Italian DPA fines BBVA EUR 5 508 000 for failing to respect a customer’s objection to direct marketing

Controller: Banco Bilbao Vizcaya Argentaria, S.A., Italian branch (BBVA) Legal Reference(s): Article 5 (Principles relating to processing of personal data), Article 12 (Transparent information, communication and modalities for the exercise of the rights of the data subject), Article 21 (Right to object), Article 24 (Responsibility of the controller) Decision: Administrative fine, Compliance order Website topics: Basic principles, Data subjects rights, Marketing The Italian Data Protection Authority (DPA) investigated BBVA, a multinational Spanish banking group, following a complaint from a customer who continued to receive promotional communications through the bank’s mobile app despite having objected to direct marketing. The customer exercised his right to object through the settings provided in the BBVA app and subsequently reiterated his objection to the bank’s Customer Service. Nevertheless, promotional notifications continued for seven months, from October 2025 to May 2026. BBVA explained that the customer’s choice had been correctly recorded but that a technical failure prevented synchronisation between its internal systems and the Customer Relationship Management unit re...