The Basque country’s Superior Court of Justice has confirmed the dismissal of an employee of Kutxabank, the Bilbao bank born from the merger of BBK, Kutxa and Caja Vital, for consulting data to which he had technical access but was not authorized to see. His explanation was “simple curiosity.”
Apparently it started with a casual conversation with his wife in which she criticized the generous salaries of ArcelorMittal’s management committee. She said her husband works in a bank and gives tips. Fish die in the mouth. According to Diario Vasco, the TSJ upheld the punitive dismissal of the worker based in Honderibia.
doubt A director of a steel company, a member of the management committee, learned from his CEO that his banking information was no longer private. He was the only member of that organization with an account at Kutxabank, so he reported his suspicions to the entity’s ethics channel, which triggered an internal audit in January 2025. Computer records revealed questions not related to the functions of the employee, who was then receiving 5,346.60 euros per month and had worked at the bank since July 20.
the tail According to the Justice Department, the employee accessed the confidential information of at least three employees of ArcelorMittal (a giant steel company with more than 20,000 employees) on seven separate days between January 2021 and March 2025. And to find them, he also examined seven other clients with the same name and surname.
And it wasn’t just limited to salaries: it checked income, account movements, mortgage loans, guarantees and card operations. When asked, he resorted to “simple curiosity” as he liked to know how much people charge and denied sharing anything with his wife. He also alleged that freely consulting those systems was a practice tolerated by the bank.
Court criteria. The Social Chamber, in a judgment dated October 20, dismissed the worker’s petition at first instance in April 2026. The key factor is not whether he leaked the information, but whether he had the right to see it.
And no: bank employees are subject to a strict duty of confidentiality, and technological access is not safe conduct. Nor did his seniority act as a mitigating factor: his experience, the magistrates concluded, should have made him fully aware of the seriousness of his conduct. There is no ruling on costs and there is still an appeal before the Supreme Court for consolidation of the doctrine.
The Catalan example. The case coincides with another one we reported in January: a director of Caxabank in Les Presses (Girona) consulted on the movements of 170 clients in 210 days between November 2022 and December 2023; 84 were family members or close friends and 121 lived in the same city. He searched by name and surname, not by DNI, and finally admitted that he did it from “xafarderia”; That is, pure gossip. The entity fired him on January 31, 2024 for contractual good faith, fraud and abuse of trust, and the TSJ of Catalonia validated the decision. According to the entity, the sentence is final.
Legal framework. The European Data Protection Regulation requires data to be treated honestly and confidentially (Art. 5.1.f), and Spanish organic law extends this responsibility to all people involved in any stage of processing, not just companies. The Penal Code, for its part, in its Article 197.2 punishes anyone who, without authorization, accesses stored data recorded in computer files. The moral is old: a key to someone else’s house does not allow entry without the owner’s permission, much less to browse through drawers.
Picture | Kutxbank
In Xataka | A CaixaBank director spent two years “gossiping” about the movements of his clients: the court upheld his dismissal
