Italian DPA fines BBVA EUR 5 508 000 for failing to respect a customer’s objection to direct marketing

BBVA's Italian branch failed to honor a customer's legally protected right to object to direct marketing under GDPR, allowing promotional communications to continue for seven months after the opt-out request was submitted through two separate channels. The root cause was a technical failure in the system responsible for propagating consent and preference changes across marketing platforms, indicating a lack of end-to-end validation for data subject rights requests. This matters because GDPR Articles 21 and 12 place a strict obligation on organizations to action objections promptly and to have functioning technical mechanisms to enforce them. A fine exceeding €5.5 million demonstrates that regulators will hold organizations accountable not just for policy intent, but for actual technical execution of data subject rights.