| AEPD - PS/00634/2021 | |
|---|---|
 | |
| Authority: | AEPD (Spain) |
| Jurisdiction: | Spain |
| Relevant Law: | Article 5(1)(f) GDPR Article 32(1) GDPR |
| Type: | Complaint |
| Outcome: | Upheld |
| Started: | |
| Decided: | |
| Published: | 15.11.2022 |
| Fine: | 80,000 EUR |
| Parties: | BANKINTER, S.A. |
| National Case Number/Name: | PS/00634/2021 |
| European Case Law Identifier: | n/a |
| Appeal: | Appealed - Confirmed |
| Original Language(s): | Spanish |
| Original Source: | AEPD (in ES) |
| Initial Contributor: | CSO |
The Spanish DPA fined a bank €80,000 for a breach of Article 32 GDPR due to lack of adequate technical and organisational measures. The controller also breached the principle of confidentiality by accidentally disclosing personal data of customers to a third party.
English Summary
Facts
The data subject was a customer of Bankinter (the controller). On 15 July 2021, the data subject accessed their online banking account in order to check a payment. They discovered that they could also view another person's banking information on the account. The data subject then contacted the controller's customer service department. However, they did not receive any news nor was the incident corrected. Therefore, the data subject complained about the security breach to the Spanish DPA.
The DPA initiated a sanctioning procedure and carried out an initial investigation.
Holding
First, the DPA held that the controller was responsible, in accordance with Article 32 GDPR, for implementing the appropriate technical and organisational measures and ensuring a level of security appropriate to the risk in order to safeguard the confidentiality of the data. The controller violated Article 32 GDPR, by allowing the data subject access to personal data of a third party via an online banking account.
Second, the DPA recalled that the GDPR does not establish a list of security measures that are applicable according to the data that are processed, but rather establishes that the controller shall apply technical and organisational measures that are appropriate to the risk of the data being processed. For that purpose, it is necessary to take into account the state of the art, the costs of implementation, the nature, scope, context and purposes of the processing, the risks of likelihood and severity for the rights and freedoms of the data subjects.
In the present case, the controller alleged that they granted special relevance to the protection of the confidentiality of the information under its control, for which it developed codes, policies and procedures aimed at guaranteeing the protection of said information. However, this statement was not accepted by the DPA, which argued that it was obvious from the incident that the technical and organisational measures implemented failed.
The DPA initially proposed a fine of €60,000 for breach of confidentiality and €40,000 for not adopting adequate technical and organisational measures. However, due to voluntary payment, the overall sum was reduced to €80,000.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Spanish original. Please refer to the Spanish original for more details.
1/19
File No.: EXP202104875
RESOLUTION OF TERMINATION OF THE PROCEDURE FOR PAYMENT
VOLUNTEER
Of the procedure instructed by the Spanish Agency for Data Protection and based on
to the following
BACKGROUND
FIRST: On February 1, 2022, the Director of the Spanish Agency for
Data Protection agreed to initiate sanction proceedings against BANKINTER, S.A.
(hereinafter the claimed party). Once the initiation agreement has been notified and after analyzing the
allegations presented, on September 8, 2022 the proposal was issued
resolution that is transcribed below:
<<
File no.: EXP202104875
PROPOSED RESOLUTION OF SANCTION PROCEDURE
Of the procedure instructed by the Spanish Agency for Data Protection and based on
to the following:
BACKGROUND
FIRST: D.A.A.A. (hereinafter, the claimant) dated 10/08/2021
filed a claim with the Spanish Data Protection Agency. The
claim is directed against BANKINTER, S.A. with NIF A28157360 (hereinafter, the
claimed party). The reasons on which the claim is based are the following:
access your personal area on the website of the claimed entity, in the section
corresponding to the monthly statement, not only the movements of your account are included, but also
also the movements of another belonging to a third party. As a consequence of
For this, on 07/16/2021 he files a claim with the Customer Service of
said entity and receives a response on 07/22/2021, reporting the start of the
timely actions without having received any further news in this regard, in addition to not
the incident has been corrected.
Provide a printout of the "monthly statement" document that appears in the personal area of the
claimant, corresponding to the month of June 2017, as well as the claim e-mail
and answer offered.
SECOND: In accordance with article 65.4 of Organic Law 3/2018, of 5
December, Protection of Personal Data and guarantee of digital rights (in
forward LOPDGDD), said claim was transferred to the claimed party, for
to proceed with its analysis and inform this Agency within a month of the
actions carried out to adapt to the requirements established in the regulations of
Data Protection.
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 2/19
No response to this letter has been received.
THIRD: On 12/29/2021 [the Director of the Spanish Protection Agency
de Datos agreed to admit the claim presented by the claimant for processing.
FOURTH: On 02/01/2022, the Director of the Spanish Protection Agency
of Data agreed to start a sanctioning procedure against the person claimed by the alleged
violation of articles 5.1.f) and 32.1 of the GDPR, typified in articles 83.5.a) and
83.4.a) of the aforementioned Regulation.
FIFTH: Notified of the initiation agreement, the defendant requested the extension on 02/09/2022
the deadline to answer and 02/14/2022 copy of the file; expansion that was
granted and copy that was transferred on 02/11/2022 and 02/14/2022 respectively.
The defendant submitted a brief of allegations on 02/25/2022 stating, in summary:
that it is not true, as stated in the initiation agreement, that it did not respond to the
requirements of the AEPD, since the response occurred on 12/27/2021; that
the incident was caused by an error when managing the change of ownership
of the other account of which in the past he was a co-owner, not updating correctly
the information that appeared in the claimant's “monthly statement” document,
to exclude that relating to the other account; the absence of fraud and guilt in the
action of the defendant; the non-existence of infringement of article 32.1 of the GDPR to the
have the claimed implemented appropriate technical and organizational measures; the
existence of medial contest of infractions; disproportionate sanctions
proposals and the necessary applications of mitigating factors and the absence of aggravating factors; the
filing of the procedure and subsidiarily the reduction of sanctions
proposals.
SIXTH: On 03/29/2022, the procedure instructor agreed to open
a period of practice tests, agreeing on the following:
- Consider reproduced for evidentiary purposes the claims filed by
the claimants and their documentation, the documents obtained and generated
by the Inspection Services that are part of the file.
- Consider reproduced for evidentiary purposes, the allegations to the agreement of
beginning presented by the defendant and the documentation that accompanies it.
SEVENTH: Of the actions carried out in this procedure, have been
accredited the following proven facts:
1. On 10/08/2021, a written entry from the claimant was entered in the AEPD stating that at
access the website of the defendant, personal area section corresponding to extract
monthly, not only the movements of your account are shown, but also the movements
from another account belonging to a third party; complaint filed with the Service of
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 3/19
Customer Service received a response informing them of the start of the proceedings
opportune, without having received further news in this regard, in addition to not having
corrected the incident.
2. There is a copy of the claimant's DNI.
3. There is a copy of the integral monthly extract of June 2021 related to the
movements of account no. ***ACCOUNT.1 of which the claimant is the owner, as well as
of the movements of the account ***ACCOUNT.2 whose owner is a third person.
4. There is an email sent by the claimant to the claimant dated
07/16/2021, which states the following:
“Yesterday, Thursday, July 15, I accessed my personal account on the website of
Bankinter in order to check a payment made last month. I was
reviewing the movements of my account when, what is my surprise to discover that
The movements of another account of which I am not the owner also appear. that other
account, as shown. corresponds to a "gold pension current account".
(…)
In accordance with the foregoing, I request that you proceed to the immediate correction of this
situation.
(…)”
5. There is a response to the email, dated 07/22/2021, stating:
"Dear Customer:
We proceed to carry out the appropriate steps based on the situation raised”.
6. The defendant has provided a letter sent to the claimant dated 08/19/2021 in the
which indicates the following:
"Regarding the situation raised by you, we inform you that we have
transferred your comments to the commercial managers of your accounts to discuss
this issue.
Thanking you as always for the trust you have placed in Bankinter, we continue to
available through Telephone Banking, at bankinter.com or at any point of
our Commercial Network.
Likewise, we know that they have tried to reach him several times by phone without
success.
For any questions regarding the claim, you can call us at the Customer Service
Customer Service (Tel. 900 802 081), providing us with the reference number”.
7. The defendant in writing dated 02/25/2022 has stated that: "Actually, the
situation was caused by an error when managing the change of ownership of
the Other Account (as the Claimant himself stated in the Brief). I don't know
had completely withdrawn access to the information of the Other Account (of which
he had been co-owner) when the change of ownership occurred, to the extent
in which the information that appeared in the document was not updated correctly
"monthly statement" of the Claimant, to exclude that relating to the Other Account".
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 4/19
FUNDAMENTALS OF LAW
Yo
By virtue of the powers that article 58.2 of the GDPR recognizes to each
control authority, and as established in articles 47 and 48 of the LOPDGDD,
the Director of the Spanish Data Protection Agency is competent to initiate
and to solve this procedure.
Likewise, article 63.2 of the LOPDGDD determines that: "The
procedures processed by the Spanish Data Protection Agency will be governed
by the provisions of Regulation (EU) 2016/679, in this organic law, for the
regulatory provisions dictated in its development and, as soon as they are not
contradict, on a subsidiary basis, by the general rules on the
administrative procedures.”
II
The denounced facts materialize in the visualization, when accessing the
monthly statement of your account on the claimant's website, not just your data
personal but to the data of a third person (account number and movements
of the same), violating the duty of confidentiality motivated by an incident of
security due to breach of technical and organizational measures.
Article 58 of the GDPR, Powers, states:
"two. Each supervisory authority shall have all the following powers
corrections listed below:
(…)
b) penalize any person in charge or person in charge of the treatment with
warning when the processing operations have infringed the
provided in this Regulation;
(…)”
First of all, article 5, Principles relating to treatment, of the GDPR
states that:
"1. Personal data will be:
(…)
f) processed in such a way as to guarantee adequate security of the
personal data, including protection against unauthorized processing or
illicit and against its loss, destruction or accidental damage, through the application
of appropriate technical or organizational measures ("integrity and
confidentiality").
(…)”
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 5/19
II
1. First, the defendant in writing 02/25/2022 alleged that the
12/27/2021, through the Agency's electronic headquarters, responded to the
Transfers of Claim and Request for Information, as reflected in those in the
File itself containing a copy of the response offered and that in the
Initiation Agreement, it is indicated that no response has been received to the Transfers of
Claim and Information Request.
Obviously it is an error because the defendant is true that he answered, such
and as stated in the file, although such circumstance is contrary to what is alleged by
the defendant would not have implied the inadmissibility of the claim or non-compliance
of the norms that regulate the procedure in light of the information offered by the
same.
Secondly, in a brief of 04/07/2022, it alleged that the defendant did not
There was no record or procedure with the AEPD that corresponds to the
reference numbers (PS/00634/2021 or E/12527/2021) and requested confirmation of the
existence of said error and, in particular, that the reference to "the documents
obtained and generated that are part of procedure E/12527/2021” was also
erroneous, there being no other procedure or documents of which Bankinter has
proof (otherwise, the Agency is requested to provide Bankinter with this
information together with the complete administrative file); and "it is corrected
formally said error, so that said Agreement is rectified in the file”.
On 02/07/2022, the defendant was notified of the Commencement Agreement
Sanctioning Procedure, appearing in the header of the same the reference to the
File No.: EXP202104875, that is, the same one that appears in the Proposal that is
issues and numbering produced by the internal system.
Subsequently, the defendant has requested a copy of the file and will have been able to
verify that the documents that make up the administrative file are
correspond to those provided by the claimant, those generated by the AEPD and the
provided by the claimant.
Likewise, on 03/29/2022 the opening of the test period was notified and the
Contrary to the previous letter, there is a reference to the disciplinary procedure
File No. PS/00634/2021 and in the second point of the AGREEMENT, it is indicated
requirement that the defendant himself indicated in his allegations to the initiation agreement; in
regarding the reference to the aforementioned numbers both of the disciplinary procedure
and the file are figures provided by the internal application system and that nothing
have to do with different files (thus the number of disciplinary procedure
is a code number provided by the system in relation to the file
procedural) but that have nothing to do with files or documents other than
those that the defendant has in his possession and that are part of the file
administrative, so there is no other procedure or other documentation of
which Bankinter is not aware of.
In short, the unique file number that appears on the settlement agreement
home includes all the internal numbers that identify the procedures carried out with
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 6/19
above, which all refer to the same claim; what he could
check upon receipt of the copy of the entire file
2. As we pointed out in the previous foundation, article 5, Principles
regarding treatment, establishes in its letter f) the following:
“The personal data will be:
(…)
f) processed in such a way as to guarantee adequate security of the
personal data, including protection against unauthorized or unlawful processing and
against its loss, destruction or accidental damage, through the application of measures
appropriate technical or organizational ("integrity and confidentiality")
(…)”
What the GDPR comes to point out is that the technical and organizational measures
adopted must be aimed at preventing unauthorized access or use of said
data and the equipment used in the treatment.
In this same sense, Recital 39 states that "... All
reasonable measures to ensure that the data is rectified or deleted
personal information that is inaccurate. Personal data must be processed in a way that
ensure adequate security and confidentiality of personal data,
including to prevent unauthorized access or use of such data and equipment
used in treatment.
This principle is reinforced in recital 49 of the GDPR, stating that the
processing of personal data will be carried out..."to the extent strictly necessary
and provided to ensure the security of the network and information, that is, the
capacity of a network or an information system to resist, at a certain level
of trust, to accidental events or illegal or malicious actions
that compromise the availability, authenticity, integrity and confidentiality of the
personal data stored or transmitted (…).”
The documentation in the file offers clear indications that the
claimed, violated article 5 of the GDPR, duty of confidentiality, by enabling the
visualization in your monthly bank statement, not only the movements of your
account, but also those relating to a third person.
As it appears in the proven facts, a copy of the extract is provided
comprehensive monthly corresponding to June 2021 in which the movements of
the account of which the claimant is the holder, as well as the movements related to
a second account owned by a third person.
The duty of confidentiality, previously the duty of secrecy, must
understood that its purpose is to prevent leaks of data not
consented by the holders of the same.
The duty of confidentiality is an obligation that is incumbent not only on the
responsible and in charge of the treatment but to anyone who intervenes in any
treatment phase and complementary to the duty of professional secrecy.
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 7/19
The defendant himself in his brief of 04/07/2022 has stated that "In
Actually, the situation was caused by an error when managing the change of
ownership of the Other Account (as the Claimant himself stated in the Brief).
Access to the Other's information had not been completely withdrawn.
Account (of which he had been co-owner) at the time of the change of ownership of the
itself, to the extent that the information that
appeared in the Claimant's "monthly statement" document, to exclude that
regarding the Other Account” and, furthermore, that “when he received the Transfers of
Complaint and Information Request, Bankinter was able to understand exactly what
happened, undoing the previous misunderstanding and adopted measures to solve the
incidence” (underlining corresponds to the AEPD).
Therefore, it is considered that the defendant is responsible for the infringement of the
article 5.1.f) of the RGPD, infringement typified in its article 83.5.a) of the aforementioned
regulation.
IV.
Article 83.5 a) of the GDPR, considers that the infringement of "the principles
principles for treatment, including the conditions for consent under
of articles 5, 6, 7 and 9” is punishable, in accordance with section 5 of the
mentioned article 83 of the aforementioned GDPR, "with administrative fines of €20,000,000
maximum or, in the case of a company, an amount equivalent to 4% as
maximum of the overall annual total turnover of the previous financial year,
opting for the one with the highest amount”.
The LOPDGDD in its article 72 indicates: "Infractions considered very serious:
1. Based on what is established in article 83.5 of the Regulation (EU)
2016/679 are considered very serious and the infractions that
suppose a substantial violation of the articles mentioned in that and, in
particular, the following:
a) The processing of personal data in violation of the principles and guarantees
established in article 5 of Regulation (EU) 2016/679.
(…)”
V
Secondly, article 32 of the GDPR "Security of treatment",
states that:
"1. Taking into account the state of the art, the application costs, and the
nature, scope, context and purposes of processing, as well as risks of
variable probability and severity for the rights and freedoms of individuals
physical, the person in charge and the person in charge of the treatment will apply technical and
appropriate organizational measures to guarantee a level of security appropriate to the risk,
which may include, among others:
a) the pseudonymization and encryption of personal data;
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 8/19
b) the ability to ensure the confidentiality, integrity, availability and
permanent resilience of treatment systems and services;
c) the ability to restore availability and access to data
quickly in the event of a physical or technical incident;
d) a process of regular verification, evaluation and assessment of effectiveness
technical and organizational measures to guarantee the safety of the
treatment.
2. When evaluating the adequacy of the level of security, particular attention should be paid to
take into account the risks presented by data processing, in particular as
consequence of the destruction, loss or accidental or illegal alteration of data
personal information transmitted, preserved or processed in another way, or the communication or
unauthorized access to such data.
3. Adherence to an approved code of conduct pursuant to article 40 or to a
certification mechanism approved under article 42 may serve as an element
to demonstrate compliance with the requirements established in section 1 of the
present article.
4. The person in charge and the person in charge of the treatment will take measures to
ensure that any person acting under the authority of the controller or the
manager and has access to personal data can only process such data
following the instructions of the person in charge, unless it is obliged to do so by virtue of the
Law of the Union or of the Member States”.
SAW
The violation of article 32 of the GDPR is typified in article
83.4.a) of the aforementioned GDPR in the following terms:
"4. Violations of the following provisions will be penalized, according to
with paragraph 2, with administrative fines of maximum EUR 10,000,000 or,
in the case of a company, an amount equivalent to a maximum of 2% of the
total annual global business volume of the previous financial year, opting for
the highest amount:
a) the obligations of the person in charge and the person in charge according to articles 8,
11, 25 to 39, 42 and 43.
(…)”
For its part, the LOPDGDD in its article 73, for prescription purposes, qualifies
of "Infringements considered serious":
According to what is established in article 83.4 of Regulation (EU) 2016/679
are considered serious and will prescribe after two years the infractions that suppose a
substantial violation of the articles mentioned therein and, in particular, the
following:
(…)
g) The breach, as a consequence of the lack of due diligence,
of the technical and organizational measures that have been implemented in accordance with
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 9/19
to what is required by article 32.1 of Regulation (EU) 2016/679”.
(…)”
The facts disclosed in this claim materialize
also in the breach of technical and organizational measures, violating the
data confidentiality.
VII
1. The GDPR defines personal data breaches as
“all those security violations that cause the destruction, loss or
accidental or illegal alteration of personal data transmitted, stored or processed
otherwise, or unauthorized disclosure of or access to such data.”
The documentation provided to the file shows that the defendant has
violated article 32 of the GDPR, when a security incident occurred by allowing
access to the claimant to the personal data of a third party, when viewing in their area
personnel from the entity's website the movements of another person's account.
It should be noted that the GDPR in the aforementioned precept does not establish a list of
the security measures that are applicable according to the data that is
object of treatment, but it establishes that the person in charge and the person in charge of the
treatment will apply technical and organizational measures that are appropriate to the risk
that entails the treatment, taking into account the state of the art, the costs of
application, the nature, scope, context and purposes of the treatment, the risks of
probability and seriousness for the rights and freedoms of the persons concerned.
In addition, security measures must be adequate and
proportionate to the risk detected, noting that the determination of the measures
technical and organizational procedures must be carried out taking into account: pseudonymization and
encryption, the ability to ensure confidentiality, integrity, availability and
resiliency, the ability to restore availability and access to data after a
incident, verification process (not audit), evaluation and assessment of the
effectiveness of the measures.
In any case, when evaluating the adequacy of the security level,
particular account of the risks presented by data processing, such as
consequence of the destruction, loss or accidental or illegal alteration of data
personal information transmitted, preserved or processed in another way, or the communication or
unauthorized access to said data and that could cause damages
physical, material or immaterial.
In this sense, recital 83 of the GDPR states that:
"(83) In order to maintain security and prevent processing from infringing the provisions of
this Regulation, the controller or processor must assess the risks
inherent to the treatment and apply measures to mitigate them, such as encryption. These
measures must ensure an adequate level of security, including the
confidentiality, taking into account the state of the art and the cost of its application
regarding the risks and nature of the personal data to be
protect yourself. When assessing risk in relation to data security, considerations should be
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 10/19
take into account the risks arising from the processing of personal data,
such as the destruction, loss or accidental or unlawful alteration of personal data
transmitted, stored or processed in another way, or communication or access not
authorized to said data, susceptible in particular to cause damages
physical, material or immaterial.
2. In the present case, the defendant has alleged that he has granted a special
relevance to the protection of the confidentiality of the information under its control, for
which has developed codes, policies and procedures aimed at guaranteeing the
protection of said information, listing below a series of measures
implanted, surprising him that the AEPD accused him of a violation of art. 32 GDPR.
However, such a statement cannot be accepted; it seems obvious that said
incident has occurred, that is, the technical and organizational measures implemented
failed due to a security incident when allowing the visualization by the
claimant of the movements of the account of a third party in his personal area of the
website of the entity, violating the principle of confidentiality.
In accordance with the proven facts and the documentation contained in the
file, the claimant addressed the defendant by sending him an e-mail on 07/16/2021,
stating that "Yesterday ... I accessed my personal account on the website of
Bankinter in order to consult a payment made last month. I was
reviewing the movements of my account when, what is my surprise to discover that
The movements of another account of which I am not the owner also appear. that other
According to the figure, the account corresponds to a "current or pension account...
I sense that the person who owns that gold pension account is the person with whom
share the ownership of a payroll account where we deposited our
corresponding payroll (my ex-partner). A possible explanation of these facts, the
more predictable, is that during the steps taken at the time by the office of
Bankinter so that we could put an end to joint ownership of the payroll account and pass
to each have their own payroll account, there was some oversight on the part of the
bank office...
In accordance with the foregoing, I request that you proceed to the immediate correction of
this situation".
Six days later, on 07/22/2021, the defendant responded by stating:
"We proceeded to carry out the appropriate steps based on the situation raised"
Well, despite the fact that the situation raised by the claimant was
crystal clear did not receive any response, stating that "The situation that
I exposed it to the bank, it continues the same without being corrected”.
Response that does not differ much from that carried out on 08/19/2021 by the
claimed to the claimant "In relation to the situation raised by you, I
We inform you that we have forwarded your comments to those responsible
of their accounts to deal with this matter”, and which was provided on 12/27/2021
In response to the information request from the AEPD to which we referred in the
point 1 of FD III.
Therefore, the defendant cannot rely on the fact that it was not until he received
the Complaint Transfers and Request for Information when you could understand
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 11/19
exactly what happened, adopting measures to solve the incident because the
The claimant in his claim document and in the extracts provided made it clear:
identified the type of account: "That other account, as shown, corresponds to a
account "current gold pension..." and to the owner of the same "I sense that the person who owns
of that gold pension account is the person with whom to share the ownership of a
payroll account where we entered our corresponding payroll (my
ex partner)..,".
The Supreme Court in a judgment of 02/15/2022 states that: "The obligation to
adopt the necessary measures to guarantee the security of personal data
cannot be considered an obligation of result, which implies that produced a
leaking of personal data to a third party there is responsibility regardless
of the measures adopted and the activity carried out by the person responsible for the file
or the treatment.
In the obligations of result there is a commitment consisting of the
fulfillment of a certain objective, ensuring the achievement or proposed result,
In this case, guarantee the security of personal data and the absence of
security leaks or breaches.
In obligations of means, the commitment acquired is to adopt
technical and organizational means, as well as deploy diligent activity in its
implantation and use that tends to achieve the expected result with
that can reasonably be classified as suitable and sufficient for its achievement,
for this reason they are called obligations "of diligence" or "of behavior".
The difference lies in the responsibility in both cases, because while
that the obligation of result responds to a harmful result due to the failure of the
security system, whatever its cause and the diligence used. In the
obligation of means is enough to establish technically appropriate measures and
implement and use them with reasonable care.
In the latter, the sufficiency of the security measures that the
responsible has to establish has to be related to the state of technology
at all times and the level of protection required in relation to the data
treated, but a result is not guaranteed.”
The Court confirms that the design of the technical means is not sufficient
and organizational requirements, since it is also necessary to correctly
implementation and proper use.
Therefore, the responsibility of the defendant is determined by the incident
of security revealed by the claimant, since he is responsible for taking
decisions aimed at effectively implementing the technical and
appropriate organizational measures to guarantee a level of security appropriate to the risk
to ensure the confidentiality of the data, restoring its availability and preventing
access to them in the event of a physical or technical incident. However, from the
documentation provided shows that the entity has not only breached this
obligation, but also the adoption of measures in this regard is unknown, despite
of having given transfer of the claim presented.
Pursuant to the foregoing, it is estimated that the defendant would be
allegedly responsible for the infringement of the GDPR: the violation of article 32,
offense typified in article 83.4.a).
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 12/19
VIII
The defendant alleges the existence of a medial contest of infractions for
concur the assumption referred to in art. 29.5 of Law 40/2015, of October 1,
Therefore, the imposition of only one of the two sanctions would proceed, specifically, the
regarding the violation of article 5.1.f) of the GDPR.
The art. 29.5 of Law 40/2015, of October 1, on the Legal Regime of the Sector
Public, establishes that: "When the commission of an offense derives
necessarily the commission of another or others, only the sanction must be imposed
corresponding to the most serious offense committed".
However, such argumentation cannot be accepted; the specific standard in
data protection, that is, the GDPR, establishes in its article 83.3 that:
"3. If a person in charge or a person in charge of the treatment fails to comply
intentionally or negligently, for the same treatment operations or operations
related parties, various provisions of this Regulation, the total amount of the
administrative fine shall not exceed the amount provided for the most serious offences.
serious.
We already pointed out in FD IV that the processing of personal data
violating the principles and guarantees established in article 5 of the GDPR,
considered as a very serious infraction, so the only limit would be established by
the amount indicated in article 83.5 of the GDPR "€20,000,000 maximum or,
in the case of a company, an amount equivalent to a maximum of 4% of the
total annual global business volume of the previous financial year, opting for
the one with the highest value”.
IX
In order to establish the administrative fine that should be imposed, the
observe the provisions contained in articles 83.1 and 83.2 of the GDPR, which
point out:
"1. Each control authority will guarantee that the imposition of fines
administrative proceedings under this article for violations of this
Regulations indicated in sections 4, 5 and 6 are in each individual case
effective, proportionate and dissuasive.
2. Administrative fines will be imposed, depending on the circumstances
of each individual case, as an addition to or substitute for the measures contemplated
in article 58, paragraph 2, letters a) to h) and j). When deciding to impose a fine
administration and its amount in each individual case shall be duly taken into account:
a) the nature, seriousness and duration of the offence, taking into account the
nature, scope or purpose of the processing operation in question
as well as the number of stakeholders affected and the level of damage and
damages they have suffered;
b) intentionality or negligence in the infringement;
c) any measure taken by the controller or processor
to alleviate the damages and losses suffered by the interested parties;
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 13/19
d) the degree of responsibility of the controller or the person in charge of the
processing, taking into account the technical or organizational measures that have
applied under articles 25 and 32;
e) any previous infringement committed by the person in charge or in charge of the
treatment;
f) the degree of cooperation with the supervisory authority in order to put
remedy the breach and mitigate the potential adverse effects of the breach;
g) the categories of personal data affected by the infringement;
h) the way in which the supervisory authority became aware of the infringement, in
particularly if the person in charge or the person in charge notified the infringement and, in such a case,
what extent;
i) when the measures indicated in article 58, paragraph 2, have been
previously ordered against the person in charge or in charge in question
in relation to the same matter, compliance with said measures;
j) adherence to codes of conduct under article 40 or to mechanisms
of certification approved in accordance with article 42, and
k) any other aggravating or mitigating factor applicable to the circumstances of the
case, such as the financial benefits obtained or the losses avoided, direct
or indirectly, through the infringement.
In relation to letter k) of article 83.2 of the GDPR, the LOPDGDD, in its
Article 76, "Sanctions and corrective measures", establishes that:
"two. In accordance with the provisions of article 83.2.k) of the Regulation (EU)
2016/679 may also be taken into account:
a) The continuing nature of the offence.
b) Linking the activity of the offender with the performance of processing
of personal data.
c) The benefits obtained as a consequence of the commission of the infraction.
d) The possibility that the conduct of the affected party could have led to the
commission of the offence.
e) The existence of a merger process by absorption after the commission
of the infringement, which cannot be attributed to the absorbing entity.
f) The affectation of the rights of minors.
g) Have, when it is not mandatory, a data protection delegate
data.
h) The submission by the person in charge or in charge, with character
voluntary, alternative conflict resolution mechanisms, in those
cases in which there are controversies between those and any
interested."
- In accordance with the transcribed precepts, and without prejudice to what results from
the instruction of the procedure, in order to set the amount of the fine to
impose in the present case for the infringement typified in article 83.5.a) and article
5.1.f) of the GDPR for which the defendant is held responsible, in an initial assessment,
consider the following factors concurrent:
They are aggravating circumstances:
- The nature, seriousness and duration of the infringement: the facts considered
proven seriously affect a basic principle in the treatment of data of
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 14/19
personal nature, such as confidentiality and integrity, and whose reproach is
more seriousness revealing the data of the account of a third party, type data
economic; damages caused as a result of interference in the
privacy sphere of the claimant, since we must not forget that we are
in the event of the infringement of a fundamental right to the protection of personal data and
that the claimant has been forced to file a claim with the AGPD before the
inaction of the defendant.
- The activity of the allegedly infringing entity is linked to the
data processing of both clients and third parties. In the activity of the entity
claimed, the processing of personal data is essential, therefore,
given the volume of business of the same the importance of the conduct object of the
This claim is undeniable (article 76.2.b) of the LOPDGDD in relation to the
article 83.2.k).
- Although it cannot be argued that the defendant acted
intentionally, there is no doubt that there is a serious lack of diligence in
his performance. Connected with the degree of diligence that the data controller
is obliged to deploy in compliance with the obligations imposed by the
data protection regulations, the SAN of 10/17/2007 can be cited. although it was
issued before the entry into force of the GDPR, its pronouncement is perfectly
extrapolated to the assumption that we analyse. The ruling, after alluding to the fact that the
entities in which the development of their activity entails a continuous treatment of
data of clients and third parties must observe an adequate level of diligence,
specified that "(...) the Supreme Court has been understanding that there is imprudence
whenever a legal duty of care is neglected, that is, when the offender does not
behaves with the required diligence. And in assessing the degree of diligence must
especially the professionalism or not of the subject should be considered, and there is no doubt that,
in the case now examined, when the appellant's activity is constant and
copious handling of personal data must insist on rigor and
exquisite care to comply with the legal provisions in this regard” (article 83.2,
b) of the GDPR).
- The volume of business of the defendant is one of the entities
leading financial institutions in the Spanish market, by business purpose (article
83.2, k) of the GDPR).
Extenuating circumstances are considered:
- Only one person has been affected by the infringing conduct.
In accordance with the above factors, it is deemed appropriate to impose on the defendant
for violation of article 5.1.f) of the GDPR, a penalty of 60,000 euros.
- In accordance with the precepts transcribed, for the purpose of setting the amount of the
sanction of a fine to be imposed in the present case for the offense typified in the
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 15/19
Article 83.4.a) and Article 32.1 of the GDPR for which the defendant is held responsible, in
In an initial assessment, the following factors are considered concurrent:
They are aggravating circumstances:
- The nature, seriousness and duration of the infringement: the facts considered
proven affect a basic issue in data protection such as the
security of the same, allowing the access of the claimant to the data of a
third, his ex-partner, as a consequence of the security incident and his absence from
response, initially, to the claim filed by the claimant, which
motivated him to contact the AEPD (article 83.2, a) of the GDPR).
- The activity of the allegedly infringing entity is linked to the
data processing of both clients and third parties. In the activity of the entity
claimed, the processing of personal data is essential, therefore,
given the volume of business of the same the importance of the conduct object of the
This claim is undeniable (article 76.2.b) of the LOPDGDD in relation to the
article 83.2.k).
- Although it cannot be argued that the defendant acted
intentionally, there is no doubt that there is a serious lack of diligence in
his performance. Connected with the degree of diligence that the data controller
is obliged to deploy in compliance with the obligations imposed by the
data protection regulations, the SAN of 10/17/2007 can be cited. although it was
issued before the entry into force of the GDPR, its pronouncement is perfectly
extrapolated to the assumption that we analyse. The ruling, after alluding to the fact that the
entities in which the development of their activity entails a continuous treatment of
data of clients and third parties must observe an adequate level of diligence,
specified that "(...) the Supreme Court has been understanding that there is imprudence
whenever a legal duty of care is neglected, that is, when the offender does not
behaves with the required diligence. And in assessing the degree of diligence must
especially the professionalism or not of the subject should be considered, and there is no doubt that,
in the case now examined, when the appellant's activity is constant and
copious handling of personal data must insist on rigor and
exquisite care to comply with the legal provisions in this regard” (article 83.2,
b) of the GDPR).
- The volume of business of the defendant is one of the entities
leading financial institutions in the Spanish market, by business purpose (article
83.2, k) of the GDPR).
Extenuating circumstances are considered:
- Only one person has been affected by the infringing conduct.
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 16/19
In accordance with the above factors, it is deemed appropriate to impose on the defendant
for violation of article 32.1 of the GDPR a penalty of 40,000 euros.
In view of the foregoing, the following is issued
PROPOSED RESOLUTION
FIRST. That by the Director of the Spanish Data Protection Agency
penalize BANKINTER, S.A., with NIF A28157360, for a violation of article
5.1.f) of the GDPR, typified in article 83.5, a) of the GDPR, with a fine of €60,000
(sixty thousand euros).
SECOND. That by the Director of the Spanish Data Protection Agency
penalize BANKINTER, S.A., with NIF A28157360, for a violation of article
32.1 of the GDPR, typified in article 83.4, a) of the GDPR, with a fine of €40,000
(forty thousand euros).
Likewise, in accordance with the provisions of article 85.2 of the LPACAP, you will be
informs that it may, at any time prior to the resolution of this
procedure, carry out the voluntary payment of the proposed sanction, which
It will mean a reduction of 20% of the amount of the same. With the application of this
reduction, the total sanction would be established at €80,000 (eighty thousand euros) and its
payment will imply the termination of the procedure. The effectiveness of this reduction
will be conditioned to the withdrawal or resignation of any action or appeal via
administrative against the sanction.
In case you choose to proceed to the voluntary payment of the specified amount
above, in accordance with the provisions of the aforementioned article 85.2, you must do it
effective by depositing it in the restricted account no. ES00 0000 0000 0000 0000
0000 open in the name of the Spanish Data Protection Agency in the entity
bank CAIXABANK, S.A., indicating in the concept the reference number of the
procedure that appears in the heading of this document and the cause, for
voluntary payment, reduction of the amount of the sanction. You must also send the
Proof of admission to the Sub-Directorate General of Inspection to proceed to close
The file.
In accordance with the provisions of article 76.4 of the LOPDGDD and given that the
amount of the sanction imposed is greater than one million euros, it will be subject to
publication in the Official State Gazette of the information that identifies the offender, the
infraction committed and the amount of the sanction.
By virtue of this, you are notified of the foregoing, and the procedure is revealed.
so that within TEN DAYS you can allege whatever you consider in your defense and
present the documents and information that it deems pertinent, in accordance with
Article 89.2 of the LPACAP.
R.R.R.
INSPECTOR/INSTRUCTOR
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 17/19
EXHIBIT
File index EXP202104875
10/08/2021 A.A.A.
10/11/2021 A.A.A.
11/24/2021 Transfer of claim to BANKINTER, S.A.
11/25/2021 Transfer of claim 2 to BANKINTER, S.A.
12/27/2021 Allegations by BANKINTER, S.A.
12/29/2021 Admission for processing to A.A.A.
02/02/2022 Opening of BANKINTER, S.A.
02/07/2022 Information. Claimant to A.A.A.
02/09/2022 Term extension request from BANKINTER S.A
02/09/2022 Request for term extension from BANKINTER.S. A
02/11/2022 Amp. Term to BANKINTER, S.A.
02/14/2022 Request for a copy of the BANKINTER.S file. A
02/14/2022 Transfer to BANKINTER, S.A.
02/25/2022 Allegations of BANKINTER.S. A
03/29/2022 Test period notification
>>
SECOND: On September 22, 2022, the claimed party has proceeded to the
payment of the penalty in the amount of 80,000 euros using the reduction
provided for in the motion for a resolution transcribed above.
THIRD: The payment made entails the waiver of any action or resource in the
against the sanction, in relation to the facts referred to in the
resolution proposal.
FUNDAMENTALS OF LAW
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 18/19
Yo
In accordance with the powers that article 58.2 of Regulation (EU) 2016/679
(General Data Protection Regulation, hereinafter GDPR), grants each
control authority and as established in articles 47, 48.1, 64.2 and 68.1 of the
Organic Law 3/2018, of December 5, Protection of Personal Data and
guarantee of digital rights (hereinafter, LOPDGDD), is competent to
initiate and resolve this procedure the Director of the Spanish Protection Agency
of data.
Likewise, article 63.2 of the LOPDGDD determines that: "The procedures
processed by the Spanish Data Protection Agency will be governed by the provisions
in Regulation (EU) 2016/679, in this organic law, by the provisions
regulations dictated in its development and, insofar as they do not contradict them, with character
subsidiary, by the general rules on administrative procedures."
II
Article 85 of Law 39/2015, of October 1, on Administrative Procedure
Common for Public Administrations (hereinafter LPACAP), under the heading
"Termination in disciplinary proceedings" provides the following:
"1. Initiated a disciplinary procedure, if the offender acknowledges his responsibility,
The procedure may be resolved with the imposition of the appropriate sanction.
2. When the sanction has only a pecuniary nature or it is possible to impose a
pecuniary sanction and another of a non-pecuniary nature but the
inadmissibility of the second, the voluntary payment by the presumed perpetrator, in
any moment prior to the resolution, will imply the termination of the procedure,
except in relation to the replacement of the altered situation or the determination of the
compensation for damages caused by the commission of the offence.
3. In both cases, when the sanction is solely pecuniary in nature, the
The competent body to resolve the procedure will apply reductions of at least
20% of the amount of the proposed penalty, these being cumulative among themselves.
The aforementioned reductions must be determined in the notification of initiation
of the procedure and its effectiveness will be conditioned to the withdrawal or resignation of
any administrative action or resource against the sanction.
The percentage reduction provided for in this section may be increased
according to regulations."
According to what has been stated,
the Director of the Spanish Data Protection Agency RESOLVES:
FIRST: DECLARE the termination of procedure EXP202104875, in
in accordance with the provisions of article 85 of the LPACAP.
SECOND: NOTIFY this resolution to BANKINTER, S.A..
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 19/19
In accordance with the provisions of article 50 of the LOPDGDD, this
Resolution will be made public once the interested parties have been notified.
Against this resolution, which puts an end to the administrative process as prescribed by
the art. 114.1.c) of Law 39/2015, of October 1, on Administrative Procedure
Common of Public Administrations, interested parties may file an appeal
administrative litigation before the Administrative Litigation Chamber of the
National Court, in accordance with the provisions of article 25 and section 5 of
the fourth additional provision of Law 29/1998, of July 13, regulating the
Contentious-Administrative Jurisdiction, within a period of two months from the
day following the notification of this act, as provided for in article 46.1 of the
referred Law.
968-230822
Mar Spain Marti
Director of the Spanish Data Protection Agency
28001 – Madrid 6 sedeagpd.gob.es
