Sign in

Info Other, enforcement EU

Italian DPA fines BBVA EUR 5.5 million for failing to respect customer's objection to direct marketing

Original title: Italian DPA fines BBVA EUR 5 508 000 for failing to respect a customer’s objection to direct marketing

Published
Source: edpb.europa.eu
Effective
Not stated
Deadline
Not stated
Framework: GDPR
Regulation (EU) 2016/679 (as corrected 2018) source
in 14 days
Indicative European Parliament plenary date (first reading) for the small mid-caps omnibus, COM(2025) 501, which would raise the Article 30 records exemption to organisations under 750 employees - a forecast, not a fixed date source

Why it matters

The Italian Data Protection Authority fined BBVA EUR 5,508,000 for failing to give effect to a customer's objection to direct marketing through the bank's mobile app, continuing to send promotional notifications for seven months despite the objection being recorded in the system. Controllers must ensure they have adequate technical and organisational measures in place to facilitate the exercise of data subject rights and cannot ignore valid requests merely because they were not submitted through a preferred channel. BBVA must adopt appropriate measures to ensure requests are handled correctly and without undue delay, and inform the DPA within 30 days of the steps taken.

What changed

  • BBVA was fined EUR 5,508,000 for infringements of Articles 5(1)(a), 12, 21, and 24 GDPR related to a customer's objection to direct marketing.
  • The Italian DPA found that BBVA failed to give effect to the customer's right to object correctly and in a timely manner, despite the objection being recorded in the system, resulting in at least ten unsolicited commercial notifications over seven months (October 2025 to May 2026).
  • The DPA rejected BBVA's argument that the customer should have used dedicated email addresses instead of the app's built-in objection mechanism, establishing that controllers must facilitate exercise of rights through available channels.
  • The DPA identified deficiencies in BBVA's technical and organisational measures, including incorrect information from Customer Service stating that promotional notifications could not be disabled when they actually could be.
  • BBVA was ordered to adopt appropriate technical and organisational measures to facilitate the exercise of data subject rights and to report to the DPA within 30 days on compliance measures taken.

Who is affected

Financial services (banking sector); multinational companies with EU operations; any organisation processing personal data for direct marketing purposes

What to do

Open the official document

AI-assisted summary of the official document; the official text prevails. Not legal advice.

More changes in GDPR