Customers of Caixabank, complained to the Spanish Data Protection Agency (AEPD) that the bank was using a deceptive pattern application of preselection and forced action to obtain consent for processing personal data from its customers. Caixabank had asked customers to accept consent terms through pre-ticked boxes. If the customers did not accept the terms, the bank would charge them a fee of €5 per month for maintaining their bank account. This approach of preselecting the consent checkbox and then linking it to a mandatory fee for the bank account's maintenance forced the customers to provide their consent. The bank claimed that the fee was not a charge but a necessary fare for providing banking services and was an essential element of the contract. The AEPD established that during a certain period, for new customers who chose a particular type of bank account, the consent acceptance fields were pre-ticked. In the AEPD's view, linking an exemption from fees to the provision of obtaining consent for the processing of personal data would mean that the consent was not given freely, since not giving consent entailed the payment of maintenance fees, which were detrimental to the data subject.
The AEPD also noted that the bank's arguments related to the offering of different banking products were not relevant in this case, since these other products had different requirements based on, customer's economic conditions, minimum purchases per month, insurance contributions, and holdings into investment funds. The AEPD also established that linking processing of personal data with a waiver of fees could not be considered analogous to a loyalty program. The AEPD held that the two legal bases for the lawful processing of personal data (ie. consent and performance of a contract), were merged or blurred, in violation of Article 7(4) GDPR. Overall, the AEPD found Caixabank's actions to be in violation of GDPR due to the deceptive pattern application of preselection and forced action used to obtain consent for processing personal data.