BBVA Fined €5.5M for Ignoring Customer Marketing Opt-Out for Seven Months
Written by AI from the linked story. Not reviewed by an editor. How this works
BBVA's Italian branch failed to honor a customer's legally protected right to object to direct marketing under GDPR, allowing promotional communications to continue for seven months after the opt-out request was submitted through two separate channels. The root cause was a technical failure in the system responsible for propagating consent and preference changes across marketing platforms, indicating a lack of end-to-end validation for data subject rights requests. This matters because GDPR Articles 21 and 12 place a strict obligation on organizations to action objections promptly and to have functioning technical mechanisms to enforce them. A fine exceeding €5.5 million demonstrates that regulators will hold organizations accountable not just for policy intent, but for actual technical execution of data subject rights.
Tactical Insight
Immediate Actions
- Audit all active opt-out and consent withdrawal records to verify they have been correctly applied across every downstream marketing system.
- Implement end-to-end automated testing that validates a consent change in one channel (e.g., app) propagates correctly to all connected marketing platforms within the required timeframe.
Long-term Improvements
- Establish a unified Consent Management Platform (CMP) as a single source of truth that all marketing and communication systems query in real time before sending any outreach.
- Define and enforce a maximum SLA (e.g., 72 hours) for processing data subject rights requests, with escalation procedures if the deadline is at risk.
- Conduct annual third-party audits of data subject rights workflows to identify technical gaps between policy and actual system behavior.
Detection & Monitoring Measures
- Deploy automated monitoring alerts that flag any marketing communications sent to customers with an active opt-out or objection status.
- Maintain detailed, tamper-evident logs of all consent changes and system acknowledgements to support regulatory investigations and demonstrate compliance.