Data Processing and Storage Rules - Complete Framework (EU/Spain Focus + Banking)

Data processing and storage are governed by 6 principles under Article 5 GDPR and LOPDGDD 3/2018 in Spain, plus sectoral banking rules. Violation of any principle is independently fineable.

I. 7 LEGAL RULES OF PROCESSING - Art 6 & Art 9 GDPR

You cannot process unless you have one of these:

1. Consent: Free, specific, informed, unambiguous affirmative action. For banking monetisation, must be separate from contract.
2. Contract: Necessary to execute banking contract - e.g. process IBAN to make transfer. Cannot stretch to marketing.
3. Legal Obligation: Ley 10/2010 AML - 10 year retention, tax laws 4-6 years, Banco de España Circular reporting.
4. Vital Interests: Rare in banking - fraud prevention to protect customer.
5. Public Task: Only for public banks.
6. Legitimate Interest: Bank's interest in fraud detection, IT security, but must pass balancing test vs user privacy - cannot override.
7. Special Category Art 9: Financial data is not special category, but if you process health data from medical loan, biometric for KYC - needs explicit consent.

Spanish nuance: LOPDGDD Art 6 adds that processing of data relating to criminal offences only allowed under public control.

II. 7 PRINCIPLES OF STORAGE & PROCESSING - Art 5 GDPR

1. Lawfulness, Fairness, Transparency
You must tell data subject before processing: who you are, why, how long, who receives, rights.
Case Law: AEPD vs BBVA €5M (2020) & CaixaBank €6M (2021)
Spanish AEPD fined both banks for failing Art 13/14 information. BBVA used opaque privacy notice: "we will use data for commercial purposes". AEPD held transparency requires granular list - type of data, purpose, retention. "Glasnost" decisions - ended generic bank notices in Spain.

2. Purpose Limitation
Data collected for one purpose cannot be reused for incompatible purpose.
Case Law: CJEU C-26/22 and C-64/22 - SCHUFA Scoring (2023)
German credit scoring agency retained bank data longer than purpose. Court held storing data for future credit scoring is incompatible purpose - must have new basis.

In banking: Data collected for account management cannot be used for AI training or selling to advertiser without new consent.

3. Data Minimisation
Collect only what is necessary.
Case Law: AEPD PS/00068/2020 - Telefónica €75K + Applied to Banks
Telefónica charged third-person data. AEPD held collecting excessive data violates minimisation. Applied to banks - cannot collect full transaction history if only IBAN needed for transfer.

Case Law: CJEU C-184/20 - OT vs Vyriausioji tarnybinės etikos komisija
Lithuanian law requiring public disclosure of private interests excessive - minimisation principle.

4. Accuracy
Keep data accurate and updated. Art 5(1)(d).
Case Law: AEPD vs EVO Banco / Bankinter €240K (2025)
Breach exposing 1.27M records due to inaccurate mapping after merger. Bank failed to ensure accuracy post M&A.

Banking duty: Under Banco de España Circular 2/2016, bank must ensure accuracy of data before outsourcing.

5. Storage Limitation - Most Important for Banking
Store only as long as necessary for purpose, then delete or anonymise.

Banking storage matrix in Spain:

Case Law: AEPD vs Iberia Cards €20,000
Bank kept data after erasure request claiming storage interest. AEPD: retention must be based on law, not business interest. AML law overrides erasure, marketing interest does not.

Case Law: CJEU C-132/21 - Nemzeti Adatvédelmi - Budapest Bank
Hungarian bank stored customer complaints indefinitely. Court: storage beyond complaint handling is illegal.

6. Integrity & Confidentiality - Security
Implement appropriate technical and organisational measures - Art 32. Encryption, pseudonymisation, access control.

Case Law: AEPD vs Vodafone España €8M (2021) + CaixaBank breach pattern
Failure to prevent SIM swapping and unauthorised access. DORA now mandates ICT risk management for banks - encryption at rest and transit.

7. Accountability - Art 5(2)
Bank must be able to DEMONSTRATE compliance. Maintain Record of Processing Activities (ROPA) Art 30, DPIA Art 35 for high-risk processing like biometric, AI credit scoring.

III. SPECIAL STORAGE RULES FOR SPAIN

A. Data Localisation De-facto:

• No law says "store in Spain only", but Banco de España Circular 2/2016 + EBA Outsourcing Guidelines say:
  1. Bank must know exact location of data at all times
  2. Supervisor must have unrestricted audit access
  3. Data must be retrievable in Spain within 24h
  4. Transfer outside EEA needs SCCs + TIA after Schrems II C-311/18

Case Law: Schrems II - CJEU C-311/18 (2020)
Invalidated Privacy Shield. Any bank storing data in US cloud (AWS, Azure US) without supplementary measures violates storage rules. Spanish AEPD ordered banks to move to EU Sovereign Cloud.

B. Blocking vs Deleting - LOPDGDD Art 32
Spanish innovation: When retention law requires keeping data (e.g. 10yr AML) but GDPR requires deletion, data must be blocked - not used, only accessible to judges, prosecutors, Banco de España. After blocking period, securely delete.

C. Outsourced Storage Rules - EBA/GL/2019/02 Par 13
Before using cloud storage:

• Risk assessment
• Notify Banco de España for critical outsourcing
• Contract must contain: location of data centers, obligation to not change location without approval, right to audit, exit strategy.

IV. Landmark Cases Summary for Exam/Project

1. Puttaswamy I (2017) 10 SCC 1 - India: Foundation - privacy includes right to control storage of personal data.
2. BBVA & CaixaBank (AEPD 2020-21): Transparency + purpose limitation + storage for monetisation illegal.
3. Schrems I & II (C-362/14, C-311/18): Storage outside EEA invalid without adequate protection.
4. Planet49 (C-673/17): Consent for storage must be active opt-in.
5. Google LLC vs CNIL €50M (2019): Storage of location data without valid consent illegal.
6. Banco de España Sanctioning Procedure - Banco Popular / Banco Santander merger (2017-18): Failure to integrate storage and ROPA after merger led to governance sanctions under Ley 10/2014.

V. Practical Rulebook for Compliance

1. Map: Create ROPA - every data, purpose, basis, location, retention.
2. Tag: Tag data with retention date at ingestion.
3. Block: After purpose ends, auto-block access except legal hold.
4. Delete: Secure deletion - not just logical delete, cryptographic erasure.
5. Audit: Annual audit by Data Protection Officer + Banco de España reporting.