[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f40qUKxGdAVYSIaQMOs8YaeeMgyPo91FCPCvVs5bIlls":3},{"article":4,"iocs":44,"watch_terms":45,"solutions":46,"lesson":104},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":23,"category":24,"article_tags":28},"30ef64ed-69dd-4bb8-8a38-852e035e3b63","Garante per la protezione dei dati personali (Italy) - 613\u002F2026","garante-per-la-protezione-dei-dati-personali-italy-613-2026-c0b22e","Created page with \"{{DPAdecisionBOX |Jurisdiction=Italy |DPA-BG-Color= |DPAlogo=LogoIT.png |DPA_Abbrevation=Garante per la protezione dei dati personali |DPA_With_Country=Garante per la protezione dei dati personali (Italy) |Case_Number_Name=613\u002F2026 |ECLI= |Original_Source_Name_1=Garante per la protezione dei dati personali |Original_Source_Link_1=https:\u002F\u002Fwww.garanteprivacy.it\u002Fweb\u002Fguest\u002Fhome\u002Fdocweb\u002F-\u002Fdocweb-display\u002Fdocweb\u002F10291895 |Original_Source_Language_1=Italian |Original_Source_L...\" Show changes","The Italian Data Protection Authority (Garante per la protezione dei dati personali) has fined the Italian branch of Banco Bilbao Vizcaya Argentaria (BBVA) €5.508.000. The fine was imposed because the bank continued to send in-app communications to a data subject even after they had deactivated the feature and objected to the processing. BBVA cited a technical coordination error for the delay in synchronizing the deactivation, but the DPA found this insufficient justification.","Italy's DPA fines BBVA €5.5M for sending unsolicited messages after opt-out.","https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=Garante_per_la_protezione_dei_dati_personali_(Italy)_-_613\u002F2026&diff=52993&oldid=0","https:\u002F\u002Fgdprhub.eu\u002Fimages\u002Fe\u002Fec\u002FLogoIT.png","2026-09-10T10:04:02+00:00","2026-09-10T12:00:28.106969+00:00",8,[17,20],{"name":18,"type":19},"BBVA","vendor",{"name":21,"type":22},"in-app communications","product","d95477d7-eb04-4fad-a2dc-be1428040ce7",{"id":23,"icon":25,"name":26,"slug":27},null,"Privacy Fines","privacy-fines",[29,34,39],{"category":30},{"id":31,"icon":25,"name":32,"slug":33},"3f0f8451-91df-4b6c-9a73-ef3b2509b7f1","GDPR","gdpr",{"category":35},{"id":36,"icon":25,"name":37,"slug":38},"53f9c4b6-8bc6-4964-9169-d09e5cd41d72","Compliance","compliance",{"category":40},{"id":41,"icon":25,"name":42,"slug":43},"c5c77cdb-f7d7-4990-9436-c81dcbff1163","Policy","policy",[],[18,21],{"controls":47,"vendors":103},[48,77],{"slug":49,"name":50,"problem":51,"products":52},"identity-governance","Identity governance and single sign-on","People who leave or change roles lose access everywhere at once, and forgotten accounts stop piling up.",[53,61,69],{"vendor_slug":54,"vendor_name":55,"vendor_logo":56,"product_slug":57,"product_name":58,"url":59,"description":60},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","workforce-identity","Okta Workforce Identity","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fworkforce-identity\u002F","Single sign-on, adaptive MFA including phishing-resistant methods, and lifecycle management for employees.",{"vendor_slug":62,"vendor_name":63,"vendor_logo":64,"product_slug":65,"product_name":66,"url":67,"description":68},"sailpoint","SailPoint","\u002Fvendor-logos\u002Fsailpoint.png","human-fabric","SailPoint Human Fabric","https:\u002F\u002Fwww.sailpoint.com\u002Fproducts\u002Fhuman-fabric","Identity governance platform, the successor to Identity Security Cloud: lifecycle management, access requests and continuous access reviews.",{"vendor_slug":70,"vendor_name":71,"vendor_logo":72,"product_slug":73,"product_name":74,"url":75,"description":76},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","entra-id","Microsoft Entra ID","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fidentity-access\u002Fmicrosoft-entra-id","Cloud identity and access management with single sign-on, conditional access, passkeys and identity governance.",{"slug":78,"name":79,"problem":80,"products":81},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.",[82,90,95],{"vendor_slug":83,"vendor_name":84,"vendor_logo":85,"product_slug":86,"product_name":87,"url":88,"description":89},"proofpoint","Proofpoint","\u002Fvendor-logos\u002Fproofpoint.png","enterprise-dlp","Proofpoint Enterprise DLP","https:\u002F\u002Fwww.proofpoint.com\u002Fus\u002Fproducts\u002Fdata-loss-prevention","Data loss prevention across email, cloud and endpoints.",{"vendor_slug":70,"vendor_name":71,"vendor_logo":72,"product_slug":91,"product_name":92,"url":93,"description":94},"purview-dlp","Microsoft Purview Data Loss Prevention","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fdata-security-governance\u002Fmicrosoft-purview-data-security","Data classification and loss prevention across Microsoft 365, endpoints and connected cloud apps.",{"vendor_slug":96,"vendor_name":97,"vendor_logo":98,"product_slug":99,"product_name":100,"url":101,"description":102},"forcepoint","Forcepoint","\u002Fvendor-logos\u002Fforcepoint.png","forcepoint-dlp","Forcepoint DLP","https:\u002F\u002Fwww.forcepoint.com\u002Fproduct\u002Fdlp-data-loss-prevention","Data loss prevention for endpoints, network, email and cloud applications.",[],{"slug":105,"title":106,"body":107,"framework_refs":108,"framework_notes":121},"bbva-italy-fined-55m-for-ignoring-user-opt-out-preferences","BBVA Italy Fined €5.5M for Ignoring User Opt-Out Preferences","BBVA Italy failed to honour a data subject's explicit objection to in-app marketing communications, continuing to send messages after the user had deactivated the feature. The bank attributed the failure to a 'technical coordination error' in synchronising user preference changes across its systems, which the Italian DPA (Garante) rejected as insufficient justification. This case illustrates that consent and preference management must be backed by robust, near-real-time technical controls — not manual or loosely coupled processes. Under GDPR, the right to object must be actionable immediately and verifiably enforced, making technical gaps a direct regulatory liability. Organisations that treat preference synchronisation as a low-priority operational task expose themselves to significant fines and reputational damage.",[109,110,111,112,113,114,115,116,117,118,119,120],"GDPR Article 7 (Conditions for consent)","GDPR Article 21 (Right to object)","GDPR Article 5(1)(a) (Lawfulness, fairness and transparency)","GDPR Article 25 (Data protection by design and by default)","GDPR Article 83(5) (Fines for infringements of data subjects' rights)","NIST Privacy Framework PR.CO-P3 (Communication of privacy preferences)","NIST SP 800-53 AC-2 (Account Management \u002F Privilege control)","NIST SP 800-53 SI-12 (Information Management and Retention)","CIS Control 3 (Data Protection)","CIS Control 14 (Security Awareness and Skills Training)","ISO\u002FIEC 27001:2022 A.5.34 (Privacy and protection of PII)","ITIL 4 – Change Enablement (coordinated change synchronisation across systems)",{}]