Cybersecurity Policy Report, Spanish Bank Fined After Deleting Former Employee’s Data, (Nov 13, 2024)
Organizations Mentioned:Banco Bilbao Vizcaya Argentaria, SA
Spain’s data protection authority, Agencia Española Protección Datos (AEDP), fined Banco Bilbao Vizcaya Argentaria S.A. (BBVA) 120,000 euros ($127,000), reduced from an initial fine of 200,000 euros ($211,000), alleging that BBVA violated the European Union’s General Data Protection Regulation (GDPR). The fine follows a complaint from a former employee who alleged absolute loss of control of his data.
The former employee was offered the possibility of acquiring his corporate device for personal use after termination of the employment relationship, according to AEDP. While the device became his personal property on Sept. 20, 2021, the device stopped working on June 23, 2022, it noted.
When trying to reconfigure it, he received a message indicating that the device was remotely managed by BBVA and requesting the entry of corporate credentials, effectively preventing the former employee from accessing the device, AEDP said.
BVVA completely wiped the device after it found the device was enrolled in the corporate device management platform for more than nine months after the end of the employment relationship, AEDP said. The former employee complained to the AEDP that BBVA’s actions resulted in the absolute loss of control over his data, as the only way to obtain access to the device would be to restore factory settings.
The AEPD found that, while the company had authority to delete all data contained in the corporate applications on the device at any time during the duration of the employee’s contract with the company or thereafter under the employer’s terms of use, BBVA did not have authority to delete data not included in the corporate applications, including personal data and information of the former employee contained on the acquired device. Thus, locking the employee out of the device and requiring reformatting was an infringement of the GDPR, the AEDP ruled.
The AEDP’s decision is available in Spanish; the document was machine translated for the purposes of reporting.
News: InternationalLegislation DataPrivacy LitigationEnforcement GDPR