Garante per la protezione dei dati personali (Italy) - 613/2026
Italian DPA fines BBVA €5.5M for sending unsolicited in-app messages after opt-out.
The Italian Data Protection Authority (Garante) has fined the Italian branch of BBVA €5,508,000 for continuing to send in-app communications to a user who had deactivated the feature and objected to the processing. The bank cited a technical error as the cause, but the Garante found this insufficient justification, noting the bank only acted after the DPA intervened and that the user received 10 unsolicited commercial messages.
AI summary of the linked source. Not reviewed by an editor. How this works
Run BBVA?
Get an email when a new story names BBVA, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonThe root cause of this violation was a failure to honour a user's explicit opt-out request due to a technical error in the bank's communication preference management system. Critically, BBVA did not detect or remediate the issue independently — action was only taken after the Garante intervened, indicating a lack of adequate monitoring and internal controls. This matters because GDPR grants individuals the right to object to marketing processing, and organisations are legally obligated to enforce those preferences immediately and reliably. A 'technical error' is not an acceptable defence when the underlying systems lack the controls to validate that consent and preference changes are correctly applied end-to-end.
What helps against this
How we list vendors- Data loss prevention (DLP)
Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.
- Compliance automation (GRC)
Evidence for NIS2, DORA and ISO 27001 is collected continuously, not in a rush before the audit.