[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fqjS5ZloZ_b3HSK0OzijVUdspPg4AUZwlZYCMeUnuaI8":3},{"article":4,"iocs":45,"watch_terms":46,"solutions":47,"lesson":96},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":20,"category":21,"article_tags":24},"990f2591-7fa0-459e-adad-0d879210e985","Italian DPA fines BBVA EUR 5 508 000 for failing to respect a customer’s objection to direct marketing","italian-dpa-fines-bbva-eur-5-508-000-for-failing-to-respect-a-customer-s-objecti-d93272","Italian DPA fines BBVA EUR 5 508 000 for failing to respect a customer’s objection to direct marketing ikerinar Fri, 09\u002F10\u002F2026 - 09:49","The Italian Data Protection Authority (DPA) has fined BBVA's Italian branch EUR 5,508,000 for failing to honor a customer's objection to direct marketing. Despite the customer exercising their right to opt-out via the bank's app and customer service, promotional notifications continued for seven months due to a technical failure. The DPA found BBVA infringed GDPR principles by not facilitating data subject rights and ordered the bank to implement corrective measures.","Italian DPA fines BBVA EUR 5.5M for ignoring customer's direct marketing opt-out.","https:\u002F\u002Fwww.edpb.europa.eu\u002Fnews\u002Fitalian-dpa-fines-bbva-eur-5-508-000-for-failing-to-respect-a-customers-objection-to-direct_en",null,"2026-10-09T07:49:34+00:00","2026-10-09T08:00:22.539231+00:00",7,[17],{"name":18,"type":19},"BBVA","vendor","d95477d7-eb04-4fad-a2dc-be1428040ce7",{"id":20,"icon":12,"name":22,"slug":23},"Privacy Fines","privacy-fines",[25,30,35,40],{"category":26},{"id":27,"icon":12,"name":28,"slug":29},"3f0f8451-91df-4b6c-9a73-ef3b2509b7f1","GDPR","gdpr",{"category":31},{"id":32,"icon":12,"name":33,"slug":34},"53f9c4b6-8bc6-4964-9169-d09e5cd41d72","Compliance","compliance",{"category":36},{"id":37,"icon":12,"name":38,"slug":39},"614132b8-5837-4952-b8b5-c6c9a32a1d85","Privacy","privacy",{"category":41},{"id":42,"icon":12,"name":43,"slug":44},"c5c77cdb-f7d7-4990-9436-c81dcbff1163","Policy","policy",[],[18],{"controls":48,"vendors":95},[49,78],{"slug":50,"name":51,"problem":52,"products":53},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.",[54,62,70],{"vendor_slug":55,"vendor_name":56,"vendor_logo":57,"product_slug":58,"product_name":59,"url":60,"description":61},"netskope","Netskope","\u002Fvendor-logos\u002Fnetskope.png","netskope-dlp","Netskope DLP","https:\u002F\u002Fwww.netskope.com\u002Fproducts\u002Fdata-loss-prevention","Data loss prevention for web, cloud apps, AI tools and endpoints.",{"vendor_slug":63,"vendor_name":64,"vendor_logo":65,"product_slug":66,"product_name":67,"url":68,"description":69},"proofpoint","Proofpoint","\u002Fvendor-logos\u002Fproofpoint.png","enterprise-dlp","Proofpoint Enterprise DLP","https:\u002F\u002Fwww.proofpoint.com\u002Fus\u002Fproducts\u002Fdata-loss-prevention","Data loss prevention across email, cloud and endpoints.",{"vendor_slug":71,"vendor_name":72,"vendor_logo":73,"product_slug":74,"product_name":75,"url":76,"description":77},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","purview-dlp","Microsoft Purview Data Loss Prevention","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fdata-security-governance\u002Fmicrosoft-purview-data-security","Data classification and loss prevention across Microsoft 365, endpoints and connected cloud apps.",{"slug":79,"name":80,"problem":81,"products":82},"compliance-automation","Compliance automation (GRC)","Evidence for NIS2, DORA and ISO 27001 is collected continuously, not in a rush before the audit.",[83,89],{"vendor_slug":84,"vendor_name":85,"vendor_logo":86,"product_slug":84,"product_name":85,"url":87,"description":88},"vanta","Vanta","\u002Fvendor-logos\u002Fvanta.png","https:\u002F\u002Fwww.vanta.com\u002F","Automated evidence collection and continuous monitoring for ISO 27001, SOC 2, NIS2 and other frameworks.",{"vendor_slug":90,"vendor_name":91,"vendor_logo":92,"product_slug":90,"product_name":91,"url":93,"description":94},"drata","Drata","\u002Fvendor-logos\u002Fdrata.png","https:\u002F\u002Fdrata.com\u002F","Continuous control monitoring and audit readiness across security frameworks.",[],{"slug":97,"title":98,"body":99,"framework_refs":100,"framework_notes":111},"bbva-fined-55m-for-ignoring-customer-marketing-opt-out-for-seven-months","BBVA Fined €5.5M for Ignoring Customer Marketing Opt-Out for Seven Months","BBVA's Italian branch failed to honor a customer's legally protected right to object to direct marketing under GDPR, allowing promotional communications to continue for seven months after the opt-out request was submitted through two separate channels. The root cause was a technical failure in the system responsible for propagating consent and preference changes across marketing platforms, indicating a lack of end-to-end validation for data subject rights requests. This matters because GDPR Articles 21 and 12 place a strict obligation on organizations to action objections promptly and to have functioning technical mechanisms to enforce them. A fine exceeding €5.5 million demonstrates that regulators will hold organizations accountable not just for policy intent, but for actual technical execution of data subject rights.",[101,102,103,104,105,106,107,108,109,110],"GDPR Article 21 – Right to Object","GDPR Article 12 – Transparent Information and Communication","GDPR Article 5(1)(a) – Lawfulness, Fairness and Transparency","GDPR Article 17 – Right to Erasure (related data subject rights obligations)","NIST Privacy Framework PR.PO-P4 – Privacy Policies, Processes and Procedures","NIST SP 800-53 PT-4 – Consent","CIS Control 3 – Data Protection","CIS Control 8 – Audit Log Management","ISO\u002FIEC 27701 – Privacy Information Management (PIMS)","ITIL Service Management – Change and Configuration Management",{}]