[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fh5YJsRr5l0uGCZ0WoA_vvb0lgtkANFY1g-KY96EZAWk":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":22,"status":23,"created_at":24,"published_at":25,"article":26,"tags":30,"podcasts":49,"controls":50},"e490db7d-a7d7-432d-b009-5e0ddec6f4e1","bbva-fined-55m-for-ignoring-customer-marketing-opt-out-for-seven-months","990f2591-7fa0-459e-adad-0d879210e985","BBVA Fined €5.5M for Ignoring Customer Marketing Opt-Out for Seven Months","BBVA's Italian branch failed to honor a customer's legally protected right to object to direct marketing under GDPR, allowing promotional communications to continue for seven months after the opt-out request was submitted through two separate channels. The root cause was a technical failure in the system responsible for propagating consent and preference changes across marketing platforms, indicating a lack of end-to-end validation for data subject rights requests. This matters because GDPR Articles 21 and 12 place a strict obligation on organizations to action objections promptly and to have functioning technical mechanisms to enforce them. A fine exceeding €5.5 million demonstrates that regulators will hold organizations accountable not just for policy intent, but for actual technical execution of data subject rights.","**Immediate Actions:**\n- Audit all active opt-out and consent withdrawal records to verify they have been correctly applied across every downstream marketing system.\n- Implement end-to-end automated testing that validates a consent change in one channel (e.g., app) propagates correctly to all connected marketing platforms within the required timeframe.\n\n**Long-term Improvements:**\n- Establish a unified Consent Management Platform (CMP) as a single source of truth that all marketing and communication systems query in real time before sending any outreach.\n- Define and enforce a maximum SLA (e.g., 72 hours) for processing data subject rights requests, with escalation procedures if the deadline is at risk.\n- Conduct annual third-party audits of data subject rights workflows to identify technical gaps between policy and actual system behavior.\n\n**Detection & Monitoring Measures:**\n- Deploy automated monitoring alerts that flag any marketing communications sent to customers with an active opt-out or objection status.\n- Maintain detailed, tamper-evident logs of all consent changes and system acknowledgements to support regulatory investigations and demonstrate compliance.",[12,13,14,15,16,17,18,19,20,21],"GDPR Article 21 – Right to Object","GDPR Article 12 – Transparent Information and Communication","GDPR Article 5(1)(a) – Lawfulness, Fairness and Transparency","GDPR Article 17 – Right to Erasure (related data subject rights obligations)","NIST Privacy Framework PR.PO-P4 – Privacy Policies, Processes and Procedures","NIST SP 800-53 PT-4 – Consent","CIS Control 3 – Data Protection","CIS Control 8 – Audit Log Management","ISO\u002FIEC 27701 – Privacy Information Management (PIMS)","ITIL Service Management – Change and Configuration Management",{},"published","2026-10-09T08:20:27.940332+00:00","2026-10-09T08:20:27.832+00:00",{"id":7,"url":27,"slug":28,"title":29},"https:\u002F\u002Fwww.edpb.europa.eu\u002Fnews\u002Fitalian-dpa-fines-bbva-eur-5-508-000-for-failing-to-respect-a-customers-objection-to-direct_en","italian-dpa-fines-bbva-eur-5-508-000-for-failing-to-respect-a-customer-s-objecti-d93272","Italian DPA fines BBVA EUR 5 508 000 for failing to respect a customer’s objection to direct marketing",[31,37,43],{"id":32,"name":33,"slug":34,"description":35,"color":36},"1732a005-556e-411c-a9db-5edec3058571","Logging & Monitoring","logging-monitoring","Missing logs, no alerting, blind spots","#a855f7",{"id":38,"name":39,"slug":40,"description":41,"color":42},"c0dcc566-3654-4d70-8ede-262a198e732f","Regulatory Compliance","regulatory-compliance","GDPR, NIS2, DORA, sector-specific violations","#ec4899",{"id":44,"name":45,"slug":46,"description":47,"color":48},"c8b843a5-d5a7-41d1-8d3b-cabded09d2ef","Data Protection","data-protection","Unencrypted data, missing DLP, poor classification","#3b82f6",[],[51,55],{"slug":52,"name":53,"problem":54},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.",{"slug":56,"name":57,"problem":58},"compliance-automation","Compliance automation (GRC)","Evidence for NIS2, DORA and ISO 27001 is collected continuously, not in a rush before the audit."]