The Spanish Data Protection Authority Imposes a €200,000 Fine on a Bank for Prolonged Data Retention

The Spanish Data Protection Authority (“DPA”) has conducted an investigation following a complaint from a data subject. According to the complaint, the individual had received notifications from the bank requesting consent for its privacy policy and for sending personalized advertising, despite no longer being a customer.

The investigation has revealed that the bank had obtained the data subject's information from a mortgage contract that terminated in 2008 and had retained this data for approximately 16 years.

The Authority has ruled that this situation constitutes a violation of the storage limitation principle as stipulated in Article 5(1)(e) of the GDPR. Therefore, the Authority has imposed an administrative fine of €200,000 on the bank, the data controller.

In its decision, the Authority has also considered the bank's history of four previous fines for similar violations as an aggravating factor, in addition to the extended retention period.

You can access the  full text of the Decision here.

Kind regards,

Zumbul Attorneys-at-Law

info@zumbul.av.tr

All information and documents on our website have been prepared by Zumbul Attorneys at Law for general informational purposes only, in accordance with the Attorneyship Law, other relevant legislation and the Professional Rules of Attorneyship of the Union of Turkish Bar Associations. These publications are not intended for advertising or commercial purposes. The information and documents provided are of a general nature and under no circumstances, do they guarantee or warrant that the content is complete, accurate, up-to-date, or reliable. You should not rely on the information and documents on this website without first consulting a lawyer or expert. The links included in our website’s publications are sourced from publicly available materials and are provided solely for the convenience of visitors in accessing additional information. These links do not constitute any form of recommendation or endorsement of the linked persons, institutions or organizations. The information on this website does not in any way constitute legal advice or establish an attorney-client relationship with visitors to the site. All content on this website is the property of by Zumbul Attorneys at Law, and no content may be copied, reproduced, or used without prior written permission.