Banco de Sabadell Fined for Ignoring Customer Marketing Opt-Out

Banco de Sabadell sent commercial communications to a customer who had explicitly withdrawn consent, then incorrectly attempted to justify the contact as a contractual necessity. The AEPD rejected this argument, affirming that marketing communications require affirmative consent and cannot be reframed as operational necessity. This case highlights how organisations frequently misclassify marketing activities to circumvent consent obligations, exposing themselves to regulatory penalties. Proper consent lifecycle management — from collection through to honouring withdrawal — is a fundamental requirement under e-Privacy and GDPR frameworks.

Tactical Insight

Immediate actions

Audit all active marketing lists to verify that opted-out customers are immediately and fully suppressed across every communication channel.
Establish a clear internal definition distinguishing 'marketing communications' from 'contractual/operational communications' to prevent misclassification.

Long-term improvements

Implement a centralised Consent Management Platform (CMP) that propagates opt-out signals in real time to all downstream marketing and CRM systems.
Train customer-facing and marketing staff on the legal boundaries between legitimate interest, contractual necessity, and consent-based processing.
Conduct periodic compliance audits to verify that consent records are accurate, up to date, and honoured across all business units.

Detection & monitoring measures

Deploy automated monitoring to flag and halt any outbound communications to customers with recorded opt-out status before dispatch.
Maintain detailed logs of consent status changes and communication events to provide an auditable trail in the event of a regulatory investigation.