[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fA-Rwi-QOC7BKxZJJthkkJ9RHwUuzAbg_-0aNGfBOwnE":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":24,"status":25,"created_at":26,"published_at":27,"article":28,"tags":32,"podcasts":51,"controls":52},"aa360012-97df-46b2-8163-f48b57e0ef03","bbva-italy-fined-55m-for-ignoring-gdpr-opt-out-requests","8e3977e3-39b0-4414-b5ee-0a041db7f077","BBVA Italy Fined €5.5M for Ignoring GDPR Opt-Out Requests","BBVA Italy failed to honour a data subject's right to object to data processing under GDPR Article 21, continuing to send unsolicited in-app communications even after the user had explicitly deactivated the setting and lodged a formal objection. The bank attempted to attribute the failure to a technical error, but Italy's Garante ruled this was not a valid legal justification for sustained non-compliance. This case highlights that organisations must have reliable, end-to-end technical mechanisms to enforce data subject rights — not just policy statements. The €5.5 million fine underscores that regulators expect both procedural and technical accountability when handling consent and objection workflows.","**Immediate actions:**\n- Audit all consent and objection management workflows to verify that opt-out signals are correctly propagated to every downstream communication channel.\n- Conduct a technical review of the in-app notification system to identify and remediate any bugs that override user preference settings.\n\n**Long-term improvements:**\n- Implement end-to-end automated testing that simulates data subject rights requests (objection, erasure, restriction) and validates they are fully enforced across all systems.\n- Establish a dedicated Data Subject Rights (DSR) fulfilment platform with audit trails to ensure requests are tracked, actioned, and verifiable.\n- Train engineering and product teams on the technical obligations of GDPR Articles 17, 18, and 21 so privacy requirements are embedded at design time.\n\n**Detection & monitoring measures:**\n- Deploy monitoring alerts that flag any communication sent to a customer whose profile carries an active opt-out or objection flag.\n- Schedule quarterly compliance audits of marketing and notification pipelines to detect drift between stated user preferences and actual system behaviour.",[12,13,14,15,16,17,18,19,20,21,22,23],"GDPR Article 21 – Right to object","GDPR Article 17 – Right to erasure","GDPR Article 18 – Right to restriction of processing","GDPR Article 5(1)(a) – Principle of lawfulness, fairness and transparency","GDPR Article 24 – Responsibility of the controller","NIST Privacy Framework PR.PO-P1 – Policies and procedures for data processing","NIST SP 800-53 AU-2 – Event Logging","NIST SP 800-53 SI-7 – Software, Firmware, and Information Integrity","CIS Control 3 – Data Protection","CIS Control 8 – Audit Log Management","ISO\u002FIEC 27701:2019 – Privacy Information Management (PIMS)","ITIL Service Design – Availability and continuity management for compliance obligations",{},"published","2026-09-16T10:21:59.387604+00:00","2026-09-16T10:21:59.106+00:00",{"id":7,"url":29,"slug":30,"title":31},"https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=Garante_per_la_protezione_dei_dati_personali_(Italy)_-_613\u002F2026&diff=53089&oldid=53037","garante-per-la-protezione-dei-dati-personali-italy-613-2026-fd9f18","Garante per la protezione dei dati personali (Italy) - 613\u002F2026",[33,39,45],{"id":34,"name":35,"slug":36,"description":37,"color":38},"1732a005-556e-411c-a9db-5edec3058571","Logging & Monitoring","logging-monitoring","Missing logs, no alerting, blind spots","#a855f7",{"id":40,"name":41,"slug":42,"description":43,"color":44},"c0dcc566-3654-4d70-8ede-262a198e732f","Regulatory Compliance","regulatory-compliance","GDPR, NIS2, DORA, sector-specific violations","#ec4899",{"id":46,"name":47,"slug":48,"description":49,"color":50},"c8b843a5-d5a7-41d1-8d3b-cabded09d2ef","Data Protection","data-protection","Unencrypted data, missing DLP, poor classification","#3b82f6",[],[53],{"slug":54,"name":55,"problem":56},"identity-governance","Identity governance and single sign-on","People who leave or change roles lose access everywhere at once, and forgotten accounts stop piling up."]