Control. An audit was conducted in September 2024, when UNICAJA was already aware of the investigations being carried out by the Spanish Data Protection Agency (AEPD). This audit confirmed the lack of this security measure for controlling access by Grupo Control employees to UNICAJA's video surveillance systems. Moreover, it was also observed that the measures implemented do not guarantee adequate traceability of access, as this data is only stored for 90 days. The defendant's liability stems from the lack of the aforementioned security measures, as it is responsible for making decisions aimed at effectively adopting and implementing the appropriate technical and organizational measures to guarantee a level of security appropriate to the risk, to ensure the confidentiality of data, and to prevent unnecessary or excessive access by employees. Therefore, the failure of the data controller to adopt these security measures appropriate to the risk constitutes a breach of Article 32 of the GDPR, and these actions constitute an infringement attributable to UNICAJA for violating the aforementioned provision. V Classification of the infringement of Article 32 of the GDPR The aforementioned infringement of Article 32 of the GDPR constitutes the commission of the infringements classified in Article 83.4 of the GDPR, which, under the heading “General conditions for the imposition of administrative fines,” provides: C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeaepd.gob.es 39/55 “Infringements of the following provisions shall be sanctioned, in accordance with paragraph 2, with administrative fines of up to EUR 10,000,000 or, in the case of an undertaking, up to 2% of its total global annual turnover of the preceding financial year, whichever is higher: a) the obligations of the controller and the processor pursuant to Articles 8, 11, and 25a 39, 42 and 43; (...) In this regard, the LOPDGDD, in its Article 71 “Infringements”, establishes that “The acts and conduct referred to in paragraphs 4, 5 and 6 of Article 83 of Regulation (EU) 2016/679, as well as those that are contrary to this Organic Law, constitute infringements.” For the purposes of the statute of limitations, Article 73, “Serious Infringements,” of the LOPDGDD (Spanish Data Protection Act) states: “In accordance with the provisions of Article 83.4 of Regulation (EU) 2016/679, the following infringements are considered serious and will be subject to a two-year statute of limitations: (f) Failure to adopt the appropriate technical and organizational measures to ensure a level of security appropriate to the risk of the processing, as required by Article 32.1 of Regulation (EU) 2016/679.” (p) (e) (f) ... VI Proposed Sanction In order to determine the administrative fine to be imposed, the provisions of Articles 83.1 and 83.2 of the GDPR must be observed. These provisions state: “1. Each supervisory authority shall ensure that the imposition of administrative fines pursuant to this Article for infringements of this Regulation referred to in paragraphs 4, 5 and 6 is, in each individual case, effective, proportionate and dissuasive. 2. Administrative fines shall be imposed, depending on the circumstances of each individual case, as an additional measure to, or in lieu of, the measures provided for in Article 58(2)(a) to (h) and (j). When deciding on the imposition of an administrative fine and its amount in each individual case, due consideration shall be given to: (a) the nature, seriousness and duration of the infringement, taking into account the nature, scope or purpose of the processing operation in question. treat, as follows: as the number of data subjects affected and the level of damage suffered; b) the intentionality or negligence of the infringement; c) any measures taken by the controller or processor to C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeaepd.gob.es 40/55 mitigate the damage suffered by the data subjects; d) the degree of responsibility of the controller or processor, taking into account the technical and organizational measures implemented by them pursuant to Articles 25 and 32; e) any previous infringements committed by the controller or processor; f) the degree of cooperation with the supervisory authority in order to remedy the infringement and mitigate its possible adverse effects; g) the categories of personal data affected by the infringement; h) how the supervisory authority became aware of the infringement, in particularly whether the controller or the (i) the extent to which the controller or processor notified the infringement; (j) where the measures referred to in Article 58(2) have been previously ordered against the controller or processor concerned in relation to the same matter, compliance with those measures; (k) adherence to codes of conduct pursuant to Article 40 or to approved certification mechanisms pursuant to Article 42; (k) any other aggravating or mitigating factors applicable to the circumstances of the case, such as financial benefits obtained or losses avoided, directly or indirectly, through the infringement. For its part, Article 76, “Sanctions and Corrective Measures,” of the LOPDGDD (Spanish Data Protection Law) stipulates: “1. The sanctions provided for in paragraphs 4, 5, and 6 of Article 83 of Regulation (EU) 2016/679 shall be applied taking into account the criteria for determining the severity of the sanction established in paragraph 2 of said Article. 2. In accordance with the provisions of Article 83.2.k) of Regulation (EU) 2016/679, the following may also be taken into account: a) The ongoing nature of the infringement. b) The connection between the infringer's activity and the processing of personal data. c) The benefits obtained as a result of committing the infringement. d) The possibility that the data subject's conduct may have induced the commission of the infringement. e) The existence of a merger by acquisition subsequent to the commission of the infringement, which cannot be attributed to the acquiring entity.” f) The impact on the rights of minors. g) To have, when not mandatory, a data protection officer. h) The voluntary submission by the controller or processor to alternative dispute resolution mechanisms in those cases where disputes arise between them and any interested party. In this case, considering the seriousness of the infringement, and especially the risks that its commission entails, a fine is warranted. It is necessary to quantify the proposed sanction, considering that the fine imposed must be effective, proportionate, and dissuasive in each individual case, in accordance with Article 83.1 of the GDPR. C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeaepd.gob.es 41/55 as established in Article 83.1 of the GDPR. To guarantee these principles, the turnover of UNICAJA, which amounted to €1,775,548,000 in the 2023 financial year, is taken into account beforehand. First, the category of the infringement committed is taken into account, which falls within the level established in Article 83.4 of the GDPR, which punishes the conduct with a maximum fine of €10 million or, in the case of a company, with a fine equivalent to a maximum of 2% of its annual turnover. According to the aforementioned provision, when establishing the maximum applicable amount, the higher of the two limits set by the regulation must be chosen. In this case, since it is a company whose turnover in 2023 amounted to €1,775,548,000, the amount of the fine to be imposed will necessarily be between €0.00 and €35,510,960. In accordance with the aforementioned provisions, for the purpose of determining the initial amount of the penalty to be imposed in this case for the infringement of Article 32 of the GDPR for which UNICAJA is held responsible, as defined in Article 83.4(a) of the GDPR, the following factors are considered to be relevant: 1. The following circumstances are taken into account as determining factors of the severity of the infringement: . Article 83.2(a) of the GDPR: “the nature, seriousness and duration of the infringement, taking into account the nature, scope or purpose of the processing operation concerned, as well as the number of data subjects affected and the level of damage and loss suffered by them.” . Nature of the infringement: Article 83.4 encompasses several different types of conduct. In this case, the infringed provision affects a fundamental principle of the right to personal data protection, as it underpins the security of data processing and its violation poses a significant risk to the rights of data subjects, including risks to the confidentiality of personal data, insofar as control over all those acting on behalf of the controller has not been guaranteed, thus failing to ensure adequate protection of personal data. Seriousness of the infringement: Scope of the processing: It is important to consider that UNICAJA is a financial institution with a large presence and numerous video surveillance systems (8,885 cameras connected to the new system, plus 736 pending installations), and that the infringement is a direct consequence of weaknesses in the measures implemented by said institution. The relationship between the infringement committed and the allocation of resources that C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeaepd.gob.es 42/55 UNICAJA can be required to provide to prevent this type of illicit activity must be analyzed based on the actual risk and the circumstances related to its broad scope of operations. Number of interested parties: Considering the entity's reach, the number of potentially affected parties is very high. Duration of the infringement: the infringement was committed from the beginning of the contractual relationship between UNICAJA and Grupo Control, formalized in the service agreement signed in January 2023. Article 83.2.b) of the GDPR: “the intent or negligence in the infringement.” The conduct of UNICAJA demonstrates gross negligence, specifically a breach of the duty of care required by law, beyond what might be considered a neutral factor associated with the subjective element of culpability. This conclusion stems from objective elements of UNICAJA's conduct, obtained based on all the factual circumstances detailed in the preceding Legal Grounds, which clearly show that this entity took no action to ensure the effective implementation of the security measures required of the data processor. Related to the degree of diligence that the defendant is obligated to exercise in complying with the obligations imposed by data protection regulations, the judgment of the National High Court of 17/10/2007 can be cited. Although issued before the GDPR came into effect, its ruling is perfectly applicable to the case under analysis. The ruling, after alluding to the fact that entities whose activity involves the continuous processing of customer and third-party data must observe an appropriate level of diligence, specified that “(...) the Supreme Court has consistently held that negligence exists whenever a legal duty of care is disregarded, that is, when the offender does not act with the required diligence. And in assessing the degree of diligence, special consideration must be given to the professionalism of the individual, and there is no doubt that, in the case now under examination, when the appellant's activity involves the constant and extensive handling of personal data, the rigor and meticulous care must be emphasized to comply with the relevant legal provisions.” Article 83.2.g) of the GDPR: “the categories of personal data affected by the infringement.” The infringement committed affects personal data relating to the image of “clients”, “potential clients”, “employees and equivalents”, as well as “suppliers”. 2. The following mitigating factor is considered: Article 83.2.k) of the GDPR: “any other aggravating or mitigating factor applicable to the circumstances of the case, such as financial benefits obtained or losses avoided, directly or indirectly, through the infringement.” C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeaepd.gob.es 43/55 The assessment of UNICAJA's conduct in this case requires considering the actions taken by said entity aimed at complying with the provisions of the GDPR and the Spanish Data Protection Act (LOPDGDD), in consideration of the principle of continuous improvement, especially those detailed in Findings Six and Seven. Without overlooking the fact that continuous improvement is an obligation for those responsible for data processing, it is deemed appropriate to consider the proactive attitude shown by UNICAJA, which, throughout the proceedings, has carried out specific controls to identify the deficiencies in its security measures and has implemented the necessary changes to correct the irregular situation. Based on the foregoing, and considering the requirement that the fine be effective, proportionate, and dissuasive, and with the aim of ensuring effective compliance with the GDPR and the LOPDGDD, the assessment of the circumstances contemplated in Article 83.2 of the GDPR and Article 76.2 of the LOPDGDD, considered as a whole, with respect to the alleged infringement of the provisions of Article 6 of the GDPR, allows us to propose an administrative fine in the amount of €500,000.00 (five hundred thousand euros). VII Corrective Measures Once the infringement has been confirmed, the resolution issued may establish the corrective measures that the infringing entity must adopt to end the non-compliance with personal data protection legislation, in this case Article 32 of the GDPR, in accordance with the provisions of Article 58.2.d) of the GDPR, according to which each supervisory authority may “require the controller or processor to bring processing operations into compliance with the provisions of this Regulation, where appropriate, in a specific manner and within a specified time period…” Thus, the responsible entity may be required to adapt its actions to the personal data protection regulations, to the extent expressed in the previous Legal Basis. This document establishes the alleged infringement and the facts that could give rise to this possible violation of data protection regulations. From this, the measures to be adopted are clearly inferred, without prejudice to the fact that the specific procedures, mechanisms, or instruments for implementing them correspond to the sanctioned party, since it is the data controller who fully knows their organization and must decide, based on proactive responsibility and a risk-based approach, how to comply with the GDPR and the LOPDGDD. In this case, it is established that UNICAJA has implemented a new system that allows for the integration and management of all security systems in a single application, as well as establishing access control based on roles or permissions assigned by name. C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeaepd.gob.es 44/55 At the same time, it has established guidelines to define access segmentation based on each user's responsibilities and the implementation of specific access controls to ensure that only authorized users can access and download images from customer recorders. This includes authentication using unique credentials and monitoring of activities performed. Therefore, it is proposed that the resolution adopted require UNICAJA to demonstrate to this Agency, within a maximum period of three months from the date of enforcement of the final resolution of this procedure, the adoption and effective implementation of the indicated measures, in compliance with the provisions of Article 32 of the GDPR. Please be advised that failure to comply with any order to adopt measures imposed by this agency in the resolution of this sanctioning procedure may be considered an administrative infringement in accordance with the GDPR, specifically classified as an infringement in Articles 83.5 and 83.6, and such conduct may lead to the initiation of further administrative sanctioning proceedings. Furthermore, please note that neither acknowledgment of the infringement committed nor, where applicable, voluntary payment of the proposed amounts, exempts you from the obligation to take the necessary measures to cease the conduct or correct the effects of the infringement committed, and from the obligation to demonstrate compliance with this obligation to the Spanish Data Protection Agency (AEPD). In view of the foregoing, the following PROPOSED RESOLUTION is issued: That the President of the Spanish Data Protection Agency sanction UNICAJA BANCO, S.A.U., with Tax Identification Number A93139053, for an infringement of Article 32 of the GDPR, classified under Article 83.4 of the GDPR, with a fine of 500,000 euros (five hundred thousand euros). That the Presidency of the Spanish Data Protection Agency order UNICAJA BANCO, S.A.U., with Tax Identification Number A93139053, to demonstrate to this Agency, within a maximum period of three months from the date of enforcement of the final resolution of this procedure, the adoption of the necessary measures to guarantee compliance with the provisions of Article 32 of the GDPR, to the extent expressed in Legal Basis VII of this proposed resolution, pursuant to Article 58.2.d) of the GDPR. Furthermore, in accordance with the provisions of Article 85.2 of the LPACAP, you are hereby informed that you may, at any time prior to the resolution of this procedure, make voluntary payment of the proposed penalty, which will entail a 20% reduction of the amount. With the application of this reduction, the penalty would be set at 400,000 euros (four hundred thousand euros) and its payment will result in the termination of the proceedings, without prejudice to the imposition of the corresponding measures. The effectiveness of this reduction will be conditional upon the withdrawal or waiver of any administrative action or appeal against the penalty. C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeaepd.gob.es 45/55 For these purposes, if you choose to take advantage of this reduction, you must send the General Sub-Directorate for Data Inspection express notification of your withdrawal or waiver of any administrative action or appeal against the penalty. Should you choose to make voluntary payment of the amount specified above, in accordance with the provisions of Article 85.2, you must make it effective by depositing it into the restricted account no. IBAN: ES00-0000-0000-0000-0000-0000-0000-0000-0000 (BIC/SWIFT Code: CAIXESBBXXX) held in the name of the Spanish Data Protection Agency at CAIXABANK, S.A., indicating in the payment details the reference number of the procedure shown in the heading of this document and the reason for the reduction of the penalty amount due to voluntary payment. You must also send proof of payment to the General Sub-Directorate of Inspection in order to close the file. In accordance with Article 76.4 of the LOPDGDD (Organic Law on the Protection of Personal Data and Guarantee of Digital Rights) and given that the amount of the imposed penalty exceeds one million euros, the information identifying the offender, the offense committed, and the amount of the penalty will be published in the Official State Gazette. Therefore, you are hereby notified of the foregoing and informed of the proceedings so that, within TEN DAYS, you may submit any arguments you deem relevant in your defense and submit any documents and information you consider pertinent, in accordance with Article 89.2 of the LPACAP (Law on the Common Administrative Procedure of Public Administrations). 926-250625 R.R.R. INSTRUCTOR ANNEX File Index EXP202404507 (…) >> The aforementioned proposed resolution was sent, in accordance with the regulations established in the LPACAP (Law on Administrative Procedure of Public Administrations), by electronic notification, and was received on January 19, 2026, as evidenced by the certificate included in the file. SECOND: On February 2, 2026, UNICAJA submitted a brief of arguments to the Proposed Resolution, in which, in summary, it states that: FIRST. - UNICAJA ACCEPTS THE REDUCTION FOR VOLUNTARY PAYMENT OF THE PENALTY. The payment receipt is attached as Document No. 1. Having voluntarily paid the penalty, pursuant to Article 85 of Law 39/2015 and waiving the right to appeal through administrative channels, UNICAJA requests that a resolution be issued declaring the termination of these disciplinary proceedings and ordering their closure. C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeaepd.gob.es 46/55 SECOND. - UNICAJA HAS ACTED DILIGENTLY AND HAS NOT VIOLATED ARTICLE 32 GDPR. Notwithstanding the foregoing, UNICAJA does not acknowledge responsibility for the alleged infringement and maintains that its actions have been in accordance with data protection regulations at all times. It alleges that the obligation of Article 32 GDPR... Article 32 of the GDPR is an obligation of means, not of result, and affirms that UNICAJA has implemented the measures whose absence is criticized by the Spanish Data Protection Agency (AEPD). It considers that it has not breached its obligations under Article 32 of the GDPR. It states that UNICAJA adequately monitors and verifies all its suppliers, and, in particular, Grupo Control. Evidence of these measures is included in the file and was submitted during the evidentiary phase. It also considers that, (...). Therefore, without prejudice to the voluntary payment and the consequent waiver of the right to file an appeal through administrative channels, it considers it proven that UNICAJA has acted duly and has complied with its obligations under Article 32 of the GDPR. THIRD. – ERROR IN THE CLASSIFICATION OF THE INFRINGEMENT. UNICAJA wishes to point out an error in the classification of the infringement in accordance with the Spanish Data Protection Act (LOPDGDD). It asserts that UNICAJA did have implemented technical and organizational measures related to logical access control and the obligation to use named users. It considers that, therefore, this is not a case of "failure to adopt" measures, but rather, if anything, a breach of measures already in place. Therefore, the conduct (if applicable) should be classified under Article 73(g) of the LOPDGDD (Spanish Data Protection Law). It understands that this is because the fact that named users were not established does not stem from a lack of security measures, but from their breach by the actions of the data processor (Control Group). It argues that the classification must be based on the proven facts, so if the facts demonstrate that measures were indeed implemented (and breached by the processor), the application of an offense that presupposes their absence is not appropriate. Therefore, it requests that the Spanish Data Protection Agency (AEPD), should it issue a ruling finding an infringement of Article 32 of the GDPR, classify the facts under section (g) and not section (f) of Article 73 of the Spanish Data Protection Act (LOPDGDD). FOURTH. – UNICAJA HAS ALREADY ADOPTED CORRECTIVE MEASURES. It indicates that it conducts ongoing reviews of its data protection measures to identify potential areas for improvement or strengthening, as well as the effective C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeaepd.gob.es 47/55 implementation of these measures, both by UNICAJA employees and by third-party providers. Specifically, within its commitment to strict compliance with data protection regulations, regarding Grupo Control's security measures and user and logical access management systems, it states that it has continuous review mechanisms and monitors the effectiveness of security measures. In particular, it reports that it conducted an audit of Grupo Control—prior to the Commencement Agreement—in 2024 to ensure effective compliance with its instructions and the imposed security measures, in order to identify potential deficiencies or areas for improvement (see Document No. 2-10 submitted during the evidentiary phase). It explains that the audit included an assessment of the application of measures for access control to images captured by video surveillance systems and a review of the methods of preservation, timeframes, and means for the effective destruction of images. In the section on access control measures for images from the video surveillance systems in the Audit Report (the “Report”), reference is made to an area for improvement, namely access to recordings through a single user and it states that “UNICAJA is currently strengthening access measures to CCTV. In particular, the proposed solution is the implementation of the ***SYSTEM.1 system, which allows the integration and management of all security systems (access control systems, alarms, attendance control, etc.) in a single application. With this system, role-based access control can be established for this application—permissions are assigned by name—thus preventing possible direct access to the recorders.” The Report indicates that this reinforcement is already included in the Proposal for Securing the Image Access System for the video surveillance system, submitted to the Technological Risk Committee on June 21, 2024. It alleges that in those security measures where potential reinforcements were detected, UNICAJA was already working to strengthen its system. Furthermore, the action plan proposed in the Report coincides with the measures that UNICAJA was working to implement. As a result of this audit, it states that it made specific recommendations to Grupo Control regarding security measures and access systems. It indicates that it initiated procedures to address any elements that might present areas for improvement, from the moment they came to its attention. It states that it has considered as a priority any potential area for improvement that may have been detected both in the Audit and in the course of ordinary activity and has made every effort to address them through the new system ***SISTEMA.1 (see Documents No. 2-5 and No. 2-6 submitted during the evidentiary phase). It claims to have followed the recommendations and can confirm that, to date, Grupo Control has implemented them (see Document No. 2-10 submitted during the evidentiary phase). For this reason, it asserts that it has an up-to-date access control system which, with the implementation of SYSTEM.1, allows for role-based access control, assigning permissions by name. Therefore, it argues that corrective measures are not required, as it considers that it has technical and organizational measures in place in accordance with Article 32 of the GDPR. Furthermore, it maintains that there is no room for objection to the access control measures currently in place at UNICAJA. Any C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeaepd.gob.es 48/55 The Spanish Data Protection Agency (AEPD) considers that the issue regarding an alleged deficiency in the implementation of nominative user accounts is now fully resolved, thanks to the control, continuous review, and monitoring measures in place. In short, it believes that corrective measures are not required, since such measures have already been voluntarily adopted by UNICAJA. FIFTH. - THE RESOLUTION SHOULD NOT BE PUBLISHED IN THE BOE (Official State Gazette). It argues that the Proposed Resolution includes a fine of €500,000, an amount that, with UNICAJA's acceptance of the early payment discount, is reduced to €400,000. Both figures are below 1,000,000, therefore it is understood that the threshold amount established by Article 76.4 of the LOPDGDD for publication in the BOE (Official State Gazette) is not met. Consequently, without prejudice to the publicity that corresponds to the resolution in accordance with Article 50 of the LOPDGDD, it considers that publication in the BOE of the resolution that concludes the proceedings is not appropriate. In light of the foregoing, it requests the AEPD (Spanish Data Protection Agency) to accept the document and the accompanying documents, and after the appropriate legal procedures, issue a resolution terminating the present sanctioning proceedings for an infringement of Article 73(g) of the LOPDGDD, and to proceed with their archiving, without imposing corrective measures on UNICAJA or publishing it in the BOE. THIRD: On February 2, 2026, UNICAJA voluntarily paid the proposed penalty in the amount of 400,000 euros (four hundred thousand euros), taking advantage of the 20% reduction in this amount, in accordance with the provisions of Article 85.2 of the LPACAP. LEGAL BASIS I Jurisdiction In accordance with the powers granted to each supervisory authority by Article 58.2 of Regulation (EU) 2016/679 (General Data Protection Regulation, hereinafter GDPR) and as established in Articles 47, 48.1, 64.2 and 68.1 of Organic Law 3/2018, of December 5, on the Protection of Personal Data and Guarantee of Digital Rights (hereinafter LOPDGDD), the Presidency of the Spanish Data Protection Agency is competent to resolve this procedure. Likewise, Article 63.2 of the LOPDGDD (Organic Law on the Protection of Personal Data and Guarantee of Digital Rights) establishes that: "The procedures processed by the Spanish Data Protection Agency shall be governed by the provisions of Regulation (EU) 2016/679, by this Organic Law, by the implementing regulations issued thereunder, and, insofar as they do not contradict them, on a subsidiary basis, by the general rules on administrative procedures." II Allegations to the Proposed Resolution C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeaepd.gob.es 49/55 Regarding the allegations submitted to the Proposed Resolution, the following responses are provided, in the order set forth: FIRST. - UNICAJA ACCEPTS THE REDUCTION FOR VOLUNTARY PAYMENT OF THE PENALTY. It is recorded that UNICAJA, on February 2, 2026, voluntarily paid the proposed penalty, in the amount of €400,000.00, taking advantage of the 20% reduction provided for in the Proposed Resolution. Therefore, in accordance with the provisions of Article 85.2 of the LPACAP (Law on Administrative Procedure of Public Administrations), with the application of this reduction, the penalty is set at €400,000 (four hundred thousand euros) and its payment implies the termination of the proceedings, without prejudice to the imposition of the corresponding measures. SECOND. - UNICAJA HAS ACTED DILIGENTLY AND HAS NOT VIOLATED ARTICLE 32 GDPR. At this point, it is worth recalling that Article 32 of the GDPR does indeed establish an obligation of means, but not just any means, rather “appropriate technical and organizational measures,” taking into account the nature, scope, context, purposes of the processing, and risks to the rights and freedoms of individuals. In a massive video surveillance system of a banking institution, with images of clients, employees, and third parties, the required standard of diligence is very high: individual traceability of access, profile segmentation, effective control of suppliers, and real and periodic audits of who accesses the images. Therefore, the debate is not whether documents or contracts existed, but whether the measures actually implemented and operational during the relevant period guaranteed a level of security appropriate to the risk, a question that is denied in light of the proven facts. UNICAJA acknowledged that the video surveillance software was accessed using a single generic username and password, used by all Grupo Control employees at the Central Receiving Area (CRA). The access log only recorded the generic username and the device's IP address, making it impossible to know which specific person was accessing the system, when, and for what purpose. This directly contradicts the requirements for named users, segmentation, and traceability contained in Annex VIII itself. Therefore, UNICAJA is not in compliance with Article 32 of the GDPR if it tolerates for years an access system without individual user identification, in a high-risk processing activity such as bank video surveillance. Article 32 requires measures such as the ability to guarantee confidentiality, integrity, availability, and resilience, as well as the ability to ensure that any person acting under the authority of the controller and having access to data may only process it on the controller's instructions. However, the established facts demonstrate noncompliance based on the use of a generic user account to access all video surveillance recorders, the inability to maintain an individualized access log (who, when, from where, and what images were viewed or downloaded), and the absence of a formalized procedure for controlling access to images by the various operators of Grupo Control. C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeaepd.gob.es 50/55 The fact that an external audit expressly recommends updating the technical access control measures to allow user tracking demonstrates that the previous situation was inadequate. Specifically, the external audit identified that there was only one generic user account for the recorders, which could hinder the tracking and recording of access users, and that there was no procedure formalizing the access control model based on operator profiles. This aligns precisely with what Article 32 of the GDPR aims to prevent: a system where individual actions regarding sensitive data processing cannot be attributed to each person, hindering control and the assignment of responsibility. The fact that the implementation of the ***SYSTEM.1 solution and new procedures was planned or initiated later demonstrates that the previous measures were insufficient. Furthermore, UNICAJA maintains that it "monitors and verifies all its suppliers adequately" and that it conducted audits in 2022 and 2023. However, the internal controls provided focus on deleting images within 15 days of recording, making images available to authorities, and random reviews of supplier contracts. No controls are documented regarding: access to images, segmentation of access profiles, or access traceability. In other words, the audits failed to address the most critical aspect of security in video surveillance: who views the images, with what profile, and with what record. Since this is the core of the risk to rights and freedoms, the omission of specific controls reveals deficient risk management and, therefore, a violation of Article 32, which requires an assessment and measures tailored to the actual risk. In fact, the 2024 external audit, commissioned by UNICAJA itself, identified these deficiencies and formulated medium-risk recommendations, proving that the previous system was not considered compliant with the required standard and that the supposedly "diligent" supplier monitoring had neither detected nor corrected a structural flaw (generic user) that had been occurring for years. Finally, regarding the measures that UNICAJA invokes, these are reactive measures and were adopted after the 2024 external audit and the 2025 analysis, when the events under investigation had already taken place. In this sense, compliance with Article 32 is assessed at the time of the infraction, not based on subsequent corrections. Subsequent improvements may be considered for the purpose of determining the penalty, but they do not excuse the prior non-compliance nor do they make diligent an action that tolerated a generic user without traceability for years. The text of the “conclusions” analysis itself acknowledges that as of November 2025, the connection of all cameras was still not complete and that the risk is considered “mitigated to an adequate level,” which presupposes that it was not previously. Therefore, far from demonstrating the absence of any infraction, these actions corroborate that UNICAJA was aware that its previous measures did not reach the required level of security. Finally, UNICAJA maintains that the Grupo Control employee was aware of the use of a generic user account, had an obligation to report it through the internal reporting channel, and failed to do so, using the information for other purposes (work-related, private security). In this regard, it should be noted that Article 32 of the GDPR imposes the obligation to implement appropriate measures on the data controller (UNICAJA), not on the C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeaepd.gob.es 51/55 employee of a data processor. The duty to design, implement, and monitor access controls is not transferred to the whistleblower. The existence of an internal reporting channel does not exempt the controller from deploying its own audits and controls, especially when it already has the contractual right to audit roles and users and has agreed to named users. Therefore, although Article 32 of the GDPR is an obligation of means, UNICAJA did not deploy the appropriate technical and organizational means required, and therefore the allegations presented must be dismissed. THIRD. – ERROR IN THE CLASSIFICATION OF THE INFRINGEMENT. At this point, it should be noted that the established facts have confirmed that the technical and organizational measures of Article 32 of the GDPR were not effectively adopted or implemented by the controller (UNICAJA). Article 32 imposes on the data controller (UNICAJA) the obligation to adopt appropriate technical and organizational measures, even when processing is outsourced to a processor. Article 32.4 specifies that, in these cases, specific contractual obligations must be established and their effective compliance ensured. Having a contract with specific clauses (Annexes VII and VIII) does not equate to having adopted the measures. UNICAJA should have verified their actual application. The established facts demonstrate that there was no individual traceability: a generic user account for 11 people, records only by device IP address, without identification of who accessed the system specifically. This is not an isolated breach by Grupo Control, but rather a structural deficiency tolerated for years (2023-2024), incompatible with the contractually required named users since May 25, 2023 (Annex VIII). Therefore, UNICAJA's argument on this matter in its allegations is not in accordance with the law. UNICAJA confuses contractual documents with implemented measures. As previously noted, the 2024 external audit commissioned by UNICAJA classifies the generic user as a medium-risk finding that could hinder traceability, recommending an update to the technical measures. The corrective actions (SYSTEM.1, procedures) were implemented in 2025, implicitly confirming that adequate measures were not previously in place. If the measures had been implemented, there would have been no need to recommend their implementation or consider the risk mitigated after 2025. This proves the lack of prior adoption, not the mere breach. Consequently, the allegations must be dismissed. FOURTH. – UNICAJA HAS ALREADY ADOPTED THE CORRECTIVE MEASURES. First, it should be noted that the subsequent corrective measures do not invalidate the essential content of the declared infringement nor do they constitute sufficient justification or exculpation. The existence of reviews and C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeaepd.gob.es 52/55 corrections confirms that the prior measures were deficient. Compliance with Article 32 of the GDPR was assessed at the time of the events (2023-2024), when a generic user account without traceability persisted. In this regard, UNICAJA implicitly admits the infringement by acknowledging areas for improvement and necessary reinforcements. Thus, the 2024 audit identifies the single generic user account as a medium-risk finding, as this could hinder the tracking of individuals accessing the system. Furthermore, it explicitly recommends updating the technical access control measures to allow for individual registration. The implementation of the system ***SYSTEM.1 was implemented in 2025, with 8.28% of cameras still pending as of November 2025, confirming that an adequate level of security did not previously exist. Indeed, as UNICAJA points out, and as stated in the proposed resolution, the entity has implemented a new system that allows for the integration and management of all security systems in a single application, as well as the establishment of access control based on roles or permissions assigned individually. At the same time, it has established guidelines to define access segmentation based on each user's responsibilities and the implementation of specific access controls to ensure that only authorized users can access and download images from customer recorders. This includes authentication using unique credentials and monitoring of activities performed. However, the "Final Analysis of Recommendations Issued in the Audit of Alarm Receiving Center Data," conducted in December 2025, makes recommendations regarding the implementation of a system that strengthens access control to video recorders. (...) In short, UNICAJA is asked to confirm the adoption and effective implementation of the measures indicated. Therefore, it is proposed that the resolution adopted require UNICAJA to within a maximum period of three months from the date of enforcement of the final resolution of this procedure, demonstrate to this Agency the adoption and effective implementation of the indicated measures, in compliance with the provisions of Article 32 of the GDPR. Furthermore, it is noted that Article 5.2 of the GDPR establishes the principle of proactive responsibility when it states that “The controller shall be responsible for compliance with paragraph 1 and be able to demonstrate such compliance.” This principle refers to the obligation of the data controller not only to design, implement, and observe the appropriate legal, technical, and organizational measures to ensure that data processing complies with regulations, but also to remain actively vigilant throughout the entire processing lifecycle to ensure proper compliance, and to be able to demonstrate it. Consequently, the allegations must be dismissed. C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeaepd.gob.es 53/55 FIFTH. - THE RESOLUTION SHOULD NOT BE PUBLISHED IN THE BOE (Official State Gazette). Article 76.4 of the LOPDGDD (Organic Law on the Protection of Personal Data and Guarantee of Digital Rights) requires publication in the BOE when the competent authority is the Spanish Data Protection Agency, the penalty exceeds one million euros, and the offender is a legal entity. In the specific case at hand, the penalty imposed in the resolution is €500,000, which is below the €1,000,000 threshold established by Article 76.4 of the Spanish Data Protection Act (LOPDGDD). Therefore, its publication in the Official State Gazette (BOE) is not required. However, the resolution will be published on the Spanish Data Protection Agency (AEPD) website in accordance with Article 50 of the LOPDGDD. III Termination of the Procedure Article 85 of Law 39/2015, of October 1, on the Common Administrative Procedure of Public Administrations (hereinafter LPACAP), under the heading “Termination of Sanctioning Procedures,” provides the following: “1. Once sanctioning proceedings have been initiated, if the offender acknowledges their responsibility, the proceedings may be resolved by imposing the appropriate sanction. 2. When the sanction is solely monetary, or when both a monetary and a non-monetary sanction may be imposed but the impropriety of the latter has been justified, voluntary payment by the alleged offender at any time prior to the resolution will result in the termination of the proceedings, except with regard to restoring the altered situation or determining compensation for damages caused by the commission of the infraction.” 3. In both cases, when the sanction is solely monetary, the competent body for resolving the proceedings shall apply reductions of at least 20% to the proposed sanction amount, and these reductions may be combined. These reductions must be specified in the notification initiating the proceedings, and their application is conditional upon the withdrawal or waiver of any administrative action or appeal against the sanction. The percentage reduction provided for in this section may be increased by regulation. IV Voluntary Payment In accordance with the provisions of Article 85 of the LPACAP (Law on Administrative Procedure and Common Administrative Procedure), the notified resolution allowed for voluntary payment of the proposed penalty, which would entail a 20% reduction. With this reduction, the penalty would be set at €400,000.00, and its payment would terminate the proceedings, without prejudice to the imposition of any applicable measures. Following the aforementioned resolution and before a decision was issued by this authority, the respondent, on February 2, 2026, proceeded to: C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeaepd.gob.es 54/55 make voluntary payment, taking advantage of the 20% reduction and waiving any further administrative action or appeal. Must It should be noted that, in accordance with the provisions of the LPACAP (Law on Administrative Procedure of Public Administrations), as well as the jurisprudence of the Supreme Court on this matter, the exercise of voluntary payment by the alleged responsible party does not exempt the administration from the obligation to resolve and notify all proceedings, regardless of how they were initiated. Likewise, Article 88 of the aforementioned law establishes that the resolution that concludes the proceedings will decide all the issues raised by the interested parties and any other issues arising therefrom. Therefore, in accordance with the applicable legislation and having assessed the criteria for determining the severity of the sanctions, the existence of which has been proven, the Presidency of the Spanish Data Protection Agency resolves: FIRST: To impose on UNICAJA BANCO, S.A., with Tax Identification Number A93139053, for an infringement of Article 32 of the GDPR, classified in Article 83.4 of the GDPR, a fine of 500,000 euros (five hundred thousand euros). After UNICAJA BANCO, S.A., with Tax Identification Number A93139053, made prompt payment, pursuant to Article 85 of the LPACAP (Law on Administrative Procedure of Public Administrations), a 20% reduction of the aforementioned total is applied, resulting in a final amount of 400,000 euros. The effectiveness of this reduction is conditional upon the withdrawal or waiver of any administrative action or appeal. SECOND: DECLARE the termination of procedure EXP202404507, in accordance with the provisions of Article 85 of the LPACAP. THIRD: ORDER UNICAJA BANCO, S.A., with Tax Identification Number A93139053, pursuant to Article 58.2.d) of the GDPR, within a maximum period of three months, counting from From the date of enforcement of this resolution, demonstrate to this Agency the adoption of the necessary measures to guarantee compliance with the provisions of Article 32 of the GDPR, to the extent expressed in Legal Basis VII of the Proposed Resolution. FOURTH: NOTIFY this resolution to UNICAJA BANCO, S.A., with Tax Identification Number (NIF) A93139053. FIFTH: In accordance with the provisions of Article 85 of the LPACAP, which conditions the reduction for voluntary payment on the withdrawal or waiver of any action or appeal through administrative channels, this authority accepts the waiver expressly stated by the respondent, and therefore, the filing of an optional appeal for reconsideration against this resolution is not permitted, all without prejudice to the possibility of resorting to the contentious-administrative jurisdiction. Consequently, taking into account the provisions of Article 90 of the LPACAP, given that no further administrative appeal is possible due to the express waiver of this right, this resolution will be fully enforceable upon notification. C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeaepd.gob.es 55/55 However, in accordance with Article 90.3 a) of the LPACAP, the final administrative resolution may be provisionally suspended if the interested party expresses their intention to file an appeal with the Administrative Court. If this is the case, the interested party must formally communicate this fact in writing to the Spanish Data Protection Agency, submitting it through the Agency's Electronic Registry [https://sedeagpd.gob.es/sede-electronica-web/], or through one of the other registries provided for in Article 16.4 of the aforementioned law. Law 39/2015, of October 1. You must also forward to the Agency the documentation that proves the effective filing of the administrative appeal. If the Agency is not notified of the filing of the administrative appeal within two months from the day following notification of this resolution, the precautionary suspension will be terminated. In accordance with the provisions of Article 50 of the LOPDGDD (Organic Law on the Protection of Personal Data and Guarantee of Digital Rights), this Resolution will be made public. Publication will take place once it has been notified to the interested parties. 1573-011025 Lorenzo Cotino Hueso President of the Spanish Data Protection Agency C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeaepd.gob.es
