Garante per la protezione dei dati personali (Italy) - 613/2026
Italy's DPA fines BBVA €5.5M for sending unsolicited in-app messages.
The Italian Data Protection Authority (Garante) has fined the Italian branch of Banco Bilbao Vizcaya Argentaria (BBVA) €5.5 million for persistently sending in-app communications. This occurred even after a data subject deactivated the feature and objected to the processing of their data. The DPA found that BBVA's failure to act on the data subject's request, and their reliance on a technical error, constituted a violation of GDPR articles related to lawful processing, transparency, and the right to object.
AI summary of the linked source. Not reviewed by an editor. How this works
Run BBVA?
Get an email when a new story names BBVA, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonBBVA Italy continued to send in-app marketing communications to a user even after they explicitly deactivated the feature and formally objected to data processing, with the bank attributing the ongoing violations to a technical error. This case illustrates that relying on system malfunctions as a legal defense does not absolve organizations of GDPR accountability — controllers are responsible for ensuring their technical systems can faithfully implement data subject rights. The failure to honor objection requests violates core GDPR principles including lawful basis, transparency, and the right to object under Articles 6, 12, and 21. This matters because it signals that regulators expect organizations to verify, not merely attempt, that user preference changes are operationally enforced.
What helps against this
How we list vendors- Data loss prevention (DLP)
Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.