Banking Law and Digital Exclusion Damages in Spain

Introduction

Digital exclusion occurs when a customer cannot effectively access banking because services are designed primarily or exclusively for smartphones, online portals, biometric verification, automated telephone systems or digital identity tools. In Spain, the problem can affect older people, persons with disabilities, rural residents, migrants, low-income consumers and people without reliable internet access.

Digital exclusion becomes a legal issue when it causes financial loss or denies access to essential services. Examples include inability to withdraw cash after a branch closure, failure to complete online identity checks, loss caused by inaccessible fraud-reporting channels, refusal of a basic payment account, or harm caused by an automated credit decision that cannot be explained or reviewed. A customer may seek damages where the bank’s conduct breaches a statutory duty, a contractual duty, consumer-protection law, data-protection rules or the general duty to act diligently.

Legal and Regulatory Framework

Spain has no single statute called the “Digital Exclusion Damages Act.” Claims arise from several legal sources.

The Spanish Civil Code provides the general basis for contractual and non-contractual liability. Under Article 1101, a party may be liable for damages caused by fraud, negligence, delay or breach of contractual obligations. Article 1902 establishes non-contractual liability where a person causes damage through fault or negligence. A bank may therefore be liable if it fails to provide reasonably safe, accessible and functioning digital services.

Law 10/2014 on the regulation, supervision and solvency of credit institutions requires sound governance and appropriate conduct by banks. A bank that replaces branches with digital systems must still manage customer-service, operational and conduct risks. Digitalisation cannot justify poor service, lack of support or systems that predictably exclude vulnerable customers.

Royal Decree-Law 19/2017 on basic payment accounts is important for financial inclusion. It supports access to essential payment-account services for eligible consumers, including vulnerable customers. If a bank wrongly refuses or closes such an account, it may face regulatory scrutiny and potentially civil liability where actual loss is established.

Royal Decree-Law 19/2018 on payment services establishes rights concerning unauthorised payment transactions, execution errors, information duties and customer authentication. If a bank’s digital-security system fails, or if its authentication process makes it impossible for a customer to report fraud promptly, the bank may have reimbursement duties and may also face damages claims.

The General Law for the Defence of Consumers and Users prohibits unfair contract terms and misleading commercial practices. A digital bank cannot hide key terms, impose excessive online-only conditions or use clauses that prevent consumers from obtaining effective assistance.

Accessibility obligations arise from Royal Legislative Decree 1/2013, which protects the rights of persons with disabilities, and from EU accessibility rules applicable to consumer-facing banking services. Inaccessible apps, websites, payment terminals and identity processes may create regulatory consequences and, where harm is proved, support compensation claims.

Types of Recoverable Damage

The first category is economic loss. This may include failed payments, late-payment penalties, lost benefits, fraud losses, transport costs incurred to reach a distant branch, or interest caused by inability to access an account.

The second category is loss of opportunity. A customer may claim that inaccessible digital onboarding or automated rejection prevented access to credit, a payment account, business finance or an investment opportunity. Such claims require evidence that the loss was real and sufficiently connected to the bank’s conduct.

The third category is non-material damage. A serious data-protection breach, discriminatory treatment, humiliation, anxiety or prolonged inability to access essential funds may justify compensation. Courts normally require proof of actual harm rather than a purely technical breach.

The fourth category is collective consumer damage. Where a bank uses the same inaccessible app design, unfair online term or unlawful fee structure for many customers, consumer associations may seek collective remedies or challenge the practice on behalf of affected users.

Causation and Evidence

A successful claim generally requires proof of duty, breach, damage and causation. The customer should preserve screenshots, rejection messages, chat logs, accessibility errors, app records, bank correspondence, payment statements and medical or expert evidence where relevant.

Banks will often argue that the customer failed to update a device, ignored warnings or shared credentials. Courts must examine the customer’s conduct, but also whether the bank provided a realistic alternative channel. An elderly or disabled customer should not be blamed for failing to use a digital process that was inherently inaccessible or inadequately explained.

Case Laws

1. Banco Español de Crédito v Calderón Camino, Case C-618/10
   The Court of Justice required national courts to examine unfair consumer terms. Online banking clauses and digital-account contracts remain subject to judicial fairness review.
2. Aziz v Caixa d’Estalvis de Catalunya, Case C-415/11
   The Court strengthened protection against significant imbalance in consumer banking contracts. It supports challenges to terms that leave digitally excluded customers without effective remedies.
3. Kásler v OTP Jelzálogbank, Case C-26/13
   The Court held that transparency requires consumers to understand the economic consequences of contractual terms. A bank must clearly explain digital fees, account restrictions and online-only conditions.
4. Content Services v Bundesarbeitskammer, Case C-49/11
   The Court ruled that required consumer information must be provided on a durable medium in appropriate circumstances. Information merely placed on a website may be inadequate for vulnerable customers.
5. Verein für Konsumenteninformation v Amazon EU, Case C-191/15
   The Court confirmed that online standard terms cannot deprive consumers of mandatory protections. Foreign digital banks serving Spanish residents remain subject to these safeguards.
6. SCHUFA Holding, Case C-634/21
   The Court recognised that automated credit scoring may amount to a significant automated decision. The case is relevant where algorithmic systems exclude customers from credit without meaningful review.
7. Dun & Bradstreet Austria, Case C-203/22
   The Court held that individuals must receive meaningful information about automated decision-making logic. This helps customers challenge unexplained digital refusals and demonstrate potential loss.
8. Österreichische Post, Case C-300/21
   The Court ruled that a GDPR breach alone does not automatically create compensation; actual damage and a causal link are required. This is important for claims based on data-driven exclusion or inaccessible digital processes.

Conclusion

Digital transformation does not remove a bank’s obligation to treat customers fairly and diligently. In Spain, a customer harmed by inaccessible digital banking may rely on contract law, consumer protection, payment-services law, disability-rights law and data-protection law. Damages are most likely where the customer can show a clear bank failure, measurable loss and a direct connection between digital exclusion and the harm suffered.