# GDPR Fine Against BBVA for Direct Marketing > Italy’s data protection authority fined BBVA €5.5m for delayed implementation of a marketing objection via its app. Source: https://www.mtrlegal.com/en/gdpr-fine-against-bbva-for-direct-marketing/ · Language: en · Updated: 2026-10-24 --- ## Italian Data Protection Authority Imposes Fine on BBVA The Italian data protection authority Garante per la protezione dei dati personali (Italian Data Protection Authority) has imposed a fine of EUR 5,508,000 on the Italian branch of Banco Bilbao Vizcaya Argentaria, S.A. The decision concerned the handling of a customer’s objection to direct marketing via the bank’s mobile application. The decision ([Provvedimento n. 613](https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/10291895) (Measure No. 613), Registro dei provvedimenti, doc. web n. 10291895) is dated 3 September 2026; the Garante made it public in Newsletter No. 551 of 11 September 2026. The [statement by the European Data Protection Board](https://www.edpb.europa.eu/news/italian-dpa-fines-bbva-eur-5-508-000-for-failing-to-respect-a-customers-objection-to-direct_en) gives a different date, 3 July 2026; the official date is authoritative. The addressee of the decision is the Italian branch of Banco Bilbao Vizcaya Argentaria, S.A., with its registered office at Corso Vittorio Emanuele 9, 20122 Milan. Pursuant to Art. 152 of the Italian Data Protection Code (Codice in materia di protezione dei dati personali) and Art. 10 of D.Lgs. Nr. 150/2011 (Italian Legislative Decree No. 150/2011), an objection to the decision may be brought before the ordinary court. ## Background to the Proceedings ### Objection to Advertising via the BBVA App The trigger for the administrative proceedings was a complaint by a customer. The customer had declared his objection to direct marketing via the settings provided in the mobile BBVA app. In addition, he contacted the bank’s customer service. According to the information relied upon by the authority, the complainant declared his objection to customer service in particular by messages dated 2 October 2025 and 9 December 2025. Nevertheless, he continued to receive advertising communications via the app. According to the supervisory authority’s account, the period of continued notifications extended from October 2025 to May 2026. According to the published information, the complaint was received by the Garante on 11 March 2026. In the further course of the matter, on 28 April 2026 the authority sent the bank a formal request for information under reference Prot. Nr. 64723/26. ### The Bank’s Account of the Technical Process BBVA submitted to the authority that the selection made by the customer had been duly recorded. The continued sending of advertising notifications had been due to a technical error. This error had prevented synchronisation between internal systems and the customer relationship management unit responsible for sending commercial communications. The bank presented the incident to the authority as a specific and isolated technical coordination error between internal systems. According to the published information, two separate email addresses and postal mail were provided for marketing objections. However, these channels were disconnected from the opt-out function in the app. ## Assessment by the Garante ### Effectiveness of the Objection via the App The Garante concluded that BBVA had not properly and promptly implemented the customer’s objection. During the relevant period, according to the authority’s findings, the customer received at least ten unsolicited commercial notifications. The authority did not accept the bank’s argument that the customer should have used the special email addresses stated in the privacy notice. In the Garante’s view, the customer had effectively exercised his right via the app and had additionally contacted customer service. Controllers must facilitate the [exercise of data subject rights](https://www.mtrlegal.com/wiki/betroffenenrechte-im-datenschutz/) and may not disregard a valid declaration solely because it was not transmitted through a preferred channel. According to published specialist reports, the Garante had already emphasised this principle in an earlier proceeding against Verisure in connection with a fine of EUR 400,000. In that case as well, the effectiveness of a marketing objection via various communication channels was at the centre of the matter. ### Deficiencies in Technical and Organisational Measures In addition to the inadequate implementation of the objection, the authority criticised technical and organisational deficiencies. In particular, the Garante relied on the fact that customer service had provided the complainant with incorrect information. The customer had been told that advertising pop-up notifications in the app could not be disabled. BBVA later demonstrated to the authority that such notifications could in fact be stopped. The Garante assessed the bank’s responsibility as being of medium severity. According to the official decision, the decisive factor in particular was that no appropriate organisational measures had been taken, above all no suitable training of customer service staff. ## Established Infringements of the GDPR The Garante found infringements of several provisions of the General Data Protection Regulation (GDPR). According to the decision, the following were affected in particular: - Art. 5(1)(a) GDPR on the principles of lawful, fair and transparent processing, - Art. 12 GDPR on transparent information, communication and modalities for the exercise of data subjects’ rights, - Art. 21 GDPR on the right to object, - Art. 24 GDPR on the responsibility of the controller. In the Garante’s assessment, the infringements were based on interrelated processing operations. The authority therefore applied the capping rule under Art. 83(3) GDPR. Accordingly, the total amount of the administrative fine could not exceed the range applicable to the gravest infringement. ## Content of the Administrative Order ### Fine and Compliance Order The Italian data protection authority imposed an administrative fine of EUR 5,508,000. In addition, it ordered BBVA to take appropriate technical and organisational measures. These are intended to facilitate the exercise of data subject rights and to ensure that corresponding requests are handled correctly and without undue delay. BBVA was also required to inform the authority, within 30 days of service of the decision, of the measures taken to implement the order. The Garante also ordered the publication of the Ordinanza-ingiunzione (injunction order) on the authority’s website. ### Participants in the Administrative Decision The rapporteur was the authority’s president, Pasquale Stanzione. Vice-President Ginevra Cerrina Feroni, member Agostino Ghiglia and Secretary General Luigi Montuori also took part in the meeting. ## Calculation of the Fine In determining the amount of the fine, the Garante took several circumstances into account. According to the statement by the European Data Protection Board, the established infringement related to one data subject, lasted seven months and concerned contact data for marketing purposes. The authority treated the remedial measures taken by BBVA as a mitigating circumstance. As an aggravating factor, it took into account a relevant previous infringement. Specifically, the Garante relied on the earlier Provvedimento Nr. 413 (Measure No. 413) of 10 July 2025 against BBVA. That previous proceeding from July 2025 concerned a complaint in connection with BBVA’s customer service. In that case, the Garante had still taken into account in the bank’s favour that there had been no relevant prior infringements. In the now-decided proceeding, the authority also expressly relied on the fact that the controller has turnover of more than EUR 500 million. In German-language specialist commentary, the fine was counted among the five highest GDPR fines of September 2026. ## Significance for Data Protection and Direct Marketing The decision illustrates the high standards applicable to the practical implementation of objections to direct marketing. What matters is not only whether a data subject is formally referred to certain communication channels. Rather, the decisive question may be whether an objection that has actually been declared is identified, correctly processed internally and effectively implemented. For companies with app-based customer relationships, the case also shows that isolated systems and separate communication channels can create data protection risks. This applies in particular where settings in an app, customer service responses and marketing systems do not interact in such a way that data subject rights are observed without undue delay. Legal issues in connection with data protection, direct marketing, data subject rights and administrative proceedings regularly require a careful assessment of the specific individual case. MTR Legal Rechtsanwälte advises companies, investors and high-net-worth individuals on data protection law matters; further information can be found under [legal advice in data protection law](https://www.mtrlegal.com/rechtsberatung/it-recht/datenschutz/).