AEPD (Spain) - EXP202408496

AEPD - EXP202408496
Authority:	AEPD (Spain)
Jurisdiction:	Spain
Relevant Law:	Article 5(1)(a) GDPR Article 6(1) GDPR Article 6(1)(a) GDPR Article 6(1)(b) GDPR Article 6(1)(f) GDPR Article 7 GDPR
Type:	Complaint
Outcome:	Upheld
Started:	17.04.2024
Decided:
Published:	17.03.2026
Fine:	100.000 EUR
Parties:	BBVA
National Case Number/Name:	EXP202408496
European Case Law Identifier:	n/a
Appeal:	Unknown
Original Language(s):	Spanish
Original Source:	AEPD (in ES)
Initial Contributor:	RP

The DPA fined a bank €100,000 for unlawfully changing a data subject’s SEPA direct debit mandate from a closed account to a new account without prior instruction by the data subject, thus infringing Article 6(1) GDPR.

English Summary

Facts

A data subject filed a complaint with the Spanish Data Protection Authority (AEPD) against BBVA, a bank acting as a controller.

The data subject had two bank accounts with the controller. An insurance company collected premiums from one of these accounts through a SEPA (Single Euro Payments Area) direct debit mandate. On 14 February 2022, the data subject closed both accounts due to security concerns and opened a new account with the same controller.

On 21 March 2022, the insurance company issued a direct debit request to one of the closed accounts. The controller did not reject the request. Instead, it redirected the payment and debited the amount from the data subject’s new account. The controller did this without any documented instruction linking the closed accounts to the new account.

The data subject stated that they had not authorised this debit from the new account. They also claimed that they had arranged for the insurance premium to be paid from another account. The data subject therefore considered the processing unlawful.

The controller argued that the original SEPA mandate had not been revoked. It claimed that this mandate allowed the continued collection of payments. The controller also argued that the data subject had implicitly accepted the redirection of payments, as they had not objected and similar transactions had occurred before. In addition, the controller relied on Article 6(1)(b) GDPR and Article 6(1)(f) GDPR as alternative legal bases.

Holding

The AEPD held that the controller infringed Article 6(1) GDPR because it processed personal data without a valid legal basis.

The AEPD explained that a SEPA direct debit mandate is linked to a specific bank account identified by its IBAN. Even if BBVA’s assertion that the mandate had not been revoked were accepted, the mandate only covered the original account. The controller therefore needed a new authorisation to debit a different account with a different IBAN. The controller could not rely on the existing mandate to justify the new processing.

The AEPD rejected the argument of implied consent. It held that consent under Article 6(1)(a) GDPR must be freely given, specific, informed and unambiguous. The data subject must express consent through a clear affirmative action. The absence of an objection or the data subject’s silence did not meet this standard. The controller also failed to demonstrate that valid consent existed.

The AEPD also rejected the alternative legal bases. It held that the controller could not switch legal bases after the processing had taken place. In any event, Article 6(1)(b) GDPR did not apply because the controller was not a party to the insurance contract. The processing was not necessary for the performance of a contract with the data subject. The AEPD also found that the controller had not demonstrated a legitimate interest under Article 6(1)(f) GDPR, as it did not carry out the required balancing test or consider the data subject’s expectations.

The AEPD concluded that the controller acted negligently. As a financial institution, the controller had to apply a high standard of care when processing personal data. Debiting a different account without verifying a legal basis breached this duty.

The AEPD therefore imposed a fine of €100,000 on the controller for the infringement of Article 6(1) GDPR. There was a 20% reduction to €80,000 of the fine since the controller proceeded to make a voluntary payment according to Spanish procedural law.

Comment

A relevant question in this case is whether the debiting operation constitutes a data processing activity. However, this issue was not raised by any of the parties. The AEPD merely stated: “In the present case, in accordance with the provisions of Articles 4(1) and 4(2) of the GDPR, the processing of personal data has taken place, since BBVA carries out, among other processing activities, the collection and storage of personal data of natural persons: first and last name, address, email address, and bank account, among others.”

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Spanish original. Please refer to the Spanish original for more details.

1/35

• File No.: EXP202408496

RESOLUTION OF SANCTIONING PROCEEDINGS

From the proceedings initiated by the Spanish Data Protection Agency and based on

the following

BACKGROUND

FIRST: On April 17, 2024, a complaint was filed with the Spanish Data Protection Agency

regarding a possible infringement attributable to BANCO
BILBAO VIZCAYA ARGENTARIA, S.A., with Tax Identification Number A48265169 (hereinafter, BBVA).

The facts brought to the attention of this authority are as follows:

The claimant states that they held two accounts with the defendant entity (ending in ***ACCOUNT.1 and ***ACCOUNT.2) and that, following security incidents involving their mailbox due to theft of mail, they chose to close these accounts and open a new one with the defendant entity (ending in ***ACCOUNT.3).

They indicate that, to do so, they were asked to digitally sign a series of documents that were to be sent to them via email. However, upon accessing these documents later, they discovered that the files were corrupted and could not be opened. Subsequently, through a notarized request for the documents, it was confirmed that only two of the documents had been properly signed digitally.

Furthermore, the claimant states that they have an insurance policy with ***ENTITY.1,
with the payment set up as a direct debit from one of the defendant's accounts that they closed.

They further state that, without having informed ***ENTITY.1 of the new account, the defendant issued a direct debit to the closed account on March 21, 2022, and the defendant accepted the charge to the new account without the claimant's prior authorization.

***ENTITY.1 did not issue the direct debit to the new account, and there was no connection or transfer of charges between the closed accounts and the new account.

The claimant also states that they had set up a direct debit for that payment from a different account, unrelated to the previous ones, a few weeks earlier.

Furthermore, it highlights the lack of transparency and malpractice in the actions of the defendant, as they failed to provide any documents related to the cancellation of the accounts, did not send the requested documentation by email, and sent documents lacking the defendant's signature, in addition to their lack of cooperation in canceling the mortgage.

Along with the claim, the following is provided:

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 2/35

- copy of the police report for theft of postal correspondence,

- copy of the account cancellation requests bearing the entity's stamp, dated February 14, 2022,

- copy of the bank statement regarding the insurance charge made to the new account (ending in ***CUENTA.3) on March 21, 2022,

- copy of the certificates issued on May 11, 2022, confirming the absence of any active transfers to the new account and also the charge from ***ENTIDAD.1 that was debited from the new account (ending in ***CUENTA.3).

Furthermore, it provides extensive documentation regarding the request for documents,

defective files received, failure to send through the indicated channel, a notarial request, unsigned documents received, as well as procedures related to the cancellation of the mortgage deed.

SECOND: In accordance with Article 65.4 of Organic Law 3/2018, of December 5, on the Protection of Personal Data and Guarantee of Digital Rights (hereinafter LOPDGDD), this complaint was forwarded to BBVA so that it could analyze it and inform this Agency within one month of the actions taken to comply with the requirements established in the data protection regulations.

The notification of the transfer of the claim, which was carried out in accordance with the rules established in Law 39/2015, of October 1, on the Common Administrative Procedure of Public Administrations (hereinafter, LPACAP), was made on June 11, 2024, as evidenced by the acknowledgment of receipt on file.

On July 17, 2024, a response to the transfer was received, which states:

- That they have sent a communication to the claimant, at the postal address on file, dated July 10, 2024, outlining the steps they have taken regarding the claim, thereby complying with the legal requirements of the GDPR concerning the processing of personal data and its free movement.

The complaint was intended to express their dissatisfaction, as they had a direct debit from ***ENTITY.1 set up on their account (***ACCOUNT.1), an account which they closed in February 2022, and which was subsequently debited without their authorization in March 2022 from account (***ACCOUNT.3).


- As previously explained to the claimant,
the managing office informed the Customer Service Department that the direct debit to the client's new account

was arranged verbally with the client, who, naturally, agreed to the direct debit in order to cover the payments that were previously charged to their old BBVA account, which they had closed.

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 3/35

- As evidence of the above, as the client was informed, other direct debits issued by various entities, such as ***ENTITY.2, were also redirected to the new
account (***ACCOUNT.3) opened by the claimant at BBVA, without any complaint or objection being raised by them.

This is perfectly logical given that the bank account from which the payments were previously charged Several bills in the name of the claimant had been cancelled,
for reasons beyond BBVA's control, and a new account was immediately opened with the
Bank in order, we understand, among other things, to cover the bills that
the previous banks were charging.

- That, in accordance with the provisions of Royal Decree-Law 19/2018 on payment services,
since more than 13 months have passed since the bill from ***BANK.1 was charged
to the claimant's account without the claimant having expressed any objection to
the aforementioned bill, no action should be taken regarding it, given that

the maximum period established by law for doing so has expired.

BBVA also provides the communication it sent to the claimant, with the following content:

(...)

“We have received the letter you sent us dated June 11, 2024. (...)

The purpose of your claim is to inform us of your Disagreement because
you had a direct debit from ***ENTITY.1 on account (***ACCOUNT.1),

an account you closed in February 2022, and without your authorization, the payment was debited in

March 2022 from account (***ACCOUNT.3).

Because at BBVA our goal is transparency with our clients,

after carefully reviewing the facts you describe and the

documentation gathered in this regard, we want our response to your request
to be as accurate as possible, also indicating:

(…)

II. The maximum period for the return of a payment receipt is regulated in Royal Decree-Law 19/2018 on payment services, which establishes:

-If it was not authorized (Art. 43): The payment service user will obtain rectification from the payment service provider of an unauthorized or incorrectly executed payment transaction only if the payment service user notifies them without undue delay, as soon as they become aware of any such transaction that is the subject of a claim, including those covered by Article 60, and, in any case, within a maximum period of thirteen months from the date of the debit.

III. On March 21, 2022, a payment receipt was issued to your account (***ACCOUNT.3) by ***ENTITY.1 for the amount of (…). Given that, to date, you have not expressed any disagreement with the aforementioned receipt, it is not necessary to take any action regarding it,

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 4/35

since the maximum period established by law for doing so has expired.

IV. Similarly, it has been verified that other receipts from

***ENTITY.2, were also redomiciled to the new account

(***ACCOUNT.3) opened by you at BBVA without any claim or disagreement being made regarding them. Therefore, we understand that you consented to said redomiciling.

(…)

BBVA goes on to state that the maximum period for the return of a payment
is regulated by Royal Decree-Law 19/2018 on payment services, which, according to BBVA, establishes:

“In the case of an unauthorized payment, Article 43 of said Royal Decree-Law

establishes that the payment service user will obtain rectification from the payment service provider of an unauthorized or incorrectly executed transaction only if the payment service user reports it without undue delay as soon as they become aware of any such transaction that is the subject of a claim, including those covered by Article 60, and, in any case, within a maximum period of thirteen months from the date of the debit.”

BBVA states that “Since the aforementioned receipt was issued on March 21, 2022, and since no objection had been previously raised, no action can be taken regarding this information, as the maximum period established by law for such action has expired.”

Furthermore, BBVA indicates that other receipts were re-debited to the new account without any claims or objections being raised. Therefore, BBVA states that the customer consented to this re-debiting.

THIRD: On July 17, 2024, in accordance with Article 65 of the

LOPDGDD (Organic Law on the Protection of Personal Data and Guarantee of Digital Rights), the complaint was admitted for processing.


FOURTH: According to the “2023 Annual Report,” published at

https://accionistaseinversores.bbva.com/wp-content/uploads/2024/03/Informe-Anual-
BBVA-2023_esp.pdf, BBVA's profit in 2023 amounted to €8,019 million, and it had more than 71 million active customers, as stated

in the official record included in the file, dated February 18, 2025.

FIFTH: On February 20, 2025, the Presidency of the Spanish Data Protection Agency agreed to initiate sanction proceedings against the respondent,
in accordance with the provisions of Articles 63 and 64 of Law 39/2015, of October 1,

on the Common Administrative Procedure of Public Administrations (hereinafter, LPACAP), for the alleged infringement of Article 6 of the GDPR, as defined in Article 83.5.a) of the GDPR.

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 5/35

SIXTH: On February 27, 2025, BBVA submitted two documents requesting an extension of the deadline for submitting arguments and a copy of the file. This request was granted on March 6, 2025, with the investigating officer providing the file and extending the deadline by up to a maximum of 5 days, in accordance with Article 32.1 of the LPACAP.

BBVA was notified of this decision on March 10, 2025, as evidenced by the acknowledgment of receipt included in the file.

SEVENTH: Having been notified of the aforementioned initiation agreement in accordance with the rules established in Law 39/2015, of October 1, on the Common Administrative Procedure of Public Administrations (hereinafter, LPACAP), the respondent submitted a statement of allegations on March 20, 2025, in which, in summary, it stated that:

-Preliminary allegation. Legal framework and operation of SEPA direct debits.

BBVA considers that, in order for this Agency to understand that its actions in the events that have given rise to these sanctioning proceedings are in accordance with the GDPR, it is necessary to explain the meaning of SEPA direct debits.

SEPA Direct Debits (Single Euro Payments Area) are a payment instrument regulated by Regulation (EU) No 260/2012, which establishes the technical and commercial requirements for euro transfers and direct debits within the European Economic Area and other participating countries.

This instrument allows for the execution of direct debit mandates, whereby a creditor, based on a direct debit mandate previously granted by the debtor, can order the collection of a specific amount from the debtor's account through their financial institution.

The elements of SEPA Direct Debits include:

a) a legal relationship between the creditor and the debtor, arising from a valid contract or legal act that justifies the collection. Thus, BBVA explains that, in the case of this sanctioning procedure, the legal relationship exists between ENTITY.1 and the claimant, and is formalized through the SEPA mandate, which remains valid until it is expressly revoked or expires if the creditor does not make any payments under it for a period of 36 months.

In this regard, the SEPA regulations, when addressing the validity period of a SEPA mandate, state: “The debtor’s authorization or consent contained in a mandate is valid until expressly revoked by the debtor or the creditor.”

Revocation is regulated in Article 52.3 of Royal Decree-Law 19/2018, on payment services and other urgent measures in financial matters (hereinafter, the “RDLSP”), and may be carried out “no later than the end of the business day preceding the agreed date

for the debiting of funds from the originator’s account.”

b) The SEPA mandate is the act by which the debtor expressly authorizes the creditor to request the collection of direct debits from the bank account designated by the debtor.

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 6/35

This authorizes the financial institution to proceed with the payment of said direct debit according to the instructions received.

The custody and safekeeping of this mandate corresponds to the creditor, in this case,
***ENTITY.1, and it must contain the following essential elements:

- identification of the creditor, including the SEPA identification number
- identification of the debtor, with their personal data and IBAN number
- unique reference of the mandate, which (…***ACCOUNT.1) allows for its tracking and control

- conditions of the direct debit, whether one-time or recurring
- signature of the debtor, confirming their express consent.

In this case, the debit in question is a consumer-business direct debit, or SEPA Core direct debit, where there is a mandate signed between the creditor and the debtor. This mandate is used by the creditor as the legal basis to initiate the direct debit collections from the debtor. Once the creditor has this mandate, they must send it to the financial institution designated by the debtor, which will be responsible for processing and executing it until the agreed due date.

BBVA indicates that, to avoid being left unprotected against unauthorized charges, the debtor also has the option of requesting a refund within the following timeframes:

- 8 weeks without needing to justify that the debit was authorized.

- 13 months in cases of unauthorized or fraudulent debits.

First allegation: regarding the facts of this case.

BBVA indicates that, according to the claimant, on February 1, 2022,
it detected that its mail was being stolen from the mailbox, which is why,

it filed a police report.

Consequently, since BBVA mail arrived by post,
it requested the closure of two accounts it held with the bank and proceeded to
open a new one.

The claimant stated that it instructed ***ENTITY.1 to ensure that the
direct debit was not charged to the BBVA account but to another one.

On April 1, 2022, the claimant noticed that the payment had not been processed
and upon contacting the insurance company, was informed that the payment had been

charged on March 21, 2022, to a BBVA account.

The payment was set up as a direct debit from one of the accounts the claimant held with BBVA, but the payment was processed from the new account opened by the claimant on February 14, 2022.

BBVA understands that this Agency has considered it proven that the claimant had expressly revoked the authorization granted to ***ENTITY.1 regarding the collection of the direct debit through the BBVA account, even though the claimant has not provided any evidence to support this assertion.

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 7/35

This Agency has therefore concluded that BBVA processed a direct debit from the claimant's account without their express consent.

BBVA understands that this circumstance is what led this Agency to conclude
that the mandate was expressly revoked, and that this constitutes the basis of the
proposed penalty. However, it maintains that this circumstance has not been proven at any time by the claimant, who bears the burden of proof, as they are the party making the assertion.

Furthermore, BBVA has not proven that it requested a change in the payment method for the aforementioned invoice from ***ENTITY.1.

BBVA states that, after analyzing the obligations of the parties

involved in the legal relationship arising from a SEPA mandate, it is clear that
managing the modification of the bank account for the direct debit payment was the responsibility of the creditor (***ENTITY.1).

BBVA further states that the SEPA mandate remained fully valid for BBVA, as it had no record of an express revocation, and wishes to reiterate that the only circumstance that terminates the mandate is express revocation, not the account closure.

Therefore, BBVA believes that the initial agreement adopted lacks justification and motivation, as it considers that its actions were based on a current and valid mandate granted by the claimant to ***ENTITY.1.

Furthermore, BBVA considers that the direct debit was charged to the new account opened in accordance with Article 6, paragraphs b) and f) of the GDPR, insofar as:

i) the charge to the claimant's new account was necessary for the performance of the contract to which the claimant is a party, as it was a SEPA direct debit formalized through the SEPA mandate signed between ***ENTITY.1 and the claimant.

ii) The charge to the new bank account is necessary to satisfy the legitimate interests of the data controller or a third party, in this case, BBVA and

***ENTITY.1. BBVA understands that this processing is essential for the proper execution of the SEPA Direct Debit Agreement, formalized through the SEPA mandate signed between ***ENTITY.1 and the claimant.

BBVA further states that this data processing aims to guarantee compliance with contractual obligations and the proper management of payments, which constitutes a legitimate interest for BBVA, ***ENTITY.1, and the claimant by preventing service interruptions or potential issues in the management of their contract that could have had negative consequences.

Furthermore, BBVA considers that it is not evident that the complainant's interests, rights, or fundamental freedoms prevail over said legitimate interest, since the processing was carried out under a previously signed and unrevoked contract.

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 8/35

It adds that the complainant did not return the receipt, which would demonstrate that it had no intention of canceling the contract signed with ***ENTITY.1. It understands that if it had not processed the payment in the new account, it could have suffered damages, since the lack of payment could have led to the cancellation of its policy.

Second allegation: regarding the alleged violation of Article 6 of the GDPR by BBVA.

BBVA states that the agreement to initiate these disciplinary proceedings is based on the premise that BBVA allegedly "issued a direct debit to a new account belonging to the claimant, when there was no transfer from the closed account to any other account the claimant might have held, and without express consent," thus concluding that there has been an unlawful processing of the claimant's personal data.

BBVA states that the contract was signed between ***ENTITY.1 and the claimant, without BBVA's involvement. Under the contract, the claimant entered into a SEPA mandate with ***ENTITY.1, designating a BBVA account for direct debit payments. Since there is no record of express revocation of said mandate, BBVA states in its written submission that it "had express consent to execute the mandate and debit a BBVA account as agreed between the parties."

BBVA insists that “the SEPA mandate can only be terminated through

its express revocation or by expiration in the event of inactivity for 36 months.”

Since neither of these circumstances had occurred, “the SEPA mandate
remained fully in force at the time ***ENTITY.1 issued the charge for the claimant's home insurance premium to the BBVA account.”

Therefore, it considers that the charge made to the new bank account would be fully justified from a legal standpoint under Articles 6.1 b) and f) of the GDPR, which establish the lawfulness of personal data in certain circumstances:

i) legitimacy of processing based on the performance of a contract (Art. 6.1.b GDPR)

According to the aforementioned article, data processing is lawful when it is necessary for the performance of a contract to which the data subject is a party or for taking steps at the request of the data subject prior to entering into a contract.

And BBVA understands that, in this case:

-the claimant and ***ENTITY.1 are bound by a contract from which
payment obligations arise.

-for the execution of said contract, the claimant granted a SEPA mandate in favor of ***ENTITY.1, authorizing the direct debit of the payments from a BBVA account.

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 9/35

-the SEPA mandate was not revoked, and therefore remained in effect at the time ***ENTITY.1 issued the payment.

-the charge to the claimant's new account was made in compliance with the
conditions agreed upon in the SEPA mandate.

-There is no record that the claimant informed ***ENTITY.1 of a change in the payment method, and in the absence of express notification from the claimant, ***ENTITY.1 acted in accordance with the SEPA mandate and requested BBVA to execute the payment order.

Therefore, the processing of personal data associated with this charge was not only legitimate but also necessary for the fulfillment of the contractual obligations assumed by the parties.

ii) Legitimateness of the processing based on the legitimate interest of the controller (Article 6.1.f) GDPR)

BBVA states that Article 6.1.f) of the GDPR establishes that data processing is lawful when necessary for the purposes of the legitimate interests of the controller or of a third party, unless such interests are overridden by the fundamental rights and freedoms of the data subject.

It adds that, in this case, the processing of the claimant's personal data, consisting of the charge to their new bank account, is based on a legitimate interest of ***ENTITY.1, and even of BBVA itself, to ensure that the direct debit payments were processed correctly, avoiding breaches or delays that could affect the contractual relationship.

Furthermore, BBVA states that it prevented potential harm to the claimant, since the charge to the new account prevented them from being affected by returned payment fees and loss of insurance coverage.

Consequently, it considers that the charge to the new account was proportionate and appropriate to the purposes pursued by ***ENTITY.1, and where applicable, by BBVA, without any indication that the claimant's interests or rights were violated. BBVA adds that the actions of the claimant suggest that they neither revoked the SEPA mandate nor returned the payment, indicating that they had no intention of canceling it, and there is no record that ***ENTITY.1 was notified of a change in the payment method.

BBVA insists that its actions are justified under Article 6.1.b) and f) of the GDPR, and adds that if a customer wishes to change the account from which direct debits are charged, they must notify their creditor, who will update the information and include the new account number in the next billing statement.

BBVA states that, since the debtor neither revoked the SEPA mandate nor notified their creditor of a change of account, ***ENTITY.1 proceeded to collect the direct debit from the customer's BBVA account, as had been done previously. It adds that the
claimant also did not request a correction of the charge made to the new

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 10/35

account, so BBVA understands that the debit order was still fully valid
at the time the payment was collected, and that BBVA, as a payment service provider
under current regulations, was obligated to process it normally, debiting the new account, in order to guarantee
continuity of payment and avoid potential contractual issues.


Therefore, it understands that BBVA did not violate data protection regulations, as its actions complied with the principles of lawfulness, necessity, and proportionality established in the GDPR, and it was demonstrated that the processing of the claimant's data was carried out lawfully, in accordance with the provisions of Article 6.1, sections b) and f).

Third allegation. Violation of the principle of presumption of innocence.

BBVA states that this Agency is violating the principle of presumption of innocence applicable to administrative sanctions law, as established in case law, and cites the Supreme Court rulings of September 29, November 4 and 10, 1980, as well as Constitutional Court ruling 187/1981, which indicate that the principles underlying criminal law are applicable, with certain nuances, to administrative sanctions law, given that both are manifestations of the State's punitive system.

BBVA understands that, for this same reason, the principle of culpability,

or subjective responsibility, applies, since it is considered essential for the existence
of the administrative offense, and therefore requires the commission of intentional
or negligent personal acts by the sanctioned party, according to Constitutional Court Ruling 76/1990, of April 26, and Supreme Court Rulings of February 22, 1992, and June 5, 1989.

It adds that objective liability is not applicable in administrative

sanctioning law, as stated in the Supreme Court Ruling of July 9, 1994, which cites that:

“the sanctioning power of the Administration has the same nature as the
criminal power, and therefore, the structural guidelines of the administrative offense also tend, as in criminal offenses, to achieve the

individualization of responsibility, prohibiting any attempt to construct an
objective or liability based on simple relationship with a thing; therefore, in the field of administrative liability, it is not enough for the conduct to be unlawful and typical, but it is also necessary that it be culpable,
that is, the consequence of an action or omission attributable to its author due to malice or
imprudence, negligence, or inexcusable ignorance.”

BBVA adds that jurisprudence has established that the State's power to impose sanctions has as its basic structural principle the principle of culpability, which makes it
incompatible with a system of strict liability, without fault, which is
expressly determined in Article 130 of the LRJPAC (Law on the Legal Regime of Public Administrations and Common Administrative Procedure), which establishes that only

natural and legal persons who are responsible for acts constituting an administrative offense, even on the grounds of
simple non-compliance, may be sanctioned.


C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 11/35

Thus, both the Supreme Court and the Constitutional Court in its Judgment
76/1990 declare that the principle of culpability must also govern in the administrative sphere, since the sanction of an administrative infraction is one of the manifestations of the State's power to punish. Furthermore, BBVA adds that a system of strict liability based on an objective imputation of the act, without any subjective element, is inadmissible. For administrative liability to exist, the infraction must have been committed intentionally, or at least negligently or recklessly.

BBVA states that in this case there is no evidence that ***ENTITY.1 notified BBVA of the alleged express revocation of the SEPA mandate granted by the claimant. In fact, it states that ***ENTITY.1 ordered a direct debit from the claimant's account, which would confirm the continuity of the mandate and the validity of the authorization to make the charge. Therefore, BBVA cannot be held liable for any fraudulent or negligent conduct, as its actions were based on the available information and compliance with its obligations as a payment service provider.


EIGHTH: On October 3, 2025, a proposed resolution was issued,
recommending that BANCO BILBAO VIZCAYA ARGENTARIA, S.A., with

Tax ID A48265169, be sanctioned for an infringement of Article 6 of the GDPR, classified under Article
83.5.a) of the GDPR, with a fine of €100,000 (one hundred thousand euros).

NINTH: On October 17, 2025, BBVA paid the fine
in the amount of €80,000, taking advantage of the 20% reduction for voluntary payment

of the fine established in the proposed resolution, under the terms
provided for in Article 85.2 of the LPACAP. In the letter to the Spanish Data Protection Agency (AEPD) in which it reported this fact and provided proof of payment, BBVA stated its denial of responsibility.

TENTH: The proposed resolution was notified in accordance with the regulations established in Law 39/2015, of October 1, on the Common Administrative Procedure of Public Administrations (hereinafter, LPACAP). On October 22, 2025, BBVA submitted a document outlining its arguments, which, in summary, stated the following:

First. The SEPA mandate was not revoked. The claimant consented to the direct debit of the receipt.

BBVA reaffirms the arguments already presented in its submissions to the Initial Agreement, regarding SEPA Direct Debits and their operation, and insists that the mandate granted by the claimant to ***ENTITY.1 was not expressly revoked, and therefore remained fully valid and effective.

Second. Regarding the alleged violation of Article 6 of the GDPR by BBVA.

BBVA maintains that the action of charging the claimant's home insurance premium to the account ending in ****ACCOUNT.3, which had been closed, would be covered under Article 6.1 b) and 6.1 f) of the GDPR.

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 12/35

Furthermore, it states that the action respected the principles of purpose limitation and data minimization (Articles 5.1.b and 5.1.c of the GDPR) and fell within the framework of proactive responsibility.

On the other hand, BBVA indicates that its action was protected by the contractual good faith established in Article 1258 of the Civil Code, according to which contracts are binding not only on what is expressly agreed upon, but also on all the consequences that, according to their nature, derive from good faith, custom, and the law.

Third. Voluntary payment of the penalty imposed in the Proposed Resolution.

Even though it refers to it as an allegation, BBVA reports that it is taking advantage of the voluntary payment option
provided for in Article 85.2 of the LPACAP (Law on Administrative Procedure of Public Administrations), without such voluntary payment implying

an admission of liability.

TENTH: On October 17, 2025, BBVA proceeded to pay the penalty
in the amount of 80,000 euros, taking advantage of the 20% reduction for voluntary payment of the fine established in the proposed resolution, under the terms
provided for in Article 85.2 of the LPACAP. In the letter to the Spanish Data Protection Agency (AEPD) in which

it reported this fact and provided proof of payment, it stated that it does not admit
its liability.

From the actions taken in this proceeding and the documentation contained in the file, the following facts have been established:

PROVEN FACTS

FIRST: The claimant held two bank accounts with BBVA (ending in ***ACCOUNT.1 and ***ACCOUNT.2) in which an insurance policy with ***ENTITY.1 was debited.

SECOND: Both bank accounts were closed on February 14, 2022, and the claimant opened a new bank account with BBVA on the same date (ending in ***ACCOUNT.3).

THIRD: On March 21, 2022, a payment was debited from ***ENTITY.1 to one of the BBVA accounts that the claimant had closed (…***ACCOUNT.1).

FOURTH: BBVA transferred the payment from ***ENTITY.1 to the new account that the claimant had opened with the bank (ending in ***CUENT.3).

FIFTH: BBVA issued a certificate on May 11, 2022, expressly stating that account number (…***CUENT.1) had no active transfers to any other account as of its closure.

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 13/35

LEGAL BASIS

I

Jurisdiction

In accordance with the powers conferred upon each supervisory authority by Article 58.2 of Regulation (EU) 2016/679 (General Data Protection Regulation, hereinafter GDPR) and as established in Articles 47, 48.1, 64.2 and 68.1 of Organic Law 3/2018, of December 5, on the Protection of Personal Data and Guarantee of Digital Rights (hereinafter LOPDGDD), the Presidency of the Spanish Data Protection Agency is competent to initiate and resolve this procedure.


II

Procedure

Likewise, Article 63.2 of the LOPDGDD (Organic Law on the Protection of Personal Data and Guarantee of Digital Rights) establishes that: “The procedures
processed by the Spanish Data Protection Agency shall be governed by the provisions of
Regulation (EU) 2016/679, by this Organic Law, by the implementing regulations issued thereunder, and, insofar as they do not contradict them,

subsidiarily, by the general rules on administrative procedures.”

The procedure shall have a maximum duration of twelve months from the date
of the initiation agreement. After this period, the procedure shall expire and,
consequently, the proceedings shall be archived, in accordance with the provisions of

Article 64 of the LOPDGDD.


III
Response to the allegations against the initial agreement

The allegations presented by BBVA can be grouped as follows:

1. The SEPA mandate explained in the previous allegation was not revoked, and therefore the charge was correct, since the claimant had consented to it.

First, BBVA states that this Agency has considered it proven that the claimant had expressly revoked the mandate granted to ***ENTITY.1 regarding the collection of the debit through the BBVA account, when in fact the claimant had not provided any evidence to support this assertion. Therefore, BBVA believes that this Agency considered that BBVA issued a receipt without the claimant's express consent.

At this point, it is important to clarify that the initial agreement does not include proven facts, but rather only the circumstances that lead to the conclusion that a GDPR infringement may have occurred, as has happened in this case.

The proven facts are first included in the proposed resolution and are generally maintained in the resolution of the sanctioning procedure.

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 14/35

In this sanctioning procedure, as already stated in the proven facts, it is taken into account that the complainant had closed two current accounts held at BBVA and had opened a new account, to which the direct debit had not been set up.

The bank subsequently charged this new account.

First, it must be emphasized that BBVA's claims are based on the fact that the so-called "SEPA mandate" was not revoked, which would legitimize the processing of personal data carried out, that is, the transfer of the debit to a new account.

In this regard, it is worth noting, as a preliminary matter, that the so-called SEPA mandate, as described by BBVA in its statement of defense, is "the act by which the debtor expressly authorizes the creditor to request the collection of debits from the account of the bank designated by the debtor." It is, in short, a direct debit authorization.


Regulation (EU) No 260/2012 of the European Parliament and of the Council of 14 March 2012, laying down technical and business requirements for euro transfers and direct debits and amending Regulation (EC) No 924/2009 (Text with EEA relevance), defines in Article 2 the concepts of

“direct debit”, “payer” and “order” as follows:

“2) ‘direct debit’ means a national or cross-border payment service intended to debit a payment account of a payer, where the payment transaction is initiated by the payee on the basis of the payer’s consent;

3) ‘payer’ means a natural or legal person who holds a payment account and authorizes a payment order from that account or, if the payer does not hold a payment account, a natural or legal person who issues a payment order to a beneficiary's payment account;

21) "order": the expression of consent and authorization given by the payer to the beneficiary and (directly or indirectly through the beneficiary) to the payer's payment service provider so that the beneficiary can initiate the collection process, which will involve debiting the payment account specified by the payer, and so that the payer's payment service provider can carry out those instructions;

Thus, the SEPA mandate is based on the payer's consent to the debit of their current account, which they have expressly designated, since, in accordance with the same regulation, all direct debits require specific information, including the IBAN number of the payer's payment account to be debited, as well as the "unique order reference."

Therefore, a SEPA mandate is linked to a specific current account held by the account holder.

That is, the debtor or originator authorizes or consents to the debit from a current account
identified unambiguously through an IBAN number.

According to the 2025 SEPA Credit Transfer rulebook version 1.0, modifications to the existing mandate are possible.

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 15/35

One of the foreseen scenarios is Change 1 of attribute AT-07 (change of the debtor's debit account within the same institution), although such modifications are the responsibility of either the debtor or the creditor.


C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 15/35 In this case, even if BBVA's assertion that the
SEPA mandate had not been revoked were true, it must be specified that it would be valid for
a specific current account belonging to the account holder, identified by its IBAN number, not for
any account belonging to the account holder. Consequently, the debit to a current account other than the one specified in the aforementioned mandate would have had to be authorized by the

claimant.

However, the aforementioned charge to the account ending in ***CUENTA.3 was made
without the claimant's consent, as evidenced by the
claim itself and by BBVA's response to the transfer of the claim, in which

BBVA first states that it had "verbal" consent and,
later asserts that it was tacit consent insofar as
the claimant had not expressed disagreement and had accepted other
drafts, thus implying agreement with the new direct debit arrangement.

Furthermore, it should be noted that among the documentation provided by the claimant is a document from BBVA itself certifying that the account

number (…) held by the claimant, as of its closure date of February 14, 2022, had no active transfers to any other account.

Regarding the alleged tacit consent to which BBVA refers, which would allow it to process the claimant's personal data under the terms

previously indicated, it must be emphasized that, in matters of data protection,
all consent must be, as required by Article 4.11 of the GDPR, freely given,
specific, informed, and unambiguous:

“Data subject’s consent” is “any freely given,

specific, informed, and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her.”

Consent is understood as a clear affirmative act that reflects a
free, specific, informed, and unambiguous indication of the data subject’s wishes

to accept the processing of personal data relating to him or her, given with
sufficient safeguards to demonstrate that the data subject is aware of the fact that
he or she is giving consent and to what extent he or she is doing so.

Likewise, it must be given for all processing activities carried out for the same purpose or purposes, so that when processing has several purposes, consent must be given for each of them specifically and unambiguously. In this regard, the lawfulness of processing requires that the data subject be informed about the purposes for which the data are intended (informed consent).

Furthermore, consent must be freely given.

Without these conditions, the consent given by the data subject would not establish control over their personal data and its use.

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 16/35

The European Data Protection Board, in the document “Guidelines 05/2020 on consent under Regulation 2016/679,” which updates the

guidelines on consent adopted by the Article 29 Working Party
on 28/11/2017, revised and approved on 10/04/2018, indicates that:

“55. Article 6(1)(a) confirms that the data subject’s consent
for the processing of their data must be given “for one or more specific purposes” and
that a data subject may choose with regard to each of those purposes. The requirement

that consent must be “specific” is intended to ensure a level of
control and transparency for the data subject. This requirement has not been amended by the
GDPR and remains closely linked to the requirement of “Informed” consent. At the same time, it must be interpreted in line with the requirement of “dissociation” to obtain “freely given” consent. In short, to comply with the “specific” nature of the data, the data controller must apply:

i, specifying the purpose as a safeguard against misuse,

ii, dissociating the data in consent requests, and

iii, clearly separating information related to obtaining consent for data processing activities from information relating to other matters.

These guidelines go on to state:

“56. Ad. i): In accordance with Article 5(1)(b) of the GDPR, obtaining valid consent is always preceded by the determination of a specific, explicit, and legitimate purpose for the intended processing activity. The need for specific consent, in combination with the notion of purpose limitation

set out in Article 5(1)(b), serves as a safeguard against the gradual broadening or blurring of the purposes for which data is processed once a data subject has given consent to the initial collection of data. This phenomenon, also known as diversion of use, poses a risk to data subjects as it can lead to unforeseen use of personal data by the controller or third parties and a loss of control by the data subject.

This means, in accordance with Guidelines 5/2020 on consent within the meaning of the Regulation (EU) 2016/679, and in accordance with the principle of proactive responsibility
enshrined in Article 5.2 of the GDPR and developed in Article 24 of the

GDPR, that consent must be demonstrable, that is, verifiable by the
controller as required by Article 7 of the GDPR.

Thus, BBVA initially stated that it had the

tacit consent of the claimant to debit the new account it had
opened, based on the fact that the SEPA mandate had not been expressly revoked.

However, as noted, the GDPR requires that consent be
demonstrable and verifiable, and in this case, these

two premises have not been met, given that the SEPA mandate between ***ENTITY.1 and the The claimant's account
was linked to a bank account that the claimant had closed, and
for which there were no active transfers to another account. Therefore, BBVA did not

have the claimant's consent to make this charge to the
new bank account that had been opened with BBVA.

For all the above reasons, the claim presented by BBVA must be rejected.

2. The direct debit was charged to the new account based on the provisions of

Article 6.1, paragraphs b) and f).

BBVA stated that it had the claimant's consent to
charge the direct debit to the new bank account opened with BBVA,
based on the assumption that the SEPA mandate had not been revoked. However,

BBVA later stated that the charge made to the new bank account was
fully justified from a legal standpoint under Articles 6.1 b) and f) of the GDPR, which establish the lawfulness of Personal data in certain circumstances.

In relation to this issue, it is important to consider the “Guidelines 05/2020 on consent under Regulation 2016/679” of the European Data Protection Board, which state:

“Article 6 establishes the conditions for the lawful processing of personal data and describes six legal bases that the controller may invoke. The application of one of these six legal bases must be established before the processing activity begins and in relation to a specific purpose.

It is important to note at this point that if a controller chooses to rely on consent for any part of the processing, they must be prepared to respect that choice and stop that part of the processing if a person withdraws their consent. Sending the message that the data will be processed on the basis of consent, while in reality another legal basis is being used, would be truly disloyal to the data subjects.

In other words, the controller cannot shift from consent to other legal bases.

For example, they are not permitted to retrospectively use the basis of legitimate interest to justify processing when they encounter problems with the validity of consent. Due to the requirement to disclose the legal basis used by the controller at the time of collecting personal data, controllers must decide which legal basis is applicable before collecting the data.

Ultimately, the processing of personal data requires a single legal basis. The choice of the most appropriate basis for processing, if several exist, rests with the controller, as does the responsibility to demonstrate that the processing is carried out on a legitimate basis.

Therefore, BBVA cannot claim to have the complainant's consent and then state that it is authorized by other legal grounds.

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 18/35

Despite the above, BBVA maintains that the processing was necessary for the performance of a contract.

In this regard, Article 6.1.b) of the GDPR establishes that processing is lawful if it is necessary for the performance of a contract to which the data subject is a party or in order to take steps at the request of the data subject prior to entering into a contract.

BBVA has stated that, regarding the fact that the processing is necessary for the performance of a contract between the complainant and a third party, namely, ***ENTITY.1. Furthermore, it states that the processing was necessary because:

-the claimant and ***ENTITY.1 are bound by a contract from which payment obligations arise.

-for the execution of said contract, the claimant granted a SEPA mandate to ***ENTITY.1, authorizing the direct debit of the receipts from a BBVA account.

-the SEPA mandate was not revoked, and therefore remained in effect at the time ***ENTITY.1 issued the receipt.

-the charge to the claimant's new account was made in compliance with the conditions agreed upon in the SEPA mandate.

-there is no record that the claimant informed ***ENTITY.1 of a change in the payment method, and in the absence of express notification from the claimant, ***ENTITY.1 acted in accordance with the SEPA mandate and requested BBVA to execute the payment order.

Therefore, the processing of personal data associated with this charge was not only legitimate, but necessary for the fulfillment of the contractual obligations assumed by the parties.”

However, as indicated, BBVA was not a party to the contract, insofar as

the parties are the claimant and ***ENTITY.1. Its participation arises from
the alleged existence of a debit order authorized by the claimant,
which, as already noted in response to the previous allegation, was
specifically issued for another current account. Therefore, the application of this
legal basis does not appear to be applicable in this case.

In turn, BBVA states that there is a legitimate interest of ***ENTITY.1 and even
BBVA itself in the processing, in order to guarantee that the direct debit payments are processed correctly, and indicates that this prevented potential
damage to the claimant.

In this regard, Article 6.1.f of the GDPR establishes that “Processing shall be lawful only if (…) processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.”

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 19/35

In relation to this issue, the CJEU judgment C-252/21, when referring to legitimate interest, determined that it implies three cumulative conditions:

“(a) Informing the data subject of the legitimate interest pursued by the processing.

(b) The processing is carried out to the extent that it is strictly

necessary for that legitimate interest.

(c) It follows from a balancing of the conflicting interests,
taking into account all relevant circumstances, that the interests or
fundamental rights and freedoms of those data subjects do not override

the legitimate interest of the controller or of a third party.”

Thus, this duty to inform about the processing of personal data
requires that, in addition to informing, the existence of the legitimate interest as the
legal basis for the processing be specified. Furthermore, the specific legitimate interests
must be specified, so that data subjects can object to such

processing at any time.

Furthermore, regarding balancing, Recital 47 of the GDPR states:
“The legitimate interests of a controller, including those of a controller to whom personal data may be disclosed, or of a third party, may constitute a legal basis for processing, provided that the interests or fundamental rights and freedoms of the data subject do not override those interests, taking into account the reasonable expectations of data subjects based on their relationship with the controller. Such a legitimate interest could exist, for example, where there is a relevant and appropriate relationship between the data subject and the controller, such as in situations where the data subject is a customer or is employed by the controller. In any event, the existence of a legitimate interest would require careful assessment, including whether a data subject could reasonably foresee, at the time and in the context of the collection of personal data, that processing for such a purpose might take place. In particular, the interests and fundamental rights of the data subject could override the interests of the controller when processing is carried out.” personal data in

circumstances in which the data subject does not reasonably expect further processing. (...)

In the present case, there is no record that the claimant was informed of the aforementioned legal basis for processing, nor that they were given the opportunity to exercise their right to object.

Furthermore, it should be noted that, in accordance with the principle of proactive responsibility set out in Article 5.2 of the GDPR and further developed in Article 24 of the GDPR, the balancing of interests must be duly documented, which is not the case here.

Based on the aforementioned regulations, it does not appear that we are dealing with a case of processing based on legitimate interest.

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 20/35

Therefore, this allegation cannot be considered.

Third Allegation. Violation of the principle of presumption of innocence. Violation

of the principle of culpability.

Regarding this matter, BBVA states that in the present case there is no evidence
that ***ENTITY.1 notified BBVA of the alleged express revocation of the
SEPA mandate granted by the claimant. In fact, it states that
***ENTITY.1 ordered a direct debit from the claimant's account, which

would confirm the continuity of the mandate and the validity of the authorization to
make the charge, and therefore BBVA cannot be attributed with malicious or negligent conduct, since
its actions were based on the available information and compliance with its
obligations as a payment service provider.

Although BBVA states that its conduct was neither malicious nor negligent, it overlooks
the fact that the debit was made to a bank account different from the one specified in the
SEPA mandate.

The principle of liability established in Article 28.1 of Law 40/2015, of October 1, on the Legal Regime of the Public Sector, stipulates that: "Only natural persons and legal entities, as well as, when a law recognizes their legal capacity, groups of affected parties, associations and entities without legal personality, and independent or autonomous assets, who are responsible for such acts due to intent or negligence, may be sanctioned for acts constituting administrative offenses."

To that effect, the Judgment of the Court of Justice of the European Union of 5 December 2023 in Case C-807/21 (Deutsche Wohnen) states:

“76. In this respect, it should be further clarified, as regards the question of whether an infringement has been committed intentionally or negligently and may therefore be sanctioned with an administrative fine under Article 83 of the GDPR, that a controller may be sanctioned for conduct falling within the scope of the GDPR when it could not have been unaware that its conduct was infringing, whether or not it was conscious that it was infringing the provisions of the GDPR (see, by analogy, the judgments of 18 June 2013, Schenker & Co. and Others, C-681/11, EU:C:2013:404, paragraph 1) 37 and cited case law; of 25 March

2021, Lundbeck v Commission, C 591/16 P, EU:C:2021:243, paragraph 156, and of 25 March

2021, Arrow Group and Arrow Generics v Commission, C 601/16 P, EU:C:2021:244,
paragraph 97).

The courts of our country have expressed themselves along the same lines.

Thus, the Supreme Court (Administrative Law Chamber, Section 5) in Judgment no. Judgment 179/2023, of February 15, 2023, establishes: Judgment (STS
354/2023)

(…) we must begin by recalling that culpability constitutes, in effect, a

requirement of administrative offenses, inherent in Article 25 of the
Constitution, which has undergone an elaborate doctrinal development within the field of
Criminal Law, to which Administrative Sanctioning Law is a subset. This requirement
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 21/35

means, in short, for the purposes of the debate raised, that the act that
is defined in the type of infraction can and must be attributable to the subject who is
sanctioned, the one considered guilty of it, that is, responsible, according to

the terminology of the Law on Common Administrative Procedure of Public Administrations. This attribution entails an intellectual element
according to which the typical action is not only carried out by the subject himself, but is done
consciously and willingly, that is, intentionally, or else through more
or less intense negligence, insofar as the diligence that would be required in the
execution of the act to avoid the harmful effect has been omitted.

In turn, the Judgment of the National Court, dated January 21, 2010, states:

“The appellant also maintains that there is no culpability whatsoever in her actions.

It is true that the principle of culpability precludes the admission of strict liability in administrative sanctioning law. It is also true that the absence of intent is secondary, since this type of infraction is normally committed through culpable or negligent conduct, which is sufficient to establish the subjective element of fault. XXX's actions are clearly negligent because… she must be aware of… the obligations imposed by the Data Protection Act on all those who handle personal data of third parties. XXX is obligated to guarantee the fundamental right to the protection of personal data of her clients and potential clients with the intensity required by the content of the right itself.”

Furthermore, it should be noted that the Supreme Court (Judgments of April 16 and 22, 1991) considers that the element of culpability implies "...that the action or omission, classified as an administratively sanctionable offense, must, in all cases, be attributable to its perpetrator, whether through intent, recklessness, negligence, or inexcusable ignorance." The same Court reasons that "it is not enough... for exoneration from conduct that is typically unlawful to invoke the absence of fault," but rather

that it is necessary "that the diligence required of the party alleging its non-existence was employed" (Supreme Court Judgment of January 23, 1998).

In addition, it is worth highlighting that the method of attributing liability to legal entities does not correspond to the forms of intentional or reckless culpability that are attributable to human conduct. Therefore, in the case of

offenses committed by legal entities, although the element
of culpability must be present, it is necessarily applied differently than it is
with respect to natural persons.

According to Constitutional Court Ruling 246/1991, "(...) this distinct construction of imputability of the

authorship of the infringement to the legal entity arises from the very nature of the legal fiction
to which these subjects respond. They lack the volitional element in the
strict sense, but not the capacity to infringe the rules to which they are subject.

Capacity to infringe and, therefore, direct blameworthiness derives from the

legal interest protected by the infringed rule and the need for said protection
to be truly effective, and from the risk that, consequently, the legal entity subject to compliance with said rule must assume" (in this sense, Supreme Court Ruling of November 24, 2011, Appeal No. 258/2009).

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 22/35

To the foregoing, it must be added, following the judgment of January 23, 1998,
partially transcribed in the Supreme Court judgments of October 9, 2009, Appeal No. 5285/2005, and of October 23, 2010, Appeal No. 1067/2006, that "although the culpability of the conduct must
also be subject to proof, it must be considered, in order to assume the
corresponding burden, that ordinarily the volitional and cognitive elements
necessary to assess it form part of the proven typical conduct, and that their
exclusion requires proof of the absence of such elements, or, in its
normative aspect, that the diligence required by the party alleging their

non-existence has been employed; it is not enough, in In short, the defense of lack of guilt is used to justify exoneration from conduct that is typically unlawful.

As has been noted, the alleged conduct was indeed negligent,

insofar as BBVA debited a receipt from the claimant's bank account without their consent, and without any other legal basis being established, as has already been analyzed in these disciplinary proceedings.

Furthermore, the claimant has a document confirming that there is no active

transfer to the claimant's new account, which demonstrates the absence of express consent.

Therefore, none of the circumstances in this case allow for the exclusion of culpability.

On the other hand, regarding the statements concerning the presumption of innocence, it must be borne in mind that for a finding of defenselessness to be established, it is not enough that a formal infraction has occurred; rather, a material lack of defense must have taken place.

In this regard, in the words of the Constitutional Court (STC 290/1993, legal basis 4), “For a situation to be considered constitutionally relevant, placing the interested party
without any possibility of alleging and defending their rights in the proceedings, a mere formal violation is not enough. It is necessary that this formal violation result in a material effect of defenselessness, an effective and real impairment of the

right to defense (STC 149/1998, legal basis 3), with the consequent
real and effective harm to the affected parties (SSTC 155/1988, legal basis 4, and 112/1989, legal basis 2).”

In short, for the prohibition against being left defenseless to be violated, it is necessary that

a situation of defenselessness actually exists, which has not occurred in this case,
since in the present instance it has been proven that BBVA proceeded to debit
a receipt from the claimant's account without express consent
to do so, and without any other legal basis.

Furthermore, BBVA was duly notified of the existence of the

disciplinary proceedings, with the initiation agreement having been formally served on February 24, 2025. BBVA also submitted arguments against the initiation agreement on March 20, 2025, which were duly addressed in the proposed resolution.

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 23/35

Therefore, none of the circumstances allow us to conclude that there has been a lack of due process, and this allegation must be rejected.

For all the above reasons, the dismissal of the sanctioning procedure, as requested by BBVA, is not warranted. A separate issue is that the investigating body considers that the following should be assessed and included in this proposal for the purpose of determining the amount of the fine to be imposed, within the parameters of the circumstances provided for in Article 83.2 a) of the GDPR: the existence of a single data subject, as well as the category of the personal data affected, in accordance with the provisions of Article 83.2 g) of the GDPR. This may lead to a modification of the amount initially planned.

IV

Response to the allegations against the proposed resolution of the sanctioning procedure

First. Regarding the non-revocation of the SEPA mandate. Regarding the consent issued by the claimant for the direct debit payment.

BBVA reiterates its arguments against the initial agreement, which were addressed in section 1 of Legal Basis III of this Resolution, to which we refer, and therefore rejects this argument.

Second. Regarding the alleged violation of Article 6 of the GDPR by BBVA.

BBVA reiterates its arguments against the initial agreement, which were already addressed in section 2 of Legal Basis III of this Resolution, to which we refer.

Furthermore, BBVA states that its actions were protected under Articles 5.1.b) and 5.1.c) of the GDPR, insofar as the purpose of the processing was solely to ensure the continuity of the already contracted service, namely the management of payments and collection of receipts, which was compatible with the original purpose.

It also adds that only the minimum data necessary to process the debit was processed (receipt identifiers and the customer's active account), without collecting new categories of data or introducing incompatible uses.

It adds that BBVA's actions would be protected by the principle of good faith in contracts,

as enshrined in Article 1258 of the Civil Code, which states that contracts are binding not only with respect to what is expressly agreed upon, but also with respect to all the consequences that, according to their nature, derive from good faith, custom, and the law. Therefore, its actions constitute a manifestation of good faith in the execution of banking services and in the intermediation of debt collection.

In relation to this matter, it should be noted that the object of the sanctioning procedure and what is imputed to BBVA is an infringement of Article 6 of the GDPR, not Articles 5.1 b) and 5.1 c) of the GDPR. Thus, Article 6 of the GDPR requires that all

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 24/35

processing of personal data, to be valid or lawful, must have a legal basis.

Articles 5.1 b) and 5.1 c) of the GDPR, which are not the subject of this
procedure, refer to the principles that all processing of personal data

must comply with. Consequently, it is important not to confuse the terms and to emphasize
that processing requires having one of the legal bases of Article 6 of the
GDPR and, once it has this basis, complying with all the principles set out in
Article 5 of the GDPR, and that, in any case, the infringement attributed to BBVA is the
violation of Article 6 of the GDPR.

In line with the above, and regarding the allegations that BBVA acted in good faith under the contractual obligation stipulated in Article 1258 of the Civil Code, we must refer to the response to the allegations against the initial agreement and reiterate that BBVA was not a party to the contract to which it refers. Thus, the parties to the contract were the claimant and ***ENTITY.1.

BBVA's involvement—due to whose actions a sanctioning procedure has been initiated because it is considered contrary to data protection regulations—arises insofar as the claimant held two bank accounts with BBVA in which their insurance policy with ***ENTITY.1 was debited. However, once these accounts were closed in February 2022, the claimant opened a new account to which BBVA, without the claimant's express authorization, charged the ***ENTITY.1 receipt. In other words, the claimant had specifically authorized a current account for the purpose of debiting an order, and BBVA, without the claimant's consent, charged a different account belonging to the same person.

Therefore, this claim must be rejected.

Third. Voluntary payment of the penalty imposed in the Proposed Resolution.

Regarding BBVA's statement that it is accepting the voluntary payment provision

stipulated in Article 85.2 of the LPACAP without acknowledging liability, it is noted that, in accordance with said article, a resolution should be issued terminating the proceedings.

V
Preliminary Issues

Article 4.1 of the GDPR defines “personal data” as: “any information relating to an identified or identifiable natural person (“data subject”); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.”

Article 4.2 of the GDPR defines "processing" as: "any operation or set of operations performed on personal data or sets of personal data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction."

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 25/35

Article 4.7 of the GDPR defines the "controller" as:
"the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of processing are determined by Union or Member State law, the controller or the specific criteria for its appointment may be laid down by Union or Member State law."

Article 4.8 of the GDPR defines the "processor" as the natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller.
... In this case, in accordance with Articles 4.1 and 4.2 of the GDPR,

the processing of personal data is established, since BBVA
carries out, among other processing activities, the collection and storage of personal data of
natural persons: name and surname, address, email address, and bank account,

among others.

BBVA carries out this activity in its capacity as data controller, given that

it is the entity that determines the purposes and means of such activity, pursuant to Article 4.7 of the
GDPR.

VI
Breach of Obligation. Lawfulness of Processing

Article 6 of the GDPR, which governs the lawfulness of processing, states the following:

"1. Processing shall be lawful only if at least one of the following conditions applies:

a) the data subject has given consent to the processing of his or her personal data for one or more specific purposes;

b) processing is necessary for the performance of a contract to which the data subject is a party or in order to take steps at the request of the data subject prior to entering into a contract;

c) processing is necessary for compliance with a legal obligation to which the controller is subject;

d) processing is necessary in order to protect the vital interests of the data subject or of another natural person;

e) processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;

f) processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights of the data subject." and fundamental freedoms of the

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 26/35

data subject that require the protection of personal data, in particular where the
data subject is a child.

The provisions of point (f) of the first paragraph shall not apply to processing
carried out by public authorities in the exercise of their functions.

2. Member States may maintain or introduce more specific provisions
in order to adapt the application of the rules of this Regulation with regard to
processing pursuant to points (c) and (e) of paragraph 1, by laying down more

specific processing requirements and other measures to ensure lawful and fair processing, including other specific situations of
processing as referred to in Chapter IX.

3. The basis for processing referred to in points (c) and (e) of paragraph 1 shall be

established by:

(a) Union law, or

(b) the law of the Member States applicable to the controller.

The purpose of the processing must be specified in that legal basis or, with regard to the processing referred to in point (e) of paragraph 1, it must be necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller. That legal basis may contain specific provisions to adapt the application of rules in this Regulation, including, among others: the general conditions governing the lawfulness of the processing by the controller; the types of data being processed; the data subjects; the entities to which personal data may be disclosed and the purposes of such disclosure; the purpose limitation; the periods for which the data will be stored; and the processing operations and procedures, including measures to ensure lawful and fair processing, such as those relating to other specific processing situations as referred to in Chapter IX. Union or Member State law must serve an objective of the public interest and will be proportionate to the legitimate aim pursued.

4. Where processing for a purpose other than that for which the personal data were collected is not based on the data subject's consent or on Union or Member State law which is a necessary and proportionate measure in a democratic society to safeguard the objectives referred to in Article 23(1), the controller, in order to determine whether processing for another purpose is compatible with the purpose for which the personal data were initially collected, shall take into account, inter alia:

(a) any relationship between the purposes for which the personal data were collected and the purposes of the further processing envisaged;

(b) the context in which the personal data were collected, in particular with regard to the relationship between the data subjects and the controller;

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 27/35

(c) the nature of the personal data, specifically when processing special categories of personal data, pursuant to Article 9, or personal data relating to criminal convictions and offenses, pursuant to Article 10;

(d) the likely consequences for data subjects of the envisaged further processing;

(e) the existence of appropriate safeguards, which may include encryption or pseudonymization.

In the present case, the claimant stated that, on February 14, 2022, it closed two bank accounts in its name at BBVA (ending in ***CUENTA.1 and ***CUENTA.2) and opened a new one with the same bank (ending in ***CUENTA.3).

On April 1, 2022, while reviewing his accounts, he noticed that the charge corresponding to the entity ***ENTITY.1, which he had debited from one of the accounts he had closed, and which a few weeks earlier he had debited from another entity (…), was missing.

The claimant states that they inquired with ***ENTITY.1 about the aforementioned receipt, and
entity 1 reported that the charge was made on March 21, 2022, to the

BBVA bank account ending in ***ACCOUNT.3.

The claimant contacted BBVA, and BBVA confirmed that the receipt
had been charged to the new account. They provided a bank statement as proof,
showing that the charge occurred on March 21, 2022.

The claimant also provided a certificate from BBVA confirming
that, according to the bank's records, account number (...)
held by the claimant, as of its closure date of February 14, 2022,
had no active transfers to other accounts.

For its part, BBVA, in response to the transfer document, stated that the direct debit was arranged verbally with the claimant, who, "naturally, agreed to the direct debit in order to cover the payment of the bills that were previously charged to their old BBVA account, which they closed."

BBVA also provided the written response it sent to the claimant, informing them that, with respect to other bills that were also re-directed to the new account, "there was no claim or objection raised regarding these, so we understand that there was consent to said re-direction on their part."

Therefore, BBVA's response is ambiguous, as it states, firstly,
that the consent was verbal and, secondly, that it was tacit since, as the claimant did not express disagreement, it was assumed that they authorized the

redomiciliation. This is further supported by the fact that the claimant has provided a certificate
from BBVA indicating that, as of the date of account cancellation (***ACCOUNT.1), there were no transfers to another account.

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 28/35

First, it should be noted that, according to the judgment of the National Court of November 3, 2015, rec. Judgment 333/2014 states that “…it is undeniable
that a natural person's bank account number constitutes

personal data, as repeatedly understood by the Court

(see, for example, the judgment of January 30, 2014, appeal 554/2012), under the
definition of personal data provided by Article 3(a) of the Spanish Data Protection Act (LOPD), defined as
“any information concerning identified or identifiable natural persons…
Therefore, the bank account number is undoubtedly data associated with the
identity of a specific, perfectly identifiable person, its holder, and thus

must be considered personal data for the purposes of applying the Spanish Data Protection Act (LOPD).”

Furthermore, and in response to BBVA's statements regarding the transfer of information, it should be noted that Recital 32 of the GDPR establishes that:

“Consent must be given through a clear affirmative act that reflects a
free, specific, informed, and unambiguous indication of the data subject's wishes to
consent to the processing of personal data relating to him or her, such as a
written statement, including by electronic means, or an oral statement.

This could include ticking a box on a website, choosing
technical parameters for the use of information society services, or any

other statement or conduct that clearly indicates in this context that the data subject
accepts the proposed processing of his or her personal data. Therefore, silence,
pre-ticked boxes, or inaction should not constitute consent.
Consent must be given for all processing activities carried out for the same
purpose(s). Where the processing has several purposes,

consent must be given for all of them. If the data subject's consent is to be given following a request made electronically, the request must be clear, concise, and not unnecessarily disrupt the use of the service for which it is provided.

In turn, Article 4 of the GDPR, concerning definitions, states in paragraph 11:

“11) ‘data subject’s consent’ means any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her;”

For its part, Article 7 of the GDPR establishes the conditions for consent as follows:

“1. Where processing is based on the data subject’s consent, the controller must be able to demonstrate that the data subject has consented to the processing of his or her personal data.”

2. If the data subject's consent is given in the context of a written declaration
that also relates to other matters, the request for consent shall be

presented in such a way that it is clearly distinguishable from the other matters, in an
intelligible and easily accessible form, and using clear and plain language.

No part of the declaration that constitutes an infringement of
this Regulation shall be binding.

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 29/35

3. The data subject shall have the right to withdraw their consent at any
time. The withdrawal of consent shall not affect the lawfulness of processing

based on consent before its withdrawal. Before giving their
consent, the data subject shall be informed of this. Withdrawing consent shall be as easy as giving it.

4. When assessing whether consent has been freely given, consideration will be given
to the greatest extent possible to whether, among other things, the performance of

a contract, including the provision of a service, is conditional upon consent
to the processing of personal data that is not necessary for the performance of
that contract.

Therefore, in accordance with Guidelines 5/2020 on consent within the meaning of

Regulation (EU) 2016/679, consent must be, among other things,
explicit (a clear affirmative action), meaning that
tacit consent is not permissible.

Furthermore, even if it could be verbal, insofar as it must be
demonstrable by the controller, it must be in some form that allows for its verification. The above is closely linked to the requirements arising from the principle of proactive responsibility enshrined in Article 5.2 of the GDPR, further developed in Article 24 of the GDPR, which requires that the controller not only comply with the regulations, but also be able to demonstrate such compliance.

In the present case, it has not been proven that the controller had the complainant's consent to debit a sum from a current account held by the complainant, different from the one initially authorized for direct debit.

Therefore, in light of the facts of this case, this Agency considers that BBVA processed the complainant's data without their consent and without any other legal basis provided for in Article 6 of the GDPR being proven.

Therefore, the known facts are considered to constitute an infringement,

attributable to BBVA, for violation of Article 6 of the GDPR.

VII
Classification of the infringement of Article 6 of the GDPR and its classification for the purposes of

statute of limitations

Article 83.5 of the GDPR classifies as an administrative infringement the violation of the following article, which shall be sanctioned, in accordance with paragraph 2, with administrative fines of up to EUR 20,000,000 or, in the case of an undertaking, up to 4% of its total annual global turnover

of the preceding financial year, whichever is higher:

"(a) the basic principles for processing, including the conditions for consent pursuant to Articles 5, 6, 7 and 9;"

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 30/35

For its part, the LOPDGDD, in its Article 71, Infringements, states that:

“The acts and conduct referred to in paragraphs 4, 5 and 6 of Article 83 of Regulation (EU) 2016/679, as well as those that are contrary to this Organic Law, constitute infringements.”

For the sole purpose of determining the statute of limitations, Article 72.1 of the LOPDGDD (Spanish Data Protection Act) establishes the following:

"In accordance with the provisions of Article 83.5 of Regulation (EU) 2016/679, the following infringements are considered very serious and shall be subject to a three-year statute of limitations:

(b) The processing of personal data without any of the conditions for lawful processing established in Article 6 of Regulation (EU) 2016/679 being met."

"(b) The processing of personal data without the existence of any of the conditions for lawful processing established in Article 6 of Regulation (EU) 2016/679."

"(c) The processing of personal data without the existence of any of the conditions for lawful processing established in Article 6 of Regulation (EU) 2016/679."

(d) The processing of personal data without the existence of any of the conditions for lawful processing established in Article 6 of Regulation (EU) 2016/679."

(e) The processing of personal data without the existence of any of the conditions for lawful processing established in Article 6 of Regulation (EU) 2016/679. VIII
Penalty for non-compliance with Article 6 of the GDPR

In order to determine the administrative fine to be imposed, the provisions of Articles 83.1 and 83.2 of the GDPR must be observed. These provisions state:

“1. Each supervisory authority shall ensure that the imposition of administrative fines under this Article for infringements of this Regulation referred to in paragraphs 4, 9 and 6 is, in each individual case, effective, proportionate and dissuasive.

2. Administrative fines shall be imposed, depending on the circumstances of each individual case, in addition to or as an alternative to the measures provided for in

Article 58(2)(a) to (h) and (j). In deciding whether to impose an administrative fine and its amount in each individual case, due consideration shall be given to:

(a) the nature, seriousness, and duration of the infringement, taking into account the nature, scope, or purpose of the processing operation concerned, as well as the number of data subjects affected and the level of damage suffered by them;

(b) whether the infringement was intentional or negligent;

(c) any measures taken by the controller or processor to remedy the damage suffered by the data subjects;

(d) the degree of responsibility of the controller or processor, taking into account the technical or organizational measures implemented by them pursuant to Articles 25 and 32;

e) any prior infringement committed by the controller or processor;

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 31/35

f) the degree of cooperation with the supervisory authority with a view to remedying the infringement and mitigating its possible adverse effects;

g) the categories of personal data affected by the infringement;

h) how the supervisory authority became aware of the infringement, in particular whether and, if so, to what extent the controller or processor notified the infringement;

i) where the measures referred to in Article 58(2) have been previously ordered against the controller or processor concerned in relation to the same matter, compliance with those measures;

(j) adherence to codes of conduct pursuant to Article 40 or to certification mechanisms approved pursuant to Article 42, and (k) any other aggravating or mitigating factor applicable to the circumstances of the case, such as financial benefits obtained or losses avoided, directly or indirectly, through the infringement.”

For its part, Article 76 “Sanctions and Corrective Measures” of the LOPDGDD (Spanish Data Protection Law) provides:

“1. The sanctions provided for in paragraphs 4, 5 and 6 of Article 83 of Regulation (EU) 2016/679 shall be applied taking into account the criteria for determining the severity of the sanction established in paragraph 2 of that Article.

2. In accordance with the provisions of Article 83.2(k) of Regulation (EU) 2016/679, the following may also be taken into account:

(a) The continuing nature of the infringement.

b) The connection between the infringer's activity and the processing of personal data.

c) The benefits obtained as a result of committing the infringement.

d) The possibility that the affected party's conduct could have induced the commission of the infringement.

e) The existence of a merger by acquisition subsequent to the commission of the infringement, which cannot be attributed to the acquiring entity.

f) The impact on the rights of minors.

g) The appointment of a data protection officer, where not mandatory.

h) The voluntary submission by the controller or processor to alternative dispute resolution mechanisms in cases where disputes arise between them and any data subject.

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 32/35

The above implies, in accordance with Guidelines 04/2022 on calculating fines under the GDPR, that the amount of the fine for each infringement must be based on three elements: the turnover, the categorization of the infringements according to their nature (i.e., whether it is an infringement of Article 83.4, 83.5, or 83.6 of the GDPR), and the level of severity of the infringement in each specific case (in accordance with Article 83.2 a), b), and g). In any case, the fine to be imposed must to be, in each individual case, effective, proportionate, and dissuasive, in accordance with Article 83.1 of the GDPR.

In this regard, it is considered, as a preliminary matter, that BBVA's profit in 2023 amounted to €8,019,000,000, as stated in the 2023 annual report.

Furthermore, taking into account the categorization of the infringement, in accordance with Article 83.5 of the GDPR, the penalty imposed for each infringement may be a maximum of €20,000,000, or, in the case of a company, an amount equivalent to a maximum of 4% of its annual turnover, whichever is higher. 4% of BBVA's annual turnover is €320,760,000.

According to the above, the penalty that is The fine imposed for each infringement must be between €0 and €320,760,000.

Furthermore, regarding the level of severity under the GDPR, it considers that the following circumstances apply:

• The nature, severity, and duration of the infringement, taking into account the nature, scope, or purpose of the processing operation in question, as well as the number of data subjects affected and the level of damage they have suffered (Article 83.2(a) of the GDPR): the disputed facts affect a fundamental element of the right to personal data protection, as it underpins the lawfulness of data processing and its violation entails a significant risk to the rights of the data subject. In this respect, the facts directly affect the control that the data subject exercises over their data, a central

cornerstone of the GDPR, and exceed the reasonable expectations that the data subject may have regarding the processing of personal data carried out by the controller.

However, it is emphasized that there is only one person affected by the unlawful processing.

Furthermore, for the purposes of determining the duration of the infringement,

this corresponds to a single debit order.

It is also emphasized that the lack of accreditation of the legal basis for
the processing constitutes a violation of the principle of proactive responsibility
enshrined in Article 5.2 of the GDPR.

• The categories of personal data affected by the infringement

(Article 83.2(g) of the GDPR): Guidelines 04/2022 of the European Data Protection Board on the calculation of fines under the GDPR, adopted on

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 33/35

May 24, 2023, in paragraph 57, state the following regarding the
requirement to take into account the categories of personal data Those affected:

“(…)the GDPR clearly highlights the types of data that deserve special protection

and, therefore, a stricter response with regard to fines.

This refers, at a minimum, to the types of data referred to in Articles 9 and 10 of the GDPR and to data outside the scope of these Articles, the disclosure of which would cause immediate harm to the data subject (for example, location data, data concerning private communications, national identification numbers, or financial data, such as transaction summaries or credit card numbers). In this case, the personal data processed corresponds to the complainant's bank account information.

Furthermore, the following factors are considered as aggravating circumstances:

• Any prior infringement committed by the controller or processor (Article 83.2(e) of the GDPR). The entity has been previously sanctioned for other GDPR infringements. The following can be cited as examples:

PS/00677/2022: two infringements of Article 6.1 of the GDPR, classified as Article 83.5 of the GDPR.

PS/00546/2022: for an infringement of Article 6.1 of the GDPR, classified under Article 83.5 of the GDPR.

• The connection of the infringer's activity with the processing of personal data (Article 76.2(b) of the LOPDGDD): BBVA, as a consequence of its business activity, routinely and continuously processes the personal data of a large number of data subjects (clients and potential clients). In short, the performance of financial activities, which is BBVA's main activity, necessarily involves the processing of personal data of the natural persons who are clients (or potential clients) of said entity. Thus, the infringement occurs within the framework of personal data processing that the controller routinely carries out in its business and which is closely linked to it.

The balance of the circumstances contemplated in Article 83.2 of the GDPR, with respect to The infringement committed by violating the provisions of Article 6 of the GDPR

allows for an administrative fine of €100,000.00.

IX
Voluntary Payment

In accordance with the provisions of Article 85 of the LPACAP, the proposed resolution allowed for voluntary payment of the proposed fine.

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 34/35

The respondent has exercised the right provided for in Article 85.2 of the LPACAP (Law on the Common Administrative Procedure of Public Administrations), after being notified of the proposed resolution, which entails a 20% reduction in the amount. With the application of this reduction, the penalty is set at €80,000, and its payment implies the termination of the proceedings, without prejudice to the imposition of the corresponding measures.

Following the proposed resolution, and before this authority issued a decision, BBVA made a voluntary payment on October 17, 2025, taking advantage of the 20% reduction. In accordance with section 3 of

Article 85 of the LPACAP (Law on Administrative Procedure of Public Administrations), the effectiveness of the aforementioned reduction will be conditional upon the
withdrawal or waiver of any action or appeal through administrative channels against the
sanction.

It should be noted that, in accordance with the provisions of the LPACAP, as well as

the jurisprudence of the Supreme Court on this matter, the exercise of voluntary payment by the alleged offender does not exempt the administration from the obligation to
resolve and notify all proceedings, regardless of how they were initiated. Similarly, Article 88 of the aforementioned law establishes that the resolution
that concludes the proceedings will decide all issues raised by the
interested parties and any other issues arising therefrom.

Therefore, in accordance with applicable legislation and having assessed the criteria for
graduating the sanctions, the existence of which has been proven, the Presidency of
the Spanish Data Protection Agency RESOLVES:

FIRST: TO DECLARE the commission of the infringement and TO CONFIRM the sanction
determined in the operative part of this resolution. The amount
cited is €100,000. Since the defendant made prompt
payment before the resolution was issued, and without admitting liability,
pursuant to Article 85 of the LPACAP (Law on the Common Administrative Procedure of Public Administrations), a 20% reduction of the total

mentioned is applied, resulting in a final amount of €80,000.00.

SECOND: TO DECLARE the termination of procedure EXP202408496 in accordance with the provisions of Article 85 of the LPACAP.

THIRD: NOTIFY BANCO BILBAO VIZCAYA
ARGENTARIA, S.A. of this resolution.

FOURTH: In accordance with the provisions of Article 85 of the LPACAP, which conditions the reduction for voluntary payment on the withdrawal or waiver of any action or appeal through administrative channels, this resolution will be final through administrative channels and fully enforceable upon notification.

In accordance with the provisions of Article 50 of the LOPDGDD, this resolution will be made public. Publication will take place once it has been notified to the interested parties.

Against this resolution, which concludes the administrative process pursuant to Article 48.6 of the LOPDGDD (Organic Law on the Protection of Personal Data and Guarantee of Digital Rights), and in accordance with the provisions of Article 123 of the LPACAP (Law on the Common Administrative Procedure of Public Administrations), interested parties may file an administrative appeal with the Administrative Chamber of the National Court, in accordance with the provisions of Article 25 and paragraph 5 of the fourth additional provision of Law 29/1998, of July 13, regulating the Administrative Jurisdiction, within two months from the day following notification of this act, as provided for in Article 46.1 of the aforementioned Law.

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 35/35

Administrative Chamber Spanish Data Protection Agency

6 Jorge Juan Street www.aepd.es
28001 – Madrid sedeaepd.gob.es