When Work and Personal Devices Collide: Lessons from BBVA’s €120,000 GDPR Fine
26th November 2024
Do you ever use your work phone for personal matters? How about using your personal phone for business? An employee of Spanish bank Banco Bilbao Vizcaya Argentaria, S.A. did, and they erased the data from the device. The now-former employee complained to the AEPD (Agencia Española Protección Datos, the Spanish data protection authority) and Banco Bilbao was fined €200,000 for violating Article 6(1) of the GDPR.
But this is an EU case!
Whilst the UK is no longer subject to the rulings of the European Court of Justice, nor subject to the EU’s consistency mechanism (which in theory aligns GDPR decisions in all EU member states), lessons can still be learned from our European neighbours. This case is not therefore binding on the UK, or any other EU member state, as it was a decision in a Spanish court, but the theory is sound.
Case Details
The data subject was an employee of Banco Bilbao Vizcaya Argentaria (BBVA) until September 2021. During their employment with the bank, they were given a mobile phone for work use. Following the termination of their employment with BBVA, they were given the option of keeping the mobile phone for personal use, which they accepted. The data subject continued to use the device as their personal phone until June 23rd, 2022 when it stopped working. When trying to fix the phone, they received a message saying that BBVA remotely managed the device. It would not function without the entry of corporate credentials. The data subject was advised to wipe the phone completely, but they did not do this, as they wanted to retain their personal data on the device. BBVA then remotely wiped the device upon discovering the company was still managing it via their corporate device management platform. The former employee complained to the AEPD in February 2023 that they had lost control of their personal data due to BBVA’s actions.
Case Results
The AEPD found that the BBVA violated Article 6(1) of the GDPR, which relates to the Lawfulness of processing and states:
- The processing will only be lawful if at least one of the following conditions is met:
- The interested party gave his consent for the processing of his personal data for one or more specific purposes;
- The processing is necessary for the execution of a contract to which the interested party is a party or for the application at the request of this one of the pre-contractual measures;
- Processing is necessary for compliance with a legal obligation to which the controller is subject;
- Processing is necessary to protect the vital interests of the data subject or of another natural person;
- Processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;
- Processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.” Source: EU GDPR
The BBVA has no legal basis for erasing the former employee’s personal data from the device without permission as their professional relationship was over. They could have erased corporate data from the device but not the entire phone memory including the personal data stored there by the data subject.
The AEPD originally set the fine at €200,000, but this amount was reduced as the BBVA took responsibility for the GDPR violation and the fine was reduced to €120,000.
While the BBVA had the right to delete all data contained in the corporate applications on the phone at any time during the employee’s contract, they did not have the right to erase any other data from the device, including personal data. The BBVA should have wiped all corporate data from the device as soon as it became the property of the former employee, not several months later. Locking the former employee out of the device after several months had passed and requiring a complete wipe of the device violates the GDPR.
Lessons Learned
What we can take from this case is that if companies allow employees the chance to use their own devices for business purposes, or keep phones and other devices that can store data after their employment has ended, they should take steps to erase all corporate data from the device promptly upon termination of said employee’s contract.
In conclusion, if you use mobile defence management software, this should always be removed from devices owned by, given to, or sold to employees for their personal use as it would be intrusive and a violation of their rights to track or remotely access their data.
Author: Mike Martin LLM
Mike is an information governance specialist and one of the founder Directors of the Griffin House Consultancy, a leading specialist data protection and information governance consultancy firm that supports hundreds of clients annually with their training, consulting and auditing requirements.
