Garante per la protezione dei dati personali (Italy) - 613/2026

BBVA Italy failed to honour a data subject's explicit objection to in-app marketing communications, continuing to send messages after the user had deactivated the feature. The bank attributed the failure to a 'technical coordination error' in synchronising user preference changes across its systems, which the Italian DPA (Garante) rejected as insufficient justification. This case illustrates that consent and preference management must be backed by robust, near-real-time technical controls — not manual or loosely coupled processes. Under GDPR, the right to object must be actionable immediately and verifiably enforced, making technical gaps a direct regulatory liability. Organisations that treat preference synchronisation as a low-priority operational task expose themselves to significant fines and reputational damage.