Fine in the amount of EUR 3 000 000 applied by Spanish Data Protection Agency to CAIXABANK PAYMENTS & CONSUMER EFC, EP, S.A.U. for lack of specific and informed consent regarding profiling for commercial purposes

The National Center for Personal Data Protection (NCPDP), for information and application purposes, communicates about the fine in the amount of EUR 3 000 000 applied by Spanish Data Protection Agency (AEPD) to CAIXABANK PAYMENTS & CONSUMER EFC, EP, S.A.U. for lack of specific and informed consent regarding profiling for commercial purposes.

An investigation was initiated following several indications that there might be an incorrect practice in relation to the automated profiling and decision-making of the controller in the context of its commercial activity (the controller is a financial establishment and payment institution).

CAIXABANK PAYMENTS & CONSUMER EFC, EP, S.A.U is an entity acting as a financial establishment and payment institution whose business consists of marketing credit or debit cards, credit accounts with or without a card.

In the framework of its commercial activity, Caixabank makes profiles for the following purposes:

·        Analyse the risk of default upon application for a product;

·        Analyse the risk of default during the application for a product;

·        Selection of target audience.

Consent is requested in the various channels of prescribers and agents for study and profiling purposes. Thus, consent is requested in the following terms: “I authorise the CaixaBank Group to use my data for study and profiling purposes”. In the present case, the interested party is provided only with generic information on the different profiling treatments and with this information the interested party is not able to know exactly what the treatment is you are consenting to. Nor is there any provision for the person concerned to express his or her choice on all purposes for which the data are processed.  

In this regard, AEPD fine of EUR 3 000 000 to CAIXABANK PAYMENTS & CONSUMER EFC, EP, S.A.U. for lack of specific and informed consent regarding profiling for commercial purposes and ordered the controller to bring processing operations into compliance with the provisions of the GDPR within six months of this decision.

The NCPDP, as national supervisory authority for personal data processing, emphasizes the responsibility of personal data controllers to comply with the provisions of legal framework on personal data protection and to ensure that personal data processing operations are in accordance with the legislation in force.