BBVA Italy Fined €5.5M for Ignoring User Opt-Out Requests

BBVA Italy continued to send in-app marketing communications to a user even after they explicitly deactivated the feature and formally objected to data processing, with the bank attributing the ongoing violations to a technical error. This case illustrates that relying on system malfunctions as a legal defense does not absolve organizations of GDPR accountability — controllers are responsible for ensuring their technical systems can faithfully implement data subject rights. The failure to honor objection requests violates core GDPR principles including lawful basis, transparency, and the right to object under Articles 6, 12, and 21. This matters because it signals that regulators expect organizations to verify, not merely attempt, that user preference changes are operationally enforced.

Tactical Insight

Immediate actions

Audit all preference management systems to verify that opt-out and objection requests are immediately and completely reflected across all communication channels.
Establish a manual review process to confirm that data subject rights requests have been technically fulfilled within the legally required timeframe.

Long-term improvements

Implement end-to-end automated testing pipelines that validate preference enforcement across all customer-facing systems after any code or configuration change.
Maintain a dedicated Data Subject Rights (DSR) request log that tracks request receipt, processing steps, and verified fulfillment status for audit purposes.
Embed privacy-by-design principles into product development so that consent and objection controls are treated as critical, regression-tested functionality.

Detection & monitoring measures

Deploy monitoring alerts that flag any communication sent to users who have an active opt-out or objection status on record.
Conduct quarterly reconciliation audits comparing marketing communication dispatch logs against the current preference database to identify discrepancies.