Italian DPA fines BBVA EUR 5 508 000 for failing to respect a customer’s objection to direct marketing

What happened

The Italian Data Protection Authority fined BBVA €5.508 million after a customer’s objection to direct marketing via the bank’s app was ignored for seven months, resulting in multiple unsolicited notifications. The DPA found violations of GDPR Articles 5(1)(a), 12, 21 and 24, citing technical and organisational failures. BBVA must implement measures to honor data‑subject rights and report compliance within 30 days. The fine considered the duration, single data subject impact, and BBVA’s prior record.

Why it matters

Banks using app‑based consent channels must ensure that objection flags are synchronised across all marketing systems instantly, or risk enforcement actions similar to BBVA’s case.

Business impact

Failure to integrate objection handling can lead to costly fines and mandatory system upgrades, affecting marketing operations and customer‑service workflows.

Checklist

• Audit objection handling workflowsHigh priority

  Verify that any opt‑out recorded in mobile apps propagates instantly to all marketing and CRM systems.

• Update technical safeguardsHigh priority

  Implement real‑time synchronization and monitoring to prevent unsynchronised marketing communications.

• Train customer‑service staffMedium priority

  Ensure staff provide accurate information on how customers can disable promotional notifications.

• Report remedial actions to regulatorMedium priority

  Submit a detailed compliance plan to the Italian DPA within 30 days of the decision.

Who reported it

Discussion