[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fhuNlPzPDj7A-aYeP__YptXtMCVkXl-_yKH_IRg1i62g":3},{"article":4,"iocs":41,"watch_terms":42,"solutions":43,"lesson":92},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":20,"category":21,"article_tags":25},"4af93435-7186-442c-867c-e6013f04af8d","Garante per la protezione dei dati personali (Italy) - 613\u002F2026","garante-per-la-protezione-dei-dati-personali-italy-613-2026-7e39e3","← Older revision Revision as of 14:35, 15 September 2026 Line 92: Line 92: }} }} The DPA fined the Italian branch of the Bank of Bilbao Vizcaya Argentina S.A. €5,508,000 for persistently sending in-app communications after a data subject had deactivated the feature and objected to such processing. The DPA fined the Italian branch of the Bank of Bilbao Vizcaya Argentina S.A. €5,508,000 for persistently sending in-app communications after a data subject had deactivated the feature and objected to such processing. Technical error was not found a sufficient justification. == English Summary == == English Summary == === Facts === === Facts === The DPA received a complaint from a data subject after they received in-app communications by the Bank of Bilbao Vizcaya Argentina S.A. Italian branch (the controller) despite having deactivated the setting and objecting to the such processing. The DPA received a complaint from a data subject after they received in-app communications by the Bank of Bilbao Vizcaya Argentina S.A. Italian branch (the controller) despite having deactivated the setting and objected to the such processing. The controller expressed that deactivation of the notifications had not synchronised within its systems due to technical coordination error which caused an implementation delay. They clarified that the error was limited to the complainant, that they corrected the data subject’s profile and implemented stronger technical and organisational measures for data protection. The in-app communication included 10 unsolicited commercial messages. They emphasised that instead of contacting their DPO which was responsible for the exercise of rights, and explicitly stated in the privacy policy, the data subject contacted the customer service. The controller blamed the absence of notification deactivation on a technical error limited to the complainant, which they later fixed. It also claimed that the data subject had contacted the customer service and not the DPO, as explicitly stated in the privacy policy. Throughout the period of delayed implementation, the data subject received 10 unsolicited commercial messages by the controller. === Holding === === Holding === The DPA held that the failure by the controller to act on the request of the data subject, which was done correctly through the in-app settings, in accordance with the advice given by the controller’s customer service, cannot be justified by relying on the technical error between its systems. The DPA held that the failure by the controller to act on the request of the data subject, which was done correctly through the in-app settings, in accordance with the advice given by the controller’s customer service, cannot be justified by a technical error between its systems. The DPA underscored that the controller sent no follow up with the data subject’s request, and in combination with the fact that the controller only acted after the DPA reached out, constitutes a failure to respond to the data subject’s request to object processing. The DPA underscored that the controller sent no follow up with the data subject’s request, and in combination with the fact that the controller only acted after the DPA reached out, constitutes a failure to respond to the data subject’s request to object processing.","The Italian Data Protection Authority (Garante) has fined the Italian branch of BBVA €5,508,000 for continuing to send in-app communications to a user who had deactivated the feature and objected to the processing. The bank cited a technical error as the cause, but the Garante found this insufficient justification, noting the bank only acted after the DPA intervened and that the user received 10 unsolicited commercial messages.","Italian DPA fines BBVA €5.5M for sending unsolicited in-app messages after opt-out.","https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=Garante_per_la_protezione_dei_dati_personali_(Italy)_-_613\u002F2026&diff=53037&oldid=53008","https:\u002F\u002Fgdprhub.eu\u002Fimages\u002Fe\u002Fec\u002FLogoIT.png","2026-09-15T14:35:43+00:00","2026-09-15T16:00:45.478174+00:00",7,[17],{"name":18,"type":19},"BBVA","vendor","c5c77cdb-f7d7-4990-9436-c81dcbff1163",{"id":20,"icon":22,"name":23,"slug":24},null,"Policy","policy",[26,31,36],{"category":27},{"id":28,"icon":22,"name":29,"slug":30},"3f0f8451-91df-4b6c-9a73-ef3b2509b7f1","GDPR","gdpr",{"category":32},{"id":33,"icon":22,"name":34,"slug":35},"53f9c4b6-8bc6-4964-9169-d09e5cd41d72","Compliance","compliance",{"category":37},{"id":38,"icon":22,"name":39,"slug":40},"d95477d7-eb04-4fad-a2dc-be1428040ce7","Privacy Fines","privacy-fines",[],[18],{"controls":44,"vendors":91},[45,74],{"slug":46,"name":47,"problem":48,"products":49},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.",[50,58,66],{"vendor_slug":51,"vendor_name":52,"vendor_logo":53,"product_slug":54,"product_name":55,"url":56,"description":57},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","purview-dlp","Microsoft Purview Data Loss Prevention","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fdata-security-governance\u002Fmicrosoft-purview-data-security","Data classification and loss prevention across Microsoft 365, endpoints and connected cloud apps.",{"vendor_slug":59,"vendor_name":60,"vendor_logo":61,"product_slug":62,"product_name":63,"url":64,"description":65},"forcepoint","Forcepoint","\u002Fvendor-logos\u002Fforcepoint.png","forcepoint-dlp","Forcepoint DLP","https:\u002F\u002Fwww.forcepoint.com\u002Fproduct\u002Fdlp-data-loss-prevention","Data loss prevention for endpoints, network, email and cloud applications.",{"vendor_slug":67,"vendor_name":68,"vendor_logo":69,"product_slug":70,"product_name":71,"url":72,"description":73},"proofpoint","Proofpoint","\u002Fvendor-logos\u002Fproofpoint.png","enterprise-dlp","Proofpoint Enterprise DLP","https:\u002F\u002Fwww.proofpoint.com\u002Fus\u002Fproducts\u002Fdata-loss-prevention","Data loss prevention across email, cloud and endpoints.",{"slug":75,"name":76,"problem":77,"products":78},"compliance-automation","Compliance automation (GRC)","Evidence for NIS2, DORA and ISO 27001 is collected continuously, not in a rush before the audit.",[79,85],{"vendor_slug":80,"vendor_name":81,"vendor_logo":82,"product_slug":80,"product_name":81,"url":83,"description":84},"vanta","Vanta","\u002Fvendor-logos\u002Fvanta.png","https:\u002F\u002Fwww.vanta.com\u002F","Automated evidence collection and continuous monitoring for ISO 27001, SOC 2, NIS2 and other frameworks.",{"vendor_slug":86,"vendor_name":87,"vendor_logo":88,"product_slug":86,"product_name":87,"url":89,"description":90},"drata","Drata","\u002Fvendor-logos\u002Fdrata.png","https:\u002F\u002Fdrata.com\u002F","Continuous control monitoring and audit readiness across security frameworks.",[],{"slug":93,"title":94,"body":95,"framework_refs":96,"framework_notes":109},"bbva-italy-fined-55m-for-ignoring-user-opt-out-preferences-1789489386466","BBVA Italy Fined €5.5M for Ignoring User Opt-Out Preferences","The root cause of this violation was a failure to honour a user's explicit opt-out request due to a technical error in the bank's communication preference management system. Critically, BBVA did not detect or remediate the issue independently — action was only taken after the Garante intervened, indicating a lack of adequate monitoring and internal controls. This matters because GDPR grants individuals the right to object to marketing processing, and organisations are legally obligated to enforce those preferences immediately and reliably. A 'technical error' is not an acceptable defence when the underlying systems lack the controls to validate that consent and preference changes are correctly applied end-to-end.",[97,98,99,100,101,102,103,104,105,106,107,108],"GDPR Article 7 – Conditions for consent","GDPR Article 21 – Right to object","GDPR Article 5(1)(a) – Lawfulness, fairness and transparency","GDPR Article 25 – Data protection by design and by default","GDPR Article 83(5) – Administrative fines","NIST SP 800-53 AC-3 – Access Enforcement","NIST SP 800-53 AU-6 – Audit Record Review, Analysis, and Reporting","NIST SP 800-53 SI-10 – Information Input Validation","CIS Control 3 – Data Protection","CIS Control 8 – Audit Log Management","ISO\u002FIEC 27001:2022 Annex A 5.34 – Privacy and protection of PII","ITIL 4 – Change Enablement (regression testing for system changes)",{}]