Bank fined by Spain Data Protection Agency

 

Spain's National Administrative Court has upheld a €60,000 penalty imposed by the Spanish Data Protection Agency (SDPA) on a Spanish bank for forwarding details of one client's confidential information to another client.

The incident came to light when the second client received confidential documents relating to the first client in addition to his own, sent through the post. These documents included bank statements, payslip transfers, account transactions and a debit card.

The SPDA concluded that this was a breach of the Data Protection Act and the bank's responsibilities and as such imposed the €60,000 fine.

The bank considered the fine to be excessive, and in a bid to reduce the amount to be paid, appealed to the National Administrative Court claiming that the error was due to the fact that the clients had similar ID numbers and the same postal code.

The National Administer Court did not agree with this and confirmed that the penalty must stand.