[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fG5f3yuuodpwysdBUp_CUTVUYAvNQFgsQ_BKRfGoUAm4":3},{"article":4,"iocs":44,"watch_terms":45,"solutions":46,"lesson":78},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":23,"category":24,"article_tags":28},"f972a07e-b9bf-4984-b93a-7555a49229c9","Garante per la protezione dei dati personali (Italy) - 613\u002F2026","garante-per-la-protezione-dei-dati-personali-italy-613-2026-cbfbe1","← Older revision Revision as of 12:21, 14 September 2026 Line 92: Line 92: }} }} The DPA fined the Italian branch of the Bank of Bilbao Vizcaya Argentina S.A. €5.508.000 for persistently sending in-app communications after a data subject had deactivated the feature and objected to such processing. The DPA fined the Italian branch of the Bank of Bilbao Vizcaya Argentina S.A. €5,508,000 for persistently sending in-app communications after a data subject had deactivated the feature and objected to such processing. == English Summary == == English Summary == Line 103: Line 103: They emphasised that instead of contacting their DPO which was responsible for the exercise of rights, and explicitly stated in the privacy policy, the data subject contacted the customer service. They emphasised that instead of contacting their DPO which was responsible for the exercise of rights, and explicitly stated in the privacy policy, the data subject contacted the customer service. Throughout the period of delayed implementation, the data subject received 10 unsolicited commercial messages by the controller Throughout the period of delayed implementation, the data subject received 10 unsolicited commercial messages by the controller. === Holding === === Holding === The DPA held that the failure by the controller to act on the request of the data subject, which was done correctly through the in-app settings, in accordance with the advice given by the controller’s customer service, cannot be justified by relying on the technical error between its systems. The DPA held that the failure by the controller to act on the request of the data subject, which was done correctly through the in-app settings, in accordance with the advice given by the controller’s customer service, cannot be justified by relying on the technical error between its systems. Line 112: Line 109: The DPA underscored that the controller sent no follow up with the data subject’s request, and in combination with the fact that the controller only acted after the DPA reached out, constitutes a failure to respond to the data subject’s request to object processing. The DPA underscored that the controller sent no follow up with the data subject’s request, and in combination with the fact that the controller only acted after the DPA reached out, constitutes a failure to respond to the data subject’s request to object processing. In light of the foregoing the DPA found the controller in violation of Articles 5(1)(a), Article 12 and [[Article 21 GDPR|Article 21 GDPR]]. In light of the conditions to take into account pursuant to Article 83 and the fact that the controller had already band correspondingly imposed a fine of €5.508.000 on them. In light of the foregoing the DPA found the controller in violation of [[Article 5 GDPR|Articles 5(1)(a)]], [[Article 12 GDPR|Article 12]] and [[Article 21 GDPR]]. In light of the conditions to take into account pursuant to [[Article 83 GDPR|Article 83]] and the fact that the controller had already band correspondingly imposed a fine of €5,508,000 on them. == Comment == == Comment ==","The Italian Data Protection Authority (Garante) has fined the Italian branch of Banco Bilbao Vizcaya Argentaria (BBVA) €5.5 million for persistently sending in-app communications. This occurred even after a data subject deactivated the feature and objected to the processing of their data. The DPA found that BBVA's failure to act on the data subject's request, and their reliance on a technical error, constituted a violation of GDPR articles related to lawful processing, transparency, and the right to object.","Italy's DPA fines BBVA €5.5M for sending unsolicited in-app messages.","https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=Garante_per_la_protezione_dei_dati_personali_(Italy)_-_613\u002F2026&diff=53008&oldid=52993","https:\u002F\u002Fgdprhub.eu\u002Fimages\u002Fe\u002Fec\u002FLogoIT.png","2026-09-14T12:21:36+00:00","2026-09-14T14:00:18.621214+00:00",7,[17,20],{"name":18,"type":19},"BBVA","vendor",{"name":21,"type":22},"in-app communications","product","c5c77cdb-f7d7-4990-9436-c81dcbff1163",{"id":23,"icon":25,"name":26,"slug":27},null,"Policy","policy",[29,34,39],{"category":30},{"id":31,"icon":25,"name":32,"slug":33},"3f0f8451-91df-4b6c-9a73-ef3b2509b7f1","GDPR","gdpr",{"category":35},{"id":36,"icon":25,"name":37,"slug":38},"53f9c4b6-8bc6-4964-9169-d09e5cd41d72","Compliance","compliance",{"category":40},{"id":41,"icon":25,"name":42,"slug":43},"d95477d7-eb04-4fad-a2dc-be1428040ce7","Privacy Fines","privacy-fines",[],[18,21],{"controls":47,"vendors":77},[48],{"slug":49,"name":50,"problem":51,"products":52},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.",[53,61,69],{"vendor_slug":54,"vendor_name":55,"vendor_logo":56,"product_slug":57,"product_name":58,"url":59,"description":60},"proofpoint","Proofpoint","\u002Fvendor-logos\u002Fproofpoint.png","enterprise-dlp","Proofpoint Enterprise DLP","https:\u002F\u002Fwww.proofpoint.com\u002Fus\u002Fproducts\u002Fdata-loss-prevention","Data loss prevention across email, cloud and endpoints.",{"vendor_slug":62,"vendor_name":63,"vendor_logo":64,"product_slug":65,"product_name":66,"url":67,"description":68},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","purview-dlp","Microsoft Purview Data Loss Prevention","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fdata-security-governance\u002Fmicrosoft-purview-data-security","Data classification and loss prevention across Microsoft 365, endpoints and connected cloud apps.",{"vendor_slug":70,"vendor_name":71,"vendor_logo":72,"product_slug":73,"product_name":74,"url":75,"description":76},"forcepoint","Forcepoint","\u002Fvendor-logos\u002Fforcepoint.png","forcepoint-dlp","Forcepoint DLP","https:\u002F\u002Fwww.forcepoint.com\u002Fproduct\u002Fdlp-data-loss-prevention","Data loss prevention for endpoints, network, email and cloud applications.",[],{"slug":79,"title":80,"body":81,"framework_refs":82,"framework_notes":93},"bbva-italy-fined-55m-for-ignoring-user-opt-out-requests","BBVA Italy Fined €5.5M for Ignoring User Opt-Out Requests","BBVA Italy continued to send in-app marketing communications to a user even after they explicitly deactivated the feature and formally objected to data processing, with the bank attributing the ongoing violations to a technical error. This case illustrates that relying on system malfunctions as a legal defense does not absolve organizations of GDPR accountability — controllers are responsible for ensuring their technical systems can faithfully implement data subject rights. The failure to honor objection requests violates core GDPR principles including lawful basis, transparency, and the right to object under Articles 6, 12, and 21. This matters because it signals that regulators expect organizations to verify, not merely attempt, that user preference changes are operationally enforced.",[83,84,85,86,87,88,89,90,91,92],"GDPR Article 6 – Lawfulness of processing","GDPR Article 12 – Transparent information and communication","GDPR Article 21 – Right to object","GDPR Article 5(1)(a) – Principle of lawfulness, fairness, and transparency","NIST SP 800-53 PT-4 (Consent)","NIST SP 800-53 AU-2 (Audit Events)","CIS Control 3 – Data Protection","CIS Control 16 – Application Software Security","ITIL Service Design – Privacy and Data Management","ISO\u002FIEC 27701 – Privacy Information Management (PIMS)",{}]