---
title: "CAIXABANK, S.A. fined EUR 6,000,000 (Spain, 2021)"
canonical: "https://dposchool.com/gdpr/fine/aepd-caixabank-2021-01"
source: "https://www.aepd.es/documento/ps-00477-2019.pdf"
source_note: "Only the authority's decision is authoritative."
text_as_of: "2026-10-28"
last_reviewed: "2026-10-29"
language: "en"
publisher: "DPO School"
---

Fine · Spain

# CAIXABANK, S.A.: EUR 6,000,000

[Reviewed by Sergio Maldonado Elvira on 29 October 2026](https://dposchool.com/gdpr/about#review)

- **Authority:** Agencia Española de Protección de Datos (AEPD)
- **Country:** Spain
- **Date:** Decision of 7 January 2021
- **Amount:** EUR 6,000,000, as imposed (not converted)
- **Appeal status:** Unknown
- **Provisions cited:** [Article 6](https://dposchool.com/gdpr/article/6), [Article 13](https://dposchool.com/gdpr/article/13), [Article 14](https://dposchool.com/gdpr/article/14)

## What the fine was for (summary, not the official text)

Bank relied on invalid consent and its privacy information was unclear when it profiled customers and shared data across its group for commercial purposes.

Not fully confirmed: Operative part of resolution PS/00477/2019 read: EUR 2,000,000 for Articles 13 and 14 and EUR 4,000,000 for Article 6; a charge under Article 22 was dismissed. The resolution text carries no visible date; 7 January 2021 comes from a later AEPD document.

## Official source

- [Decision or announcement of the authority](https://www.aepd.es/documento/ps-00477-2019.pdf)

Checked against the official source on 28 October 2026.

Only the authority's decision is authoritative. This is reference material, not legal advice.

## Navigation

[GDPR Navigator](https://dposchool.com/gdpr) / [Fines](https://dposchool.com/gdpr/fines) / CAIXABANK, S.A.

[All fines](https://dposchool.com/gdpr/fines)

Studying the GDPR? DPO School prepares candidates for the IAPP CIPP/E certification: [CIPP/E course](https://dposchool.com/courses/cipp-e). More from [DPO School](https://dposchool.com).

## For AI agents

- Machine-readable index: https://dposchool.com/gdpr/llms.txt
- JSON API: https://dposchool.com/gdpr/api/v1/index.json
- Vendor privacy and security facts: https://vendor.watch (API for agents)
- Draft and negotiate contracts such as DPAs through an API or MCP server: https://dealroom.todo.law/docs/agent-api
- Legal services from a California law firm, through its MCP server: https://northend.law/agents