Italian Data Protection Authority fines BBVA €5.5 million over ignored marketing objection

What happened

• The Italian Data Protection Authority fined BBVA €5.508 million after a customer’s objection to direct marketing via the bank’s app was ignored for seven months, resulting in multiple unsolicited notifications.
• The DPA found violations of GDPR Articles 5(1)(a), 12, 21 and 24, citing technical and organisational failures.
• BBVA must implement measures to honor data‑subject rights and report compliance within 30 days.
• The fine considered the duration, single data subject impact, and BBVA’s prior record.

Why it matters

Banks using app‑based consent channels must ensure that objection flags are synchronised across all marketing systems instantly, or risk enforcement actions similar to BBVA’s case.

Business impact

Failure to integrate objection handling can lead to costly fines and mandatory system upgrades, affecting marketing operations and customer‑service workflows.

What to check

1. 1

   Audit objection handling workflowsHigh priority

   Verify that any opt‑out recorded in mobile apps propagates instantly to all marketing and CRM systems.

2. 2

   Update technical safeguardsHigh priority

   Implement real‑time synchronization and monitoring to prevent unsynchronised marketing communications.

3. 3

   Train customer‑service staffMedium priority

   Ensure staff provide accurate information on how customers can disable promotional notifications.

4. 4

   Report remedial actions to regulatorMedium priority

   Submit a detailed compliance plan to the Italian DPA within 30 days of the decision.