On October 9, 2026, the European Data Protection Board announced that the Italian Data Protection Authority fined Banco Bilbao Vizcaya Argentaria (BBVA) EUR 5 508 000. The penalty follows the bank's failure to respect a customer's objection to direct marketing.
Case Background
The Italian Data Protection Authority investigated BBVA's Italian branch following a complaint from a customer. The customer used the settings in the BBVA app to object to direct marketing and later reiterated the objection to Customer Service, but promotional notifications continued for seven months from October 2025 to May 2026.
BBVA explained that while the customer's choice was correctly recorded, a technical failure prevented synchronisation between internal systems and the Customer Relationship Management unit responsible for sending commercial communications.
Regulatory Findings and Decision
The Italian DPA concluded that BBVA infringed Articles 5(1)(a), 12, 21, and 24 of the GDPR by failing to act on the customer's objection correctly and in a timely manner. The regulator rejected BBVA's argument that the customer should have used dedicated email addresses in its privacy policy, stating that controllers must facilitate data subject rights rather than disregard valid requests.
The DPA also identified deficiencies in BBVA's technical and organisational measures, noting that Customer Service provided incorrect information by claiming app notifications could not be disabled. Alongside the EUR 5 508 000 administrative fine, the DPA issued a compliance order requiring BBVA to update its measures and report back within 30 days.
What to do
- Adopt appropriate technical and organisational measures to facilitate the exercise of data subject rights and ensure requests are handled correctly and without undue delay.
- Inform the Italian DPA within 30 days of notification of the decision regarding the measures taken to comply with the order.
Key facts and where they come from
- The Italian DPA imposed an administrative fine of EUR 5 508 000 on BBVA.
Italian DPA fines BBVA EUR 5 508 000 for failing to respect a customer’s objection to direct marketing
- Unsolicited commercial notifications continued for seven months from October 2025 to May 2026.
promotional notifications continued for seven months, from October 2025 to May 2026.
- BBVA must inform the DPA of its compliance measures within 30 days of notification.
BBVA must also inform the DPA, within 30 days of notification of the decision, of the measures taken to comply with the order.