Generally, a bank informs a third party of its customer's personal data to fulfill its legal obligation, in which case the practice is appropriate. However, the bank must ensure the exercise of the right to information of the data subject, by informing them of the circumstances under which it may transfer personal data to a third party, the type of data to be disclosed, and the category of the data recipient, among other information.