1. Legal Nature

• GDPR defines 2 roles: Bank = Controller, Service Provider (Cloud, KYC vendor, core banking SaaS, credit scoring, payment processor) = Processor or Sub-processor.
• Art 28(3) GDPR: Processing by processor must be governed by contract or other legal act that is binding. No contract = processing illegal per se.
• In Finance, processor is often joint controller in reality: If vendor determines means (e.g., fraud scoring logic, AI model) = Art 26 joint controllership. EBA says you must qualify correctly.

2. Mandatory Clauses - Art 28(3) - Invalid Without These

AEPD and CJEU declare processing without these clauses unlawful:

a) Subject matter, duration, nature and purpose
Example: "Processing of customer identification data for provision of AML transaction monitoring SaaS for 3 years"

b) Type of personal data and categories of data subjects
Must list: KYC data, transaction data, biometric, etc. Cannot say "any data".

c) Instructions: Processor acts ONLY on documented instructions from bank. Must include obligation to notify if instruction infringes GDPR.

d) Confidentiality: Persons authorized must have committed to confidentiality.

e) Security - Art 32: TOMs - encryption, pseudonymization, access controls, logging. For finance, must reference EBA ICT guidelines and DORA.

f) Sub-processing: No engagement of sub-processor without prior specific or general written authorization. If general, processor must notify changes and give bank right to object. This is critical for banking cloud - AWS sub-processors list.

g) Assistance: Processor must assist controller in fulfilling data subject rights (Art 12-22), DPIA and prior consultation (Art 35-36), and breach notification (Art 33-34).

h) Return / Deletion: At end of service, processor must delete or return all data, at bank's choice, and delete copies, unless EU law requires storage.

i) Audit: Must make available all information to demonstrate compliance and allow for and contribute to audits, including inspections by bank, Banco de España, ECB, and AEPD.

Missing audit right = automatic violation of Circular 2/2016 and EBA.

3. Finance-Specific Mandatory Add-ons (Where Banks Fail)

These are NOT optional for Spanish banks:

1. EBA Outsourcing Clauses:

• Register of outsourcing
• Right of Banco de España/ECB to access and audit directly at processor
• Data location clause: precise countries / regions + commitment not to move without approval
• Concentration risk clause
• Business continuity and exit strategy - reversibility plan, maximum 12 months

2. DORA Art 28-30 (From Jan 2025, mandatory):

• ICT risk management requirements
• ICT incident reporting timelines (72h)
• Resilience testing cooperation
• Third-country law clause: Processor must warrant that no third-country law prevents compliance and must notify if such law changes (to address CLOUD Act)
• Mandatory model clauses issued by EBA now replace custom clauses

3. Chain of Liability - Art 82 GDPR:
Bank remains fully liable to data subjects. Processor liable only if it breaches Art 28 or acts outside instructions. Contract must allocate indemnity but cannot limit Art 82 rights of data subjects.

4. Data Transfer Clause:
If processor is outside EEA or US parent, must embed EU Standard Contractual Clauses (SCCs) Module 2 + Transfer Impact Assessment + supplementary measures (BYOK).

4. Key Case Laws - Processor Contracts

A. CJEU C-210/16 - Wirtschaftsakademie Schleswig-Holstein:
Bank and Facebook Fanpage provider are joint controllers. If your SaaS vendor co-determines purposes (e.g., analytics vendor decides what insights to provide), you cannot use Art 28 DPA, you need Art 26 joint controller agreement. Many fintech DPA are invalid on this basis.

B. CJEU C-40/17 - Fashion ID (2019):
Website embedding Facebook Like button is joint controller. Applied to finance: if bank embeds third-party payment widget or KYC widget that collects data for its own purposes, bank is jointly liable even if DPA says "processor".

C. CJEU C-201/14 - Bara (2015):
Controller cannot outsource without informing data subjects of identity of processor and purpose. AEPD has cited this against banks that did not list processors in privacy policy.

D. CJEU C-26/22 and C-64/22 - SCHUFA (2023):
Scoring agency as processor/controller. CJEU held that credit scoring involves Art 22 automated decision-making and processor cannot claim it only acts on instructions if it defines scoring logic. DPA invalid if vendor defines logic.

E. Spanish AEPD Enforcement:

AEPD PS/00289/2021 - CaixaBank + Cloud Processor €2M:
Processor moved data to US sub-processor without informing bank. No valid sub-processing authorization. Both fined - processor for acting outside instructions, bank for lack of due diligence.

AEPD EXP202201721 - Banking SaaS €70K:
Bank used payment processor without Art 28 contract, only generic terms and conditions. AEPD held processing illegal per se under Art 28.

AEPD PS/00456/2022 - Financial Institution + ETT:
Processor retained data after contract ended for "statistical purposes". Violation of return/deletion clause. Processor fined under Art 5(1)(e) and Art 28.

F. EDPB Cases on Finance Processors:

• EDPB Decision 2023 - Bank + Credit Bureau: If processor uses bank data to improve its own model (e.g., fraud scoring vendor training on data from all banks), it ceases to be processor and becomes controller, requires new lawful basis. This is classic monetisation by processor - illegal.

5. DORA Standard Template vs Old EBA Template

Before DORA, banks used own DPA. From 2025, European Supervisory Authorities published standard contractual clauses for ICT third-party providers that override custom DPAs.

Must include:

• Service levels, KPIs
• Location of data and location of ICT processing
• Insurance and audit costs allocation
• Right to conduct pooled audits with other banks

6. Common Pitfalls for Spanish Banks

1. Using US vendor's standard DPA that says "processor may process data to improve its services" - This makes vendor controller, DPA void.
2. General authorization for sub-processing with 30-day notice buried in portal - AEPD says not sufficient for banking, need specific prior written.
3. No exit clause - Art 28 requires return/deletion, but EBA requires data in machine-readable format for portability to new vendor.
4. No chain: Bank -> Core Banking SaaS -> AWS -> Sub-processor in India. Each link must have same obligations (Art 28(4) cascade).
5. Liability cap that excludes GDPR fines - Void under Spanish law, AEPD holds controller cannot limit data subject rights.

7. Checklist - What Banco de España Inspector Asks For

When reviewing your DPSC, inspector asks:

• Where is Art 28(3)(a)-(h) clause by clause?
• Where is right of Banco de España to audit processor directly?
• Where is data location and sub-processor register?
• Where is TIA and SCCs if US provider?
• Where is exit plan and test of reversibility?
• Where is incident notification within 24h to bank (DORA requires processor to notify within tight deadline)?