[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fHlpTt8zoQhHTx-u5iStsmEd-ixzTdP3IL7M_h9OYO_g":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":24,"status":25,"created_at":26,"published_at":27,"article":28,"tags":32,"podcasts":51,"controls":52},"366e3e00-eebb-484a-97eb-41c06ae889c4","bbva-italy-fined-55m-for-ignoring-user-opt-out-preferences-1789489386466","4af93435-7186-442c-867c-e6013f04af8d","BBVA Italy Fined €5.5M for Ignoring User Opt-Out Preferences","The root cause of this violation was a failure to honour a user's explicit opt-out request due to a technical error in the bank's communication preference management system. Critically, BBVA did not detect or remediate the issue independently — action was only taken after the Garante intervened, indicating a lack of adequate monitoring and internal controls. This matters because GDPR grants individuals the right to object to marketing processing, and organisations are legally obligated to enforce those preferences immediately and reliably. A 'technical error' is not an acceptable defence when the underlying systems lack the controls to validate that consent and preference changes are correctly applied end-to-end.","**Immediate actions:**\n- Audit all active communication channels to verify that opt-out and consent withdrawal signals are being correctly applied in real time.\n- Implement automated blocking of outbound marketing communications to users with active objection or opt-out flags before any message is dispatched.\n\n**Long-term improvements:**\n- Build a centralised, auditable Consent & Preference Management Platform (CMP) that serves as the single source of truth for all marketing communication permissions.\n- Establish a formal change-management process requiring regression testing of preference enforcement logic whenever communication systems are updated.\n- Conduct periodic end-to-end testing (including synthetic opt-out scenarios) to confirm that withdrawal of consent is correctly propagated across all downstream systems.\n\n**Detection & monitoring measures:**\n- Deploy automated monitoring alerts that flag any instance where a communication is sent to a user whose preference record shows an objection or opt-out status.\n- Implement a complaints and anomaly dashboard reviewed weekly by the Data Protection Officer to catch consent enforcement failures before regulatory escalation.",[12,13,14,15,16,17,18,19,20,21,22,23],"GDPR Article 7 – Conditions for consent","GDPR Article 21 – Right to object","GDPR Article 5(1)(a) – Lawfulness, fairness and transparency","GDPR Article 25 – Data protection by design and by default","GDPR Article 83(5) – Administrative fines","NIST SP 800-53 AC-3 – Access Enforcement","NIST SP 800-53 AU-6 – Audit Record Review, Analysis, and Reporting","NIST SP 800-53 SI-10 – Information Input Validation","CIS Control 3 – Data Protection","CIS Control 8 – Audit Log Management","ISO\u002FIEC 27001:2022 Annex A 5.34 – Privacy and protection of PII","ITIL 4 – Change Enablement (regression testing for system changes)",{},"published","2026-09-15T16:23:06.778235+00:00","2026-09-15T16:23:06.047+00:00",{"id":7,"url":29,"slug":30,"title":31},"https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=Garante_per_la_protezione_dei_dati_personali_(Italy)_-_613\u002F2026&diff=53037&oldid=53008","garante-per-la-protezione-dei-dati-personali-italy-613-2026-7e39e3","Garante per la protezione dei dati personali (Italy) - 613\u002F2026",[33,39,45],{"id":34,"name":35,"slug":36,"description":37,"color":38},"1732a005-556e-411c-a9db-5edec3058571","Logging & Monitoring","logging-monitoring","Missing logs, no alerting, blind spots","#a855f7",{"id":40,"name":41,"slug":42,"description":43,"color":44},"c0dcc566-3654-4d70-8ede-262a198e732f","Regulatory Compliance","regulatory-compliance","GDPR, NIS2, DORA, sector-specific violations","#ec4899",{"id":46,"name":47,"slug":48,"description":49,"color":50},"c8b843a5-d5a7-41d1-8d3b-cabded09d2ef","Data Protection","data-protection","Unencrypted data, missing DLP, poor classification","#3b82f6",[],[53,57],{"slug":54,"name":55,"problem":56},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.",{"slug":58,"name":59,"problem":60},"compliance-automation","Compliance automation (GRC)","Evidence for NIS2, DORA and ISO 27001 is collected continuously, not in a rush before the audit."]