Banking Law and Data Portability and IP Rights in Spain

Introduction

Data portability and intellectual property (IP) rights have become important legal issues in modern Spanish banking. Banks now operate through digital platforms, mobile applications, artificial intelligence systems, cloud services, open banking models, and financial-data ecosystems. These systems generate large amounts of customer information, software solutions, algorithms, databases, and technological innovations.

Data portability allows customers to obtain and transfer their personal data from one service provider to another. In banking, it supports competition by allowing customers to move financial information to new banks, fintech companies, or financial-service providers. Under Article 20 of the General Data Protection Regulation (GDPR), individuals have the right to receive certain personal data in a structured, commonly used, machine-readable format and transmit it to another controller where legal conditions are satisfied.

At the same time, banks invest heavily in intellectual property, including software platforms, risk models, cybersecurity systems, databases, artificial intelligence tools, and digital-payment technologies. The legal challenge is balancing customer control over financial data with the protection of banks’ proprietary technology and confidential business information.

Spain addresses these issues through GDPR, Organic Law 3/2018 on Personal Data Protection and Guarantee of Digital Rights (LOPDGDD), intellectual-property legislation, banking regulations, and European open-banking rules.

Legal and Regulatory Framework

The GDPR provides the main legal framework for banking data portability in Spain. Article 20 allows customers to receive personal data that they have provided to a bank and transfer it to another service provider when processing is based on consent or contractual necessity and carried out through automated means.

For banks, this may include customer identity information, account information, transaction history, and certain financial-service data generated through the customer relationship. However, portability does not automatically include every type of information created by the bank. Data derived through internal analysis, such as proprietary risk assessments, confidential scoring models, or commercial predictions, may fall outside the customer’s portability rights because they are generated through the bank’s own intellectual processes.

The Payment Services Directive framework and open-banking rules have also strengthened data access and competition. Banks must provide secure access mechanisms for authorised payment-service providers while maintaining customer consent, authentication, and security controls.

Intellectual property rights are mainly protected through Spanish and European IP laws. Software may receive copyright protection, while databases, inventions, trademarks, and technological innovations may receive additional protection depending on their nature. A bank’s proprietary algorithm, fraud-detection model, cybersecurity architecture, or artificial-intelligence system may represent valuable intellectual assets.

However, IP protection cannot be used as a reason to completely prevent lawful customer data access. Banks must distinguish between customer-owned personal information and the bank’s protected technological infrastructure.

Data Portability Challenges in Banking

One major issue is distinguishing customer data from bank-created information. A customer may request transaction records and personal information, but the bank may argue that certain analytical outputs, credit-risk models, or internal classifications are protected intellectual property.

For example, a bank may use customer transactions to create a credit-risk score. The raw transaction data may be portable, but the mathematical model, weighting system, and proprietary algorithm used to generate the score may remain protected.

Another challenge concerns competition. Data portability can reduce customer dependence on large banks and allow fintech companies to provide alternative services. However, banks argue that uncontrolled data sharing may expose confidential systems, increase cybersecurity risks, or allow competitors to benefit unfairly from expensive technological investments.

Security is also a major concern. When financial data moves between institutions, there must be strong authentication, encryption, access control, and accountability mechanisms. A portability system that increases competition but weakens security may create financial and privacy risks.

Intellectual Property Protection in Banking Technology

Banks increasingly rely on digital innovation. Their intellectual-property assets include:

banking software;

mobile applications;

artificial intelligence systems;

fraud-detection tools;

cybersecurity technology;

financial databases;

automated decision systems.

Copyright protection may apply to software code and original databases. Patent protection may apply to certain technical inventions where legal requirements are satisfied. Trade-secret protection may cover confidential algorithms, internal methodologies, and business strategies.

However, IP protection has limits. A bank cannot classify all customer-related information as a trade secret simply to avoid transparency obligations. Data protection law requires fairness and accountability, especially when automated systems affect customers.

Relationship Between GDPR and IP Rights

The GDPR recognises that data rights must coexist with other legal interests. A bank may protect intellectual property while still providing required information about processing activities and complying with portability obligations.

Transparency does not always require disclosure of the complete source code of an algorithm. A customer may have the right to understand the logic, consequences, and factors behind automated decisions without receiving the entire proprietary system.

This balance is especially important in credit scoring, automated lending, fraud detection, and customer-risk classification. Banks must explain decisions sufficiently while protecting commercially valuable technology.

Case Laws

In Google Spain SL and Google Inc. v AEPD and Mario Costeja González, Case C-131/12, the Court of Justice of the European Union recognised strong protection of personal data rights. The case established that individuals must have meaningful control over the use of their personal information.

In Schrems II, Case C-311/18, the Court examined international transfers of personal data and required effective safeguards. The case is relevant for banks transferring financial information through international technology providers.

In Nowak v Data Protection Commissioner, Case C-434/16, the Court adopted a broad interpretation of personal data. For banks, this supports the idea that many categories of customer information connected with financial services may fall under GDPR protection.

In SCHUFA Holding, Case C-634/21, the Court examined automated credit scoring and confirmed that automated systems influencing significant financial decisions require legal safeguards. The case is important for banking algorithms and proprietary scoring systems.

In Österreichische Post, Case C-300/21, the Court considered compensation for GDPR violations and clarified that unlawful data processing may create liability when legal requirements are satisfied.

In Bodil Lindqvist, Case C-101/01, the Court examined online publication of personal data and confirmed that personal information receives legal protection even in digital environments.

In Football Dataco Ltd v Yahoo! UK Ltd, Case C-604/10, the Court considered database protection and clarified the limits of intellectual-property protection over data collections. The principles are relevant to banking databases and financial information systems.

Conclusion

Data portability and intellectual property rights in Spanish banking require careful legal balancing. Customers must have effective control over their personal financial data, while banks must protect their technological investments, confidential systems, and innovative solutions.

A modern banking framework cannot choose between privacy and innovation. Spain’s approach requires banks to provide lawful data access, maintain strong cybersecurity, respect customer rights, and protect legitimate intellectual-property interests. Proper governance of financial data will be essential for competition, digital banking growth, and customer trust.