BBVA Italy Fined €5.5M for Ignoring User Opt-Out Preferences
Written by AI from the linked story. Not reviewed by an editor. How this works
BBVA Italy failed to honour a data subject's explicit objection to in-app marketing communications, continuing to send messages after the user had deactivated the feature. The bank attributed the failure to a 'technical coordination error' in synchronising user preference changes across its systems, which the Italian DPA (Garante) rejected as insufficient justification. This case illustrates that consent and preference management must be backed by robust, near-real-time technical controls — not manual or loosely coupled processes. Under GDPR, the right to object must be actionable immediately and verifiably enforced, making technical gaps a direct regulatory liability. Organisations that treat preference synchronisation as a low-priority operational task expose themselves to significant fines and reputational damage.
Tactical Insight
Immediate actions
- Audit all user preference and consent deactivation workflows to confirm that opt-out signals propagate in real time across every downstream communication channel.
- Implement automated integration tests that verify preference changes are reflected across all systems within a defined SLA (e.g., under 60 seconds).
Long-term improvements
- Design a centralised, event-driven Consent & Preference Management Platform (CMP) that acts as the single source of truth for all communication permissions.
- Establish a formal data-subject rights fulfilment process with documented SLAs, ownership, and escalation paths to prevent silent failures.
- Conduct annual privacy-by-design reviews of customer-facing systems to identify and remediate preference-synchronisation gaps before they become regulatory violations.
Detection & Monitoring measures
- Deploy automated monitoring that alerts the data protection team whenever a communication is dispatched to a user whose preference record shows an active opt-out or objection.
- Maintain detailed, tamper-evident logs of all consent state changes and outbound communications to support DPA audit requests and demonstrate accountability.