Kutxabank Fires Employee for Snooping on Client Salaries 2026

Kutxabank has dismissed an employee in Hondarribia for snooping on the salaries of several clients, and the Spanish High Court of Justice of the Basque Country (TSJPV) has confirmed the dismissal as lawful. The case highlights the serious consequences of violating banking privacy, even for employees with technical access to customer data.

The scandal began when the wife of the employee, who worked at a Kutxabank branch in Hondarribia, made a casual comment criticizing the generous salaries of ArcelorMittal's management committee. She mentioned that her husband worked at a bank, which raised suspicions. A director at the steel company, the only member of that committee with an account at Kutxabank, learned from her CEO that her banking information was no longer private. She reported her suspicions to the bank's ethics channel, triggering an internal audit in January 2025.

How the Kutxabank Employee Was Caught Snooping

Computer records revealed that the employee had accessed confidential data of at least three ArcelorMittal employees on seven different occasions between January 2021 and March 2025. These accesses were outside his job functions, and he had no authorization to view them. At the time, he was earning a monthly salary of €5,346.60 and had worked at the bank since July 2008.

When confronted, the employee claimed his motive was "simple curiosity." However, the court found that his actions constituted a serious breach of trust and violated data protection regulations. The bank's internal audit and the subsequent legal process confirmed that the employee had abused his position to satisfy personal curiosity, not any business need.

Key Findings from the Court Ruling

• The TSJPV confirmed the disciplinary dismissal was justified due to unauthorized access to client data.
• The employee accessed confidential information of at least three clients over a period of four years.
• The bank's ethics channel and internal audit played a crucial role in detecting the breach.
• The employee's claim of "simple curiosity" was rejected as a valid excuse.
• The dismissal was upheld despite the employee's long tenure at the bank.

Why This Case Matters for Banking Privacy

This case underscores the importance of data protection in the banking sector. Customers trust banks with highly sensitive information, and any breach of that trust can have severe consequences. The court's decision sends a clear message that unauthorized access to client data, even by employees with technical access, will not be tolerated.

For banks, it reinforces the need for robust internal controls and monitoring systems to detect and prevent such abuses. Kutxabank's ethics channel and audit process worked as intended, but the incident raises questions about how long the employee was able to access data without being caught. The background to this story is set out in NHS England Chief Calls for Immediate Suspension of Snooping Staff. A related thread runs through Declutter Your Digital Life: Protect Data From AI and Boost Privacy. Earlier coverage in Data protection law: what it is and how it affects you shows how the argument developed.

Comparison of Access Rights and Consequences

What This Means for Employees and Employers

For employees, the case is a stark reminder that accessing data without a legitimate work reason is a dismissible offense, regardless of seniority or curiosity. For employers, it highlights the need for clear policies, regular audits, and a culture of compliance. Banks and other organizations handling sensitive data must ensure that access controls are not only technical but also monitored and enforced. A closer look at the same subject appears in UK AI Security: Ukraine Battlefield Data to Protect Sites. Anyone following the wider picture can start with Protect NHS Patient Data: Secure Records with Open Standards. The same theme surfaces in Protect NHS Patient Data: 5 Steps for Secure Records, which takes a different angle.

The ruling also brings attention to the ethical responsibilities of bank employees. Even if someone has the technical ability to view certain information, they must respect the boundaries of their role. The employee's actions not only cost him his job but also damaged the trust between the bank and its clients. Context on how this played out before sits in Protect NHS Patient Data: 5 Key Steps for Secure Records. A companion piece, Dutch Spy Chiefs Warn Tech in Cars Can Be Used to Snoop on You, approaches the same subject from another angle.

FAQ